UniFi on Apple TV — a WireGuard VPN back to your home network

Your UniFi gateway can run a WireGuard VPN server, and your phone and laptop already use it from the road. The travel Apple TV is the exception: Teleport needs Ubiquiti's own client apps and there is none for tvOS, so the TV stays outside. The fix is not a UniFi app — it is a WireGuard client. WG Connect is an independent one for tvOS, and it takes the same client configuration your gateway hands to any other device.

The shape of the setup

The UniFi gateway at home is the WireGuard server. The Apple TV — in a hotel, a holiday flat or a second home — runs WG Connect as the client. One encrypted tunnel between them, and the Apple TV ends up with an address that routes into your home LAN.

  ┌──────────┐                        ┌─────────────┐
  │ Apple TV │ ── encrypted tunnel ──▶│ UniFi gwy   │
  │ (hotel)  │                        │ (WireGuard) │
  └──────────┘                        └──────┬──────┘
                                             │
                                             ▼
                                    ┌──────────────────┐
                                    │ Plex · NAS · Pi  │
                                    │ Cameras · Photos │
                                    └──────────────────┘
  

Nothing is relayed through a third-party cloud. Traffic goes from the Apple TV straight to your home connection.

Getting a WireGuard config from UniFi

WireGuard VPN server configuration lives in the VPN area of the UniFi Network application, where you create a server and then add the clients allowed to use it. Exactly what that area is called and where it sits has moved between Network application versions, and which models support it varies — so use Ubiquiti's current documentation for your controller version and treat the outline below as the concept rather than a click path.

1. In the Network application's VPN section, create a WireGuard VPN server if you do not already have one, and note the port it listens on
2. Add a client entry specifically for the Apple TV, separate from your phone and laptop
3. Download the client configuration UniFi produces for that entry — this is the .conf file. A QR code is usually offered alongside it, which the Apple TV cannot use
4. Open the file and check the Endpoint and AllowedIPs lines before you import it (see below)
5. Make sure your gateway is actually reachable from outside on that UDP port

Give the Apple TV its own client entry. Two devices sharing one WireGuard key will contend for the same tunnel and the connection will flap between them. A separate entry also means you can revoke the TV on its own when it is replaced or sold.

Split tunnel or full tunnel?

• Split tunnel — AllowedIPs limited to your home subnets, e.g. 192.168.1.0/24. Only home traffic goes through the tunnel; Netflix, YouTube and the App Store use the local connection. Lower latency for everyday streaming, no privacy benefit for general traffic.
• Full tunnel — AllowedIPs = 0.0.0.0/0, ::/0. Everything is routed home, so the Apple TV appears to be at your home address and the untrusted hotel network sees only encrypted UDP. Your home upload speed becomes the ceiling for all streaming.

For a travel Apple TV, full tunnel is normally what you want: the TV then behaves exactly as it does in the living room, region-locked apps included. You can edit the AllowedIPs line in the downloaded file before importing if the default is not what you want.

Importing it into WG Connect

The Apple TV has no camera, so the QR code shown next to the download in the Network application is not usable on the TV. WG Connect reverses the direction — the television shows a QR code and your phone scans it. Four ways in:

1. Upload from phone (easiest). On the Apple TV: Add Profile → Upload from Phone. The TV displays a QR code; scan it with the phone holding the downloaded .conf, on the same Wi-Fi. A small upload page opens, you pick the file, and it transfers to the TV over the local network.
2. Paste the config text. Open the .conf in a text editor, copy it whole, and paste it into WG Connect.
3. Import from a URL. WG Connect can fetch the file from an address you provide. Only use hosts you control — the file contains a private key.
4. Manual entry. Type in private key, address, DNS, peer public key, endpoint and allowed IPs by hand.

WG Connect reads the file and detects the protocol automatically. A UniFi client config is standard WireGuard, so that is what it uses; there is no protocol setting to get wrong. The same importer also recognises AmneziaWG configs from other sources, and the profile screen shows which protocol was detected.

What to expect once connected

• The tunnel comes up in about a second. If it sits at "connecting", the usual cause is that the gateway is not reachable on the WireGuard port from outside — CGNAT on your home connection, a double-NAT setup, or an endpoint address that has changed.
• Plex and Infuse find the home server. Plex's local discovery sees your media server as if the TV were on the LAN, and Infuse can browse SMB or NFS shares directly — no relay, no transcoding penalty.
• Home upload speed is the limit. Check upload rather than download: about 25 Mbps for 1080p, 50–100 Mbps for 4K direct play.
• Latency does not matter for video. Streaming buffers absorb well over 100 ms of round-trip time.
• Your network policies still apply. Traffic arriving over the VPN is traffic on your home network, so any filtering or firewall policy you have configured on the gateway continues to apply to the Apple TV.
• Always-on survives reboots. Enable it in WG Connect's settings and the tunnel re-establishes after a power cut or a tvOS update — worth doing for a TV in another building.
• Idle tunnels cost nothing. WireGuard sends no traffic when the network is unused.

Frequently asked questions