Connect Apple TV to an OPNsense firewall

When this setup fits

Use this setup when Apple TV is away from home, for example in a holiday rental, and should connect back through a firewall running OPNsense®. OPNsense calls this a Road Warrior setup.

This guide does not cover sending Apple TV traffic at home through a VPN client on the firewall. That setup does not need WaveSocket.

You need:

• an Apple TV with the WaveSocket app, which connects with WireGuard configurations and does not include a VPN service
• administrator access and a WAN address that Apple TV can reach
• OPNsense 24.1.6 or later: WireGuard is built in since 24.1, and the peer generator has a DNS field since 24.1.6
• a phone or computer on the same network as Apple TV for the transfer

The Save button and the Store private key on this firewall option named below need OPNsense 26.7.3 or later. In older versions, use the check-mark button next to Store and generate next; the private key is then never stored.

Set up the WireGuard server

These steps follow the OPNsense WireGuard Road Warrior guide.

1. Under VPN → WireGuard → Instances, add an instance. Use the cogwheel to generate its keys, set a listen port such as 51820 and a tunnel address such as 10.10.10.1/24, then save the instance.
2. Turn on Enable WireGuard, shown below the Instances and Peers lists, and select Apply.
3. Under Firewall → Rules → WAN, add a Pass rule for UDP to the WAN address on the listen port.
4. Under Interfaces → Assignments, assign the WireGuard device (such as wg1). Open the new interface, enable it, save and select Apply changes. Then restart WireGuard: turn Enable WireGuard off and on again, selecting Apply each time.
5. Add a firewall rule on that interface that allows Apple TV to reach the networks or devices you choose. The OPNsense guide explains when outbound Source NAT and an Unbound DNS reload are needed.

For a changing WAN address, install the os-ddclient plugin from System → Firmware → Plugins and set it up under Services → Dynamic DNS.

Create the Apple TV client

1. Open VPN → WireGuard → Peer generator and select your instance.
2. Enter the Endpoint: your public address or DNS name with the port, such as vpn.example.com:51820.
3. Give the peer a name such as Apple TV and check the proposed Address. Allowed IPs proposes all traffic (0.0.0.0/0,::/0) unless the instance stores its own value (26.7.3 or later). To reach only your home network, enter the tunnel and home networks, such as 10.10.10.0/24, 192.168.1.0/24. Any DNS server you set must be inside these networks.
4. To use OPNsense for name lookups, set DNS Servers to the tunnel address, such as 10.10.10.1. While connected, WaveSocket uses this address as the tunnel DNS, so Unbound on OPNsense must answer queries from the tunnel network.
5. Copy the complete text from the Config field. Then select Save, followed by Apply.

Copy the text before saving. Unless you turn on Store private key on this firewall, OPNsense keeps only the public key and cannot rebuild the configuration later. Generate a new peer if you lose it.

Import on Apple TV

1. On Apple TV, open WaveSocket and choose Profiles → Add VPN profile → Upload from your browser, then select Start upload session. If a VPN is connected, disconnect first.
2. On a phone or computer on the same network as Apple TV, scan the QR code on the TV or open the address shown. Enter the code shown on the TV in the 4-digit code field.
3. Under Import method, choose Paste configuration text, paste the complete configuration and select Send to Apple TV.
4. Review the profile on Apple TV. Choose Rename to give it a clear name such as Home VPN, then choose Save profile.

Use a trusted network for the transfer. If Apple TV is on a shared network, such as Wi-Fi in a holiday rental, import the profile at home before you take Apple TV there. The import guide explains why the network must be trusted.

Connect and check

Connect when Apple TV is on a network outside your home. A test from inside your home network may not show whether remote access works.

WaveSocket selects the saved profile and opens Connection. Choose Connect. The first time, allow Apple TV to add the VPN configuration. Look for Server verified and a recent time next to Oldest peer handshake age, then open a known home service by its address. In OPNsense, VPN → WireGuard → Status shows the peer’s last handshake.

With a DDNS hostname as the endpoint, WaveSocket resolves it before connecting and checks it again while connected; see DNS & server addresses.

Every WaveSocket feature is free for three minutes per connection, so you can try the setup before choosing WaveSocket’s Lifetime access, which removes the time limit.

If it does not connect

• No handshake. Check the WAN rule and that the endpoint points to your current public address.
• Some apps do not load. If the handshake works but some apps stall or load only partly, review the MTU and the Normalization (MSS clamping) rules in the OPNsense guide. In WaveSocket, disconnect and adjust MTU in Edit profile. If the configuration has no MTU line, WaveSocket uses 1280.
• Behind carrier-grade NAT or another router. Either can block incoming connections. Ask your internet provider for a public IP address, or forward the port on the router between OPNsense and the internet. The OPNsense documentation does not cover this case.

For routes and overlapping networks, see routes and your home network.

These steps are based on the published OPNsense documentation as checked on 16 October 2026, not on WaveSocket’s own testing with OPNsense. Menu labels can change between versions; if they do, follow the current documentation. OPNsense® is a registered trademark of its owner. WaveSocket is an independent app, not affiliated with or endorsed by the OPNsense project or Deciso B.V.