I made this because I was sick of every app and utility trying to charge you a subscription, and Apple TV VPN clients were especially silly. One wanted $90 upfront to use Apple TV, and the other wanted you to pay monthly. I don't think your Apple TV VPN client should charge you more than your actual VPN, so I decided I'd rather pay for an Apple Developer license out of spite and build my own instead.
I am also a user, and I've included a 3-day trial so you can make sure that it works and meets your needs before buying.
Buy it once and keep it, like the good ol' days.
Use your own WireGuard configuration. No account required.
TunnelTV is a simple, generic WireGuard client for Apple TV with tvOS 17+. Import a standard wg-quick configuration from your VPN provider, a self-hosted server, or any WireGuard-compatible service — then connect from the couch.
TunnelTV does not provide VPN servers, a VPN subscription, or a TunnelTV account. You bring your own configuration.
Coming soon on the App Store
Browser import
Open a URL on your phone or computer, enter the PIN shown on your TV, and paste your config. No USB, no network shares.
Manual entry
Type or paste configuration fields directly on the Apple TV. Pairs well with the iPhone keyboard.
Multiple tunnels
Save and switch between several configurations. Each is a standard system VPN profile.
Live status
See real handshake time, received and sent data — not just a "Connected" indicator.
Always-on reconnect
Optional automatic reconnect after a reboot or network change. One tunnel at a time.
Stale-handshake disconnect
Optional disconnect when a previously-healthy peer stops responding, so you know the tunnel is actually down.
$19.99
One-time purchase. No subscription, no account, no backend.
Includes a 3-day free trial. Works with any standard WireGuard configuration.
Frequently Asked Questions
Does TunnelTV include a VPN service?
No. TunnelTV is a client that connects to your existing WireGuard configuration from a provider or your own server. You bring the config.
What do I need to use it?
An Apple TV (HD or 4K) running tvOS 17 or later, and a standard WireGuard wg-quick configuration file.
How do I import a configuration?
Open the app, choose "Import from Browser," then open the displayed URL on any device on the same network. Enter the PIN shown on your TV, paste your config, and save. You can also enter configuration fields manually.
Is browser import secure?
The import page is served over plain HTTP on your local network, only while the Import screen is open. A one-time PIN (shown on the TV) and a Host-header check prevent unauthorized submissions. Do not use Browser Import on an untrusted network such as public Wi-Fi, hotels, or cafes.
Why does Apple TV ask to add a VPN configuration?
tvOS requires permission before a VPN tunnel can be created. This is a standard system prompt — approve it once per tunnel.
What does "Disconnect on stale handshake" do?
When enabled, the app disconnects if a previously-working WireGuard peer stops responding. This is not a traffic-blocking kill switch — normal routing may resume after the disconnect.
How does the trial work?
You get 3 days of full access starting from first launch. After that, the app requires a one-time $19.99 purchase. Restore Purchases is available if you've already bought the app on another device.
What should I include in a support email?
Your Apple TV model, tvOS version, app version, whether you used Browser Import or manual entry, and a description of the issue. If you have the on-screen tunnel log, include it — but never email a private key or full configuration file.
Compatible with standard WireGuard configurations from any provider, including Mullvad, AirVPN, IVPN, and self-hosted servers.
WireGuard is a registered trademark of Jason A. Donenfeld.