How to put an Apple TV behind a VPN without a router

If you have read that an Apple TV can only get a VPN from a router, that advice is out of date. Since tvOS 17, Apple has allowed third-party VPN apps on the box itself, so the television can hold the tunnel the way a phone does. What has not changed is that a VPN running on your Mac or phone covers only that device, however close it sits to the TV. Pick the placement first, app on the TV or gateway in front of it, and the rest of the setup follows from that choice.

The router-only advice was true once

Older guides were not wrong at the time. tvOS had no third-party VPN apps, so the only way to move the TV's traffic through a tunnel was to put a gateway in front of it or share a Mac's connection. The tvOS 17 release changed the first half of that, because VPN apps became installable on Apple TV.

Availability is not the same as universal support. The app has to be listed for your region and your box, its minimum tvOS version has to be met, and the protocol it speaks has to match the gateway you actually own.

What the tvOS app can and cannot do

A VPN app on Apple TV behaves like the same app on a phone. It installs a profile, opens a tunnel and routes the device's traffic through it; you sign in inside the app or with a device-code flow, choose a location and connect. There is no terminal and no configuration editor, so a provider that only ships a desktop client or a hand-edited WireGuard file has nothing to install here.

Two limits catch people out. The app routes what tvOS lets it route, so a streaming service that pins certificates or uses its own resolver may still object even though your exit address changed. And an app built for a newer tvOS release than your box runs will not install at all. Check both before buying a subscription for this purpose.

Household accounts matter too. A VPN app signed in to one Apple ID is a device-level tunnel, not a per-viewer setting, so everyone using that TV shares the exit location you selected.

When a gateway is still the right answer

A gateway wins when you want one rule for several devices, when the provider has no tvOS app, or when the tunnel must survive the TV being reset or replaced. A router running the VPN client, or a small box acting as the TV's default gateway, moves the traffic without anything installed on the television.

That arrangement needs two things people skip: a stable address for the TV and a defined failure behaviour. Give the TV a DHCP reservation so the routing rule keeps matching, then decide whether it falls back to the plain connection or loses internet when the tunnel drops. Include DNS in that decision, because a gateway that forwards traffic while leaking queries to the ISP resolver has not finished the job.

The rule itself is usually by source address or by network segment. Put the TV on its own VLAN if the router supports it, send that segment through the tunnel, and leave the rest of the house on the normal path. Writing it that way also makes the rule readable six months later.

A VPN on your Mac is not a TV VPN

This is the myth that survives longest, because the setup looks like it should work. macOS Internet Sharing can hand the TV an address and forward its traffic, but it forwards through whatever upstream the Mac is using at that moment. A VPN client running on the Mac does not automatically become that upstream, and some clients deliberately exclude forwarded traffic so they never loop packets through themselves. Depending on the macOS release, the sharing panel may or may not list your VPN service, and even when it does, a client that excludes forwarded traffic will not carry the TV.

If you want the Mac to act as the gateway, use a client that documents gateway mode for other devices, and verify from the television rather than from the Mac.

Test from the TV, not from your phone

The only evidence that counts is what the TV reports. Open a browser or a network-info app on the TV and read the public address it sees, or check the router's log for the TV's address leaving through the tunnel. A phone on the same Wi-Fi proves nothing about the television's path.

Then test the failure path. Disconnect the tunnel and confirm the TV behaves the way you decided earlier; if it silently drops back to the ordinary connection, you have a leak rather than a fallback.

Work through this list once and the setup stays stable: confirm the model and tvOS version, install the provider's app from the App Store or configure the gateway, add a DHCP reservation if a rule depends on the address, decide DNS and the disconnected state, and verify from the TV itself. If the app installs but the stream still fails, the cause is usually the service's own account rules rather than the tunnel.