VPN on Android TV: install, connect, verify

An Android TV has no keyboard and no mouse, and that single fact decides how a VPN app has to be built: every control must be reachable with the arrows of a remote. ForestVPN's Android client has a layout for that, and this page walks it screen by screen, ending on the one screen that tells you whether the tunnel carries data.

The screens come from our own run, not stock images. Read the method first: it sets what this page can and cannot claim.

What did this run test, and what did it not?

This run tested one thing, ForestVPN's Android TV layout, from idle to a running tunnel, on an emulator. It did not test a real TV, Google Play, sign-in pairing or throughput.

That is the whole measurement: one run, one network, and no promise about your TV.

What do I need, and what are the steps?

You need a TV or box running Android TV or Google TV with Google Play, its remote (or a game pad), and a network connection. Remote navigation uses the D-pad, the four-way arrow pad on the remote, plus the select button in its middle.

1. Open Google Play on the TV.
2. Search for ForestVPN and install the app.
3. Open the app. It lands on the Connect tab.
4. With the D-pad, move to the large power button and press select.
5. On the Android "Connection request" dialog, move to OK and press select.
6. Wait for the headline to change from "Connecting" to "Protected".
7. Move to Connection details and press select.
8. Read the Verdict line. Working is the answer you want.

The figure further down redraws the screens from step 4 on, from our run.

How do I install a VPN on Android TV or Google TV?

Open Google Play on the TV, search for ForestVPN, install it and open it. Google Play on a TV is the same store flow as on a phone, driven with the remote.

A remote control or game pad is how people use a TV app, as the Android hardware notes for TV put it, so expect arrows and select, not taps. Android TV and Google TV run the same Android apps; Google TV is the newer front end, and apps built for the older Leanback TV toolkit still run on both. Our client appears in the download list as Android TV. The route chooser further down covers a TV where Play is missing.

Our run could not exercise this step. The emulator image has no Play Store, so the app went on by adb from a debug build of 4.0.19. Everything after the install is what the app did.

How do I move around the app with a remote?

ForestVPN's Android TV layout is driven entirely with the D-pad and select: left and right move across three tabs, Connect, Locations and Account, and select presses the focused item.

A white outline marks the focused item. That outline is your cursor, so if you are lost, find it. The first screen reads "Not connected", names the location (Frankfurt in our run) and shows a large power button with a Connection details button below it.

How do I sign in on a TV without a keyboard?

ForestVPN's Android TV app needed no sign-in in our run. The app started on the Free tier and the Account tab read "Not linked to an account", so no pairing code appeared and no account number existed on the screen.

So this article describes no pairing flow. We never saw one, and a guess would be worse than a gap. ForestVPN's sign-in is an optional 32-character account number, with no email or password; the help pages cover the account number, the devices on one account and what to do if you lose it. Typing a long number with a remote is tedious, which is one reason the Free tier starting without it matters here.

Which location should I pick, and how do I connect?

Press select on the power button; the location shown on the first screen is the one it uses. The Locations tab holds a Smart location entry, described on screen as one that "picks a location that works on this network, and moves if it stops working", and then a list grouped by region. Some entries carry a Premium lock.

Android then asks for permission. A "Connection request" dialog says ForestVPN wants to set up a VPN connection and that a key icon appears at the top of the screen while it is active. Move to OK and press select.

After that the headline changes to "Connecting" for a few seconds (under ten in our run), then to "Protected" with a green ring.

Is the VPN actually working? Read the verdict

Working appears on the Connection details screen, not on the headline, and the app claims it only when data flows both ways. ForestVPN reads one of eight verdicts from the tunnel's own packet counters. The others are Idle, Degraded, BlockedAtHandshake, BlockedAfterHandshake, MtuBlackhole, ExitUnreachable and UnderlayDown. There is no "Connected" state.

So treat the big "Protected" headline as a status line and the button reading "Connected 0:13" as an uptime timer. Select Connection details and read the Verdict line. In our run the verdict was Working, followed by "Protected." and a list: the exit server (the machine where your traffic leaves the tunnel for the internet), uptime and server load.

If you see anything other than Working, do not reach for the protocol first. ForestVPN uses the Noise_IKpsk2 handshake that WireGuard uses, unmodified, and the verdict names where the connection stops: the handshake, after the handshake, packet size, the exit or the local network. Match the message to its page: net.blocked_after_handshake when the start finished and then went silent, net.degraded when traffic passes slowly. The sibling article VPN connected but no internet takes each message in turn.

Does Android TV support split tunneling or a kill switch?

No. ForestVPN's Android app leaves split tunneling out of its TV layout, so there is no app list to choose from on a TV; on Android phones and tablets, split tunneling picks apps.

ForestVPN's Android app has a kill switch that the system enforces: it stops traffic leaving outside the tunnel when the tunnel drops. This run did not test it on a TV, as the method box says. It is a safeguard with limits, and no kill switch covers every edge case, so do not rely on it as a guarantee.

What if my TV has no Google Play, or runs another system?

The Android app needs Google Play; without it, pick a route from the table below.

A router VPN carries everything behind it, so the TV needs nothing installed. The cost is one tunnel shared by every device.

Will these steps work the same on my TV?

Not proven: this run used an emulator, so real TV hardware, the live Play listing, sign-in pairing and throughput are still open. In our run the layout worked end to end with a remote; that does not prove how a particular TV model performs. With Google Play, install and check the verdict; without it, take a route from the table.