Connect Apple TV to a pfSense® software firewall

When this setup fits

Use this setup when Apple TV is away from home, for example in a holiday rental, and should connect back to a firewall running pfSense software.

This guide does not cover sending Apple TV traffic at home through a VPN client on the firewall. That setup does not need WaveSocket.

You need:

• an Apple TV with the WaveSocket app, which connects with WireGuard configurations and does not include a VPN service
• administrator access to the firewall and a WAN address that Apple TV can reach
• the WireGuard package; the Netgate® documentation advises upgrading to the latest pfSense Plus or pfSense CE software before installing it
• a phone or computer on the same network as Apple TV for the transfer

In the Netgate example, you write the Apple TV configuration yourself from the tunnel and peer settings, then paste it into WaveSocket.

Set up the WireGuard server

These steps follow the WireGuard remote access example in the Netgate documentation.

1. Install the WireGuard package from the Available Packages tab under System → Packages.
2. Under VPN → WireGuard → Tunnels, add a tunnel. Enable it, set the listen port (51820 in the example), generate the interface keys, give it an address such as 10.6.210.1/24 and select Save Tunnel.
3. Under Firewall → Rules, on the WAN tab, add a Pass rule for UDP to the WAN address on the listen port. On the WireGuard tab, add a rule that allows the tunnel traffic. Save each rule and select Apply Changes.

If your WAN address changes, set up Services → Dynamic DNS and use that hostname as the endpoint.

Create the Apple TV client

1. Create a key pair for Apple TV, for example with wg genkey | tee /dev/stderr | wg pubkey in a console or SSH shell on the firewall. It prints the private key and then the public key without saving files. The Netgate example notes that keys cannot be reused between clients.
2. Under VPN → WireGuard → Peers, add a peer for the tunnel. Enable Dynamic Endpoint, paste the Apple TV public key and set Allowed IPs to its tunnel address, such as 10.6.210.2/32.
3. Save the peer and apply the changes.

Write the client configuration

Replace the placeholders with your own values:

• APPLE_TV_PRIVATE_KEY: the Apple TV private key you created in the previous section
• FIREWALL_TUNNEL_PUBLIC_KEY: the tunnel’s public key under VPN → WireGuard → Tunnels
• vpn.example.com: your WAN address or DDNS hostname
• 10.6.0.0/24: your home network

Address uses the same IP address as the peer’s Allowed IPs (10.6.210.2), but with the tunnel’s mask (/24), as in the example below.

[Interface]
PrivateKey = APPLE_TV_PRIVATE_KEY
Address = 10.6.210.2/24

[Peer]
PublicKey = FIREWALL_TUNNEL_PUBLIC_KEY
AllowedIPs = 10.6.210.1/32, 10.6.0.0/24
Endpoint = vpn.example.com:51820

This example sends only the tunnel and one home network through the VPN. To send all IPv4 traffic, set AllowedIPs = 0.0.0.0/0 and add DNS = 10.6.210.1 to the [Interface] section. IPv6 needs its own tunnel address and ::/0; see routes and your home network.

Import on Apple TV

1. On Apple TV, open WaveSocket and choose Profiles → Add VPN profile → Upload from your browser, then select Start upload session. If a VPN is connected, disconnect first.
2. On a phone or computer on the same network as Apple TV, scan the QR code on the TV or open the address shown. Enter the code shown on the TV in the 4-digit code field.
3. Under Import method, choose Paste configuration text, paste the complete configuration and select Send to Apple TV.
4. Review the profile on Apple TV. Choose Rename to give it a clear name such as Home VPN, then choose Save profile.

Use a trusted network for the transfer. If Apple TV is on a shared network, such as Wi-Fi in a holiday rental, import the profile at home before you take Apple TV there. The import guide explains why the network must be trusted.

Connect and check

Connect when Apple TV is on a network outside your home. A test from inside your home network may not show whether remote access works.

WaveSocket selects the saved profile and opens Connection. Choose Connect. The first time, allow Apple TV to add the VPN configuration. Look for Server verified and a recent time next to Oldest peer handshake age, then open a known home service by its address.

With a DDNS hostname as the endpoint, WaveSocket resolves it before connecting and checks it again while connected; see DNS & server addresses.

Every WaveSocket feature is free for three minutes per connection, so you can try the setup before choosing WaveSocket’s Lifetime access, which removes the time limit.

If it does not connect

• No tunnel. Check that Enable is on under VPN → WireGuard → Settings.
• No handshake. Check that the peer’s public key belongs to the Apple TV private key, and that the client’s PublicKey is the tunnel’s public key. Confirm the WAN rule and that the endpoint resolves to your current WAN address.
• No internet with a full tunnel. Check that Firewall → NAT → Outbound translates the tunnel network (10.6.210.0/24) to the WAN address. If name lookups fail, check Services → DNS Resolver → Access Lists.
• Drops when idle. If another firewall is between Apple TV and the internet, add PersistentKeepalive = 25 to the [Peer] section. For a saved profile, disconnect and set PersistentKeepalive in Edit profile.

These steps are based on the published Netgate documentation as checked on 16 October 2026, not on WaveSocket’s own testing with pfSense software. Menu labels can change between versions; if they do, follow the current documentation. pfSense® is a registered mark owned by Electric Sheep Fencing LLC (“ESF”) and may not be used without the prior express written permission of ESF. Netgate® is a registered mark owned by Rubicon Communications LLC and may not be used without the prior express written permission of Rubicon Communications LLC. WaveSocket is an independent app. Neither this site nor the app is affiliated with or endorsed by ESF or Rubicon Communications LLC.