Connect Apple TV to a Firewalla box

When this setup fits

Use this setup when Apple TV is away from home, for example in a holiday rental, and should connect back through your Firewalla box. Firewalla’s VPN server is meant for connections from outside your home network.

This guide does not cover sending Apple TV traffic at home through a VPN client on the router. That setup does not need WaveSocket.

You need:

• an Apple TV with the WaveSocket app, which connects with WireGuard configurations and does not include a VPN service
• a Firewalla box other than Firewalla Red or the original Firewalla Blue, which do not support the WireGuard VPN server (Blue Plus does)
• a public IPv4 or IPv6 address at home; it does not have to be static
• the Firewalla app, and a phone or computer on the same network as Apple TV for the transfer

Firewalla can also run an AmneziaWG server as a beta feature, with Firewalla app 1.68 and box software 1.982 or later. Its client configurations use AmneziaWG 1.5. The optional upgrade to 2.0 needs app 1.69 and box software 1.983 or later, cannot be undone, and requires importing every client configuration again; see Firewalla’s AmneziaWG guide. WaveSocket imports compatible AmneziaWG client configurations; see WireGuard & AmneziaWG.

Set up the WireGuard server

These steps follow Firewalla’s WireGuard VPN server guide.

1. In the Firewalla app, tap VPN Server on your box’s main page, then turn on WireGuard.
2. In Router mode with a public IP and no double NAT or carrier-grade NAT, there is nothing to forward. If another router is between your Firewalla box and the internet, forward UDP port 51820 on that router to your Firewalla box. The setup page shows when manual port forwarding is needed.

Firewalla provides a DDNS hostname for your box; keep DDNS turned on, because the VPN server relies on it. If your Firewalla box was installed less than an hour ago, Firewalla says its DDNS hostname can take up to an hour to work.

Create the Apple TV client

1. Under WireGuard, choose Setup → Add a Client. Firewalla creates the client automatically.
2. Tap the client to show its configuration and QR code.

Create a separate client for Apple TV. Firewalla says one client configuration must not be used on more than one device at the same time. To remove access later, choose Delete This Client at the bottom of the client’s page.

Apple TV cannot read the QR code. In the next step, upload the client configuration as a .conf file or paste its complete text.

Import on Apple TV

1. On Apple TV, open WaveSocket and choose Profiles → Add VPN profile → Upload from your browser, then select Start upload session. If a VPN is connected, disconnect first.
2. On a phone or computer on the same network as Apple TV, scan the QR code on the TV or open the address shown. Enter the code shown on the TV in the 4-digit code field.
3. Select Choose file and pick the .conf file, or choose Paste configuration text under Import method and paste the complete configuration. Then select Send to Apple TV.
4. Review the profile on Apple TV. Choose Rename to give it a clear name such as Home VPN, then choose Save profile.

Use a trusted network for the transfer. If Apple TV is on a shared network, such as Wi-Fi in a holiday rental, import the profile at home before you take Apple TV there. The import guide explains why the network must be trusted.

Connect and check

Connect when Apple TV is on a network outside your home. Firewalla says a test from inside your home network can fail even when remote access works.

WaveSocket selects the saved profile and opens Connection. Choose Connect. The first time, allow Apple TV to add the VPN configuration.

Firewalla notes that a WireGuard client can show as connected when the tunnel does not work. Look for Server verified and a recent time next to Oldest peer handshake age in WaveSocket, and for the Apple TV under Active VPN Connections in the Firewalla app.

The client configuration uses your box’s DDNS hostname. WaveSocket resolves it before connecting and checks it again while connected; see DNS & server addresses.

Every WaveSocket feature is free for three minutes per connection, so you can try the setup before choosing WaveSocket’s Lifetime access, which removes the time limit.

If it does not connect

See Firewalla’s VPN troubleshooting for the full list. Common causes:

• Testing from home. Test from a network outside your home.
• Carrier-grade NAT. If your home connection is behind carrier-grade NAT, you can change the server’s DDNS settings in the Firewalla app to use another WAN connection with a public IP, or to use IPv6 only. With IPv6 only, Apple TV’s network also needs working IPv6; in WaveSocket, disconnect, open Edit profile, choose IPv6 only for the server under Server DNS / DDNS and select Save. If neither option is available, ask your internet provider for a public IPv4 or IPv6 address.
• Changed settings. After changing the MTU, import the client configuration again. After changing the VPN port, Firewalla says you may have to regenerate the client; import the new configuration.

For reaching devices at home, see routes and your home network.

These steps are based on Firewalla’s published documentation as checked on 16 October 2026, not on WaveSocket’s own testing with Firewalla. Labels in the Firewalla app can change; if they do, follow its current help pages. Firewalla is a trademark of its owner. WaveSocket is an independent app, not affiliated with or endorsed by Firewalla.