VPN on a Samsung or LG TV: use the router

A Samsung or LG TV cannot take a ForestVPN app today, so the VPN has to start somewhere else: on a box plugged into the TV, or on the router. Our download page has no Samsung Tizen or LG webOS entry.

Own an Android TV box? The Android TV guide applies instead. For the router route in general, see router VPN or app.

Which route works for which TV?

Apple TV and Android TV run the app themselves; Samsung, LG and Fire TV have no app on our download page, which leaves a router or a box.

The router rows ask for a router that runs OpenWrt or RouterOS 7; an ordinary ISP-supplied router is not one of them.

Does a Samsung TV have a built-in VPN, or an app store option?

We cannot say. We searched the help sites of Samsung and LG for a statement on VPN apps on Tizen or webOS, on the read date in the method box, and found none. The only hits told people to switch a VPN off when mirroring a phone to the TV.

So this page claims nothing about what Tizen or webOS can install. It states what our own download page lists, and for these two systems it lists nothing. Several other VPN vendors' pages say Samsung's Tizen takes no VPN app; that is their statement, and we have not checked it.

How do I protect a TV that cannot run the app?

Move the tunnel off the TV. With an Apple TV or Android TV box, the steps are short:

1. Plug the Apple TV or Android TV box into an HDMI port on the TV.
2. Install ForestVPN on the box from its download page, Apple TV or Android TV.
3. Open Connection details on the box and read Working.

Working (connection verdict) is one of eight that the app computes on the box. It means data flows both ways, and the app's main screen has no Connected state (on a box there is no Quick Settings tile or widget either). The other route is a router that runs the VPN, so the TV's traffic enters the tunnel on its way out of the house.

A box protects only what runs on that box. A router can cover the TV's own apps, because the TV stays on its normal Wi-Fi or cable connection and the router does the tunnelling for it.

How do I choose only the TV on an OpenWrt router?

On OpenWrt, ForestVPN picks by device, and you choose the mode under Services, ForestVPN, Devices. The help page for it opens with this note: "Not yet verified on hardware as a whole. The three modes and the Direct switch passed the lab leak suite on OpenWrt 21.02.7 and 24.10.8."

The three modes, as the device modes recipe names them:

• Every device: the whole home.
• Only the devices I choose: tick the TV, and everything you leave unticked goes Direct.
• Every device except the ones I choose: everything is protected and you list the exceptions.

Devices are remembered by hardware address, so the TV keeps its choice when the router gives it a new address. Split tunneling here means choosing devices, never apps or sites. Start from the install recipe, and read the kill switch page before relying on it; a kill switch has limits.

Does a MikroTik router cover the TV?

Not until you add rules. The install page says: "Out of the box the router tunnels its own traffic and nothing else; the phones and laptops on your network carry on using your normal connection." A TV on that network is one of those devices.

RouterOS decides what goes to the tunnel, and the container tunnels whatever it is handed. The choose-traffic recipe has two options that matter here:

• Calls and messengers only.
• Everything.

Neither picks a single device such as the TV.

The TV is not covered until Step 1 and Step 2b (everything) are pasted on the box that routes your LAN; on an access point downstream of your real gateway, the rules do nothing.

IPv6 is the catch. The recipe is IPv4 only, so with working IPv6 on the router, the destinations you select are also reachable over v6, around the tunnel, and nothing warns you.

For the container itself, the install page says "Verified on real hardware: a MikroTik cAP ax (arm64, RouterOS 7.24.1)". The choose-traffic page says every command in its kill-switch section was run on RouterOS 7.24.1 before being written down. The container image tag, 0.3.17 on the read date, is printed in the install command on the MikroTik download page.

Does a router VPN count as one device on the Free plan?

Yes. A router is one device with one allowance for everything behind it. The OpenWrt help page says so: "On the Free plan that is one allowance for the whole home, so choose a few devices or get Premium."

How do I know the TV is protected?

Honestly, the TV will not tell you: it runs no ForestVPN software, so it shows no status. Check where the tunnel runs.

For an Apple TV or Android TV box, read the Working verdict in Connection details, or follow the status feature. On OpenWrt, the status page says "ForestVPN is on" and then Protected, and Protected appears only after packets are proven to flow both ways. The router pages carry no eight-verdict view; that is an app feature.

Either router: load a what-is-my-address page from a device you chose. It should show the exit's address, while a device set to Direct shows your home address.

Related guides:

• VPN connected but no internet maps each message the app shows on a box to a cause.
• VPN on Android TV shows the screens for the app route on a TV box.
• MikroTik or OpenWrt helps pick a router.
• The OpenWrt WireGuard article covers the protocol side.

Is a Smart DNS the same as a VPN?

No. A Smart DNS is a DNS service the TV uses to look up names, nothing more. A DNS service answers name lookups, as RFC 1035 defines it, and a VPN tunnel carries the packets. Setting a different DNS on a TV changes who answers its lookups and leaves the rest of its traffic where it was.