Connect Apple TV to a UniFi gateway

When this setup fits

Use this setup when Apple TV is away from home, for example in a holiday rental, and should connect back through your UniFi gateway to reach services such as a media server by its address.

This guide does not cover sending Apple TV traffic at home through a VPN client on the gateway. That setup does not need WaveSocket.

You need:

• an Apple TV with the WaveSocket app, which connects with WireGuard configurations and does not include a VPN service
• a UniFi Gateway or UniFi Cloud Gateway with the UniFi Network application
• a public IP address on the gateway, or a port forwarded to it by another router between the gateway and the internet
• a phone or computer on the same network as Apple TV for the transfer

UniFi Teleport is a different feature. It uses invitations in Ubiquiti’s WiFiman app rather than a WireGuard configuration file.

Set up the WireGuard server

These steps follow Ubiquiti’s WireGuard VPN server article.

1. In UniFi Network, open Settings → VPN and create a WireGuard VPN server. The default port is UDP 51820.
2. If another router is between the gateway and the internet, forward UDP port 51820 on that router to the gateway’s WAN address. Ubiquiti recommends a gateway with direct access to a public IP.
3. If your public address changes, first get a hostname from a Dynamic DNS provider that UniFi supports, such as Cloudflare or No-IP. Then create a Dynamic DNS entry in Settings → Internet so clients can use the hostname. Ubiquiti’s Dynamic DNS needs a public IP on the gateway. Behind another router, use that router’s DDNS, or put that router in bridge mode so the gateway gets the public IP.

Create the Apple TV client

1. In the WireGuard server, open Clients → Add Client and enter a name such as Apple TV.
2. Select Download Configuration File and keep the file private.
3. Select Add, then Apply Changes.

Create a separate client for each device. Ubiquiti does not document fixed defaults for Endpoint, AllowedIPs and DNS, so check them in the file itself. If Endpoint shows a private address, such as one in 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 or 100.64.0.0/10, or shows your public IP address while you use Dynamic DNS, replace it with your public address or DDNS hostname before sending the file, and keep the port. After importing, you can also change Server in Edit profile while disconnected. For AllowedIPs, see routes and your home network.

Import on Apple TV

1. On Apple TV, open WaveSocket and choose Profiles → Add VPN profile → Upload from your browser, then select Start upload session. If a VPN is connected, disconnect first.
2. On a phone or computer on the same network as Apple TV, scan the QR code on the TV or open the address shown. Enter the code shown on the TV in the 4-digit code field.
3. Select Choose file, pick the .conf file and select Send to Apple TV.
4. The review on Apple TV shows Server and Allowed IPs; check them. Choose Rename to give the profile a clear name such as Home VPN, then choose Save profile.

Use a trusted network for the transfer. If Apple TV is on a shared network, such as Wi-Fi in a holiday rental, import the profile at home before you take Apple TV there. The import guide explains why the network must be trusted.

Connect and check

Connect when Apple TV is on a network outside your home. Ubiquiti notes that reaching the public address from inside your home network can fail behind another router.

WaveSocket selects the saved profile and opens Connection. Choose Connect. The first time, allow Apple TV to add the VPN configuration. Look for Server verified and a recent time next to Oldest peer handshake age, then open a known home service by its address.

With a DDNS hostname as the endpoint, WaveSocket resolves it before connecting and checks it again while connected; see DNS & server addresses.

Every WaveSocket feature is free for three minutes per connection, so you can try the setup before choosing WaveSocket’s Lifetime access, which removes the time limit.

If it does not connect

• No public address. A WAN address in 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 or 100.64.0.0/10 is not public. Ubiquiti suggests asking your internet provider for a public IP, or using bridge mode on the provider’s router to remove double NAT.
• Testing from home. Test from outside your home network; see Ubiquiti’s port forwarding article.
• Same address range. Avoid using the same private address range at home and on the network where Apple TV is used.

These steps are based on Ubiquiti’s published documentation as checked on 16 October 2026, not on WaveSocket’s own testing with UniFi. They follow its WireGuard VPN server article and, for the client labels, its site-to-site WireGuard article for the UniFi Mobile Router. Labels in UniFi Network can change; if they do, follow Ubiquiti’s current help articles. UniFi is a registered trademark of Ubiquiti Inc. WaveSocket is an independent app, not affiliated with or endorsed by Ubiquiti Inc.