Secure your internet traffic on public Wi-Fi using an Apple TV

When you connect to public Wi-Fi in places like hotels, airports, or cafés, your internet activity gets exposed to others on the same public network. This exposure can put your privacy at risk when you check email, log in to bank accounts, use cloud services, or engage in any other activity involving your personal information.

By routing your internet traffic through your Apple TV, you protect that activity. Your device creates a secure, encrypted connection to your Apple TV, which then sends your traffic to the internet using your home network. This process keeps your browsing private, even while you use unfamiliar or unsecured networks. We also refer to this type of traffic routing as an exit node.

In addition to improving privacy, routing traffic through your Apple TV can help with location-based access. Some websites and streaming platforms only allow connections from your home country or region. By sending traffic through the Apple TV, those services identify it as coming from your home network, which can allow access to region-locked content.

The benefits of routing your Tailscale network (known as a tailnet) traffic using an Apple TV include:

Use a device you may already own. No need for extra hardware or network configuration.
Apple TVs are typically always on and connected to your home internet, making them a reliable option for routing traffic when you're away.
Tailscale is free with the Personal plan that supports up to 3 users and 100 devices.
The Tailscale app for Apple TV is free and available in the Apple App Store.

Prerequisites

To follow this guide, you need:

A device such as a phone or laptop to log in and create the tailnet. Tailscale runs on most operating systems, including Linux, Windows, macOS, iOS, and Android.
An email account that uses a single sign-on (SSO) identity provider, such as Apple, Google, or Microsoft.
An Apple TV HD or Apple TV 4K running tvOS version 17 or later.

Step 1: Create your tailnet

To create your own tailnet, download and install the client on a device such as a phone or laptop, and log in using your existing identity provider. Choose the Personal option and follow the remaining instructions to complete the process. Your personal tailnet is now configured and ready to use.

Now go to the Machines page of the admin console, confirming it's connected to your tailnet. The admin console is where you can manage the users, devices, and permissions for your tailnet.

Next you'll configure Tailscale on your Apple TV.

Step 2: Install and configure Tailscale on your Apple TV to route traffic

To install Tailscale on your Apple TV, open the App Store, search for the Tailscale app, and download it. Once installed, open the app, follow the prompts, and grant any requested permissions.

Launch the app and select Connect to add the Apple TV to your tailnet. A QR code will appear on screen. You can scan it with your phone or enter the provided URL into a browser on another device. This step signs you in and authorizes the Apple TV to join your tailnet. To confirm the connection, go to the Machines page of the admin console and look for the Apple TV in the device list.

Now open the Tailscale app on the Apple TV and go to the Exit Node section. Select Run as Exit Node. Then, in the Machines page of the admin console, find the Apple TV in the list, select the button, choose Edit route settings, and toggle Use as exit node to enable it. Other devices in your tailnet can now route their traffic through your Apple TV.

Next you'll configure devices to use the Apple TV to route traffic.

Step 3: Configure devices to use Apple TV for traffic routing

To configure a device to route its traffic through your Apple TV, open the Tailscale app on a device, go to the Exit Nodes section, and select the Apple TV. The instructions for enabling an exit node vary depending on the device's operating system.

Android iOS Linux macOS tvOS Windows

Run tailscale set with the --exit-node= flag, passing the Tailscale IP address of the exit node.

sudo tailscale set --exit-node=<exit-node-ip>

You can find the IP address for the device from the admin console or by running tailscale status.

Alternatively, set --exit-node-allow-lan-access to true to allow direct access to your local network when routing traffic through an exit node.

sudo tailscale set --exit-node=<exit-node-ip> --exit-node-allow-lan-access=true

To stop using an exit node, run the --exit-node flag without passing in an IP address.

sudo tailscale set --exit-node=

Now the device's internet traffic will be securely routed through the Apple TV's network connection.

Conclusion

In this guide, you configured your Apple TV as a secure routing point for your tailnet. This setup gives you an always-available way to protect your network traffic, whether you're on public Wi-Fi, traveling, or working remotely. By sending traffic through your home network, you maintain a trusted connection and can access region-specific content.

Further exploration

Add additional devices to your tailnet.
Invite other users to your tailnet to let them route their device traffic.
Configure VPN On Demand on iOS and macOS devices to automatically enable traffic routing to your Apple TV when you leave your home.
Configure shortcuts on iOS and macOS devices to enable or disable routing through your Apple TV.
Configure your Apple TV as a subnet router to let you remotely access home network resources that don't have Tailscale installed, such as printers or smart home devices.
Refer to Install Tailscale on an Apple TV for more information and troubleshooting tips.