Provider guide · pfSense

pfSense on Apple TV — a WireGuard tunnel back to your home network

Q: Do I need firewall rules for the WireGuard interface?

Yes. Two sets: a WAN rule permitting inbound UDP to your WireGuard listen port, and rules on the WireGuard interface or group permitting traffic from the tunnel to reach the LAN resources you want. This is the most common reason a tunnel comes up but nothing is reachable through it.

You already terminate WireGuard on pfSense for your laptop and phone. The travel Apple TV is the device that never got a client, so Plex, the NAS and the rest of the LAN stay unreachable the moment the TV leaves the house. pfSense speaks plain WireGuard, so all the Apple TV needs is a WireGuard client — WG Connect is an independent one for tvOS.

The shape of the setup

pfSense is the WireGuard server on your home network. The Apple TV runs WG Connect as the client. One encrypted tunnel connects them, and the Apple TV ends up with an address on the tunnel subnet that routes into your LAN.

  ┌──────────┐                        ┌─────────────┐
  │ Apple TV │ ── encrypted tunnel ──▶│   pfSense   │
  │ (hotel)  │                        │ (WireGuard) │
  └──────────┘                        └──────┬──────┘
                                             │
                                             ▼
                                    ┌──────────────────┐
                                    │ Plex · NAS · Pi  │
                                    │ Cameras · Photos │
                                    └──────────────────┘

WireGuard on pfSense

WireGuard on pfSense is provided as a package rather than being present in a bare install, and it is configured under the VPN section of the web interface, where you define one or more tunnels and attach peers to them. Consult the current pfSense documentation for the exact steps and for anything version-specific — the details have changed between releases, and this page deliberately does not reproduce a menu path that may be out of date.

What matters conceptually is small and stable:

A tunnel on the firewall, with its own key pair, a listen port (51820 by convention) and a tunnel subnet such as 10.6.0.1/24
An interface assigned to that tunnel, so you can write firewall rules against it
A peer for the Apple TV, holding the TV's public key and its allowed address inside the tunnel subnet, e.g. 10.6.0.5/32
A WAN rule permitting inbound UDP to the listen port
Rules on the WireGuard interface or group permitting tunnel traffic to reach the LAN resources you actually want reachable

The rule that catches everyone

A tunnel that handshakes successfully but reaches nothing is almost always a firewall-rule problem, not a key problem. You need both the WAN rule that lets the handshake in and rules on the WireGuard interface that let the tunnel's traffic through to the LAN. Check the handshake timestamp on the peer first: if it is recent, the crypto is fine and the problem is routing or filtering.

Building the client config

pfSense's WireGuard package is built around configuring the firewall, not around emitting client files, so you generally assemble the Apple TV's .conf yourself. It is a short file, and you write it once per device:

  [Interface]
  PrivateKey = <Apple TV private key>
  Address    = 10.6.0.5/32
  DNS        = 10.6.0.1

  [Peer]
  PublicKey  = <pfSense tunnel public key>
  Endpoint   = home.example.org:51820
  AllowedIPs = 0.0.0.0/0, ::/0
  PersistentKeepalive = 25

Keys. Generate a key pair for the Apple TV. Its private key goes in the client file; its public key goes into the peer entry on pfSense. The firewall's public key goes in the client's [Peer] block. The firewall's private key never leaves the firewall.
Endpoint. Use a hostname, not a bare IP, unless your ISP gives you a static address. pfSense supports dynamic DNS, or use a free provider such as DuckDNS, so the config keeps working when your address changes.
DNS. Pointing at the firewall lets the Apple TV resolve internal hostnames. Leave it out if you would rather the TV keep using the local network's resolver.
PersistentKeepalive. 25 seconds keeps the tunnel alive through NAT on hotel networks. Worth having on a client that sits behind someone else's router.

Split tunnel or full tunnel?

Split tunnel — AllowedIPs = 192.168.1.0/24 (your LAN) plus the tunnel subnet. Only home traffic is routed home; streaming apps use the local connection. Lower latency, no privacy benefit for general traffic.
Full tunnel — AllowedIPs = 0.0.0.0/0, ::/0. Everything goes home, so the Apple TV appears to sit at your home address and the untrusted network sees only encrypted UDP. Requires outbound NAT on pfSense for the tunnel subnet, and your home upload speed becomes the ceiling.

For a travel Apple TV, full tunnel is usually what people want: the TV then behaves exactly as it does in the living room, region-locked services included.

Importing it into WG Connect

An Apple TV has no camera, so it cannot scan a WireGuard QR code. WG Connect reverses the flow — the TV shows a QR code and your phone scans it. Four ways in:

Upload from phone (easiest). On the Apple TV: Add Profile → Upload from Phone. The TV displays a QR code; scan it with the phone holding the .conf, on the same Wi-Fi. A small upload page opens, you pick the file, and it transfers to the TV over the local network.
Paste the config text. Since you wrote the file by hand anyway, copying and pasting the text straight in is often the fastest route.
Import from a URL. WG Connect can fetch the file from an address you supply — use only hosts you control, as the file contains a private key.
Manual entry. Type the fields in directly: private key, address, DNS, peer public key, endpoint, allowed IPs.

WG Connect detects the protocol from the file. A pfSense config is plain WireGuard and is treated as such; if you later bring an AmneziaWG config from elsewhere, the same importer recognises it and the profile screen shows which protocol is in use.

What to expect once connected

Handshake in about a second. If the profile hangs, check that inbound UDP on the listen port genuinely reaches pfSense and that your dynamic DNS name resolves to your current address.
Plex and Infuse see the home LAN. Local server discovery and SMB or NFS browsing work as if the TV were at home, assuming your interface rules allow it.
Home upload is the bottleneck. Check upload rather than download: around 25 Mbps for 1080p, 50–100 Mbps for 4K direct play.
Latency is a non-issue for video. Streaming buffers absorb well over 100 ms.
Always-on reconnects itself. Enable it in WG Connect's settings so the tunnel returns after a power cut or a tvOS update without anyone touching the remote.
Idle tunnels cost nothing beyond the keepalive packet, so there is no reason to disconnect between trips.

Independent app

WG Connect is an independent WireGuard and AmneziaWG client for tvOS, built by HANSEN AI. It is not affiliated with, endorsed by, or sponsored by pfSense or its maintainers. All trademarks are the property of their respective owners.

Frequently asked questions

Does pfSense generate a client .conf file for me?

Generally not. pfSense's WireGuard support is oriented around tunnels and peers on the firewall itself, so you typically write the client configuration yourself from values you already have: the client's private key, its tunnel address, the firewall's public key, and the WAN endpoint and port. It's a short file and you only build it once per device.

Which WireGuard keys go where?

Generate a key pair for the Apple TV. The Apple TV's private key goes in the client config's [Interface] section; its public key goes into the peer entry you create on pfSense. The firewall's own public key goes in the client config's [Peer] section. Never put the firewall's private key in a client config.

Do I need firewall rules for the WireGuard interface?

Yes — two sets. A WAN rule permitting inbound UDP to your WireGuard listen port, and rules on the WireGuard interface or group permitting traffic from the tunnel to reach the LAN resources you want. This is the most common reason a tunnel comes up but nothing is reachable through it.

Can the Apple TV scan a WireGuard QR code?

No — an Apple TV has no camera. WG Connect works the other way round: the TV shows a QR code, your phone scans it and opens a small upload page on the same Wi-Fi, and the .conf transfers to the TV over the local network. You can also paste the config text, import it from a URL, or type the fields in manually.

Will Plex and Infuse work over the tunnel?

Yes, provided your firewall rules allow it. The Apple TV holds an address on the tunnel subnet and routes into your LAN, so Plex's local discovery and Infuse's SMB or NFS browsing behave as if the TV were at home. Your home upload speed is the ceiling: about 25 Mbps for 1080p, 50–100 Mbps for 4K direct play.

What does WG Connect cost, and what does it require?

A one-time purchase — no subscription, no account, no tracking — with Family Sharing support. A free tier lets you verify the tunnel works first, with sessions limited to 120 seconds each. It needs an Apple TV running tvOS 17 or later.

Download on the

App Store