VPN for smart TV: app, router or sharing

A smart TV can use a VPN three ways, and its platform decides which. Apple TV and Android TV run an app; everything else goes through a router or a computer that shares its connection.

This page is the chooser. It lists what our download table says today, gives the steps for the app route and the two router platforms we ship, and shows how to read the connection state from the sofa.

Which smart TVs can run a VPN app?

The route follows the TV's platform, and our download table lists exactly two TV platforms with an app. The table below comes from that page, read 2026-10-16; the method box says how.

"No app listed" means exactly that: no row for it exists in our download table on the read date. It is a statement about our table. It says nothing about what the brand's own store may carry.

How do you set up a VPN on Apple TV or Android TV?

Install ForestVPN from the TV's own store (the App Store on Apple TV, Google Play on Android TV), allow the VPN prompt, and connect. It is the shortest route (the Android TV walkthrough has the steps). An app on the TV means only that TV goes through the tunnel, and nothing on the router changes.

On Apple TV

On the Apple TV download page, the listing is tvOS 17.0 or later and the App Store as the source. Apple documents the box itself in its tvOS guide, which also covers the remote.

1. Open the App Store on the Apple TV and search for ForestVPN by Digital Services LLC.
2. Select Get.
3. Open the app, go to Account and select Pair with your phone. It shows a short pairing code, because typing a long number with a remote is miserable work.
4. On an iPhone or iPad where you are signed in, open ForestVPN, go to Account and enter the code. The TV now uses your plan.
5. Choose a location with the Siri Remote and select Connect. The first time, tvOS asks to add a VPN configuration. Allow it, or the app cannot connect.

That code is a one-time stand-in for the account number, explained in Devices and linking. For the number itself, read why your sign-in is a number.

The TV takes a device seat on your account like any other device. You can sign it out or remove it from a phone, computer or the console at fvpn.net; the seat limit page shows how.

On Android TV and Google TV

Per its download page, Android TV installs from the same Google Play listing as the phone app, on a device running Android 9 or later. Google describes the platform in its Android TV developer guide.

1. Open Google Play on the TV and search for ForestVPN by Digital Services LLC.
2. Select Install.
3. Open the app and connect. Android asks once to allow a VPN connection. Allow it.
4. To use a plan you already have, link the TV to your account. In the TV app, choose Pair with your phone. On your phone open ForestVPN, then Account, then Add a device with a code, and enter the code the TV shows.

Once the TV is paired, Premium bought for your account works on it; the page on restoring on a new device covers the rest. Our changelog lists Android TV beside Android for the most recent Android release. The Android TV walkthrough shows the screens.

What the TV apps do not have is just as plain:

• No split tunneling, so you cannot choose which apps skip the VPN.
• On Android TV, no Quick Settings tile or widget from the phone app.

What if your TV has no app?

Run the VPN one step upstream, where the TV connects to the internet. There are two ways, the router and a shared computer connection. For a Samsung set in particular, see VPN on a Samsung TV.

Put the VPN on the router

A router that runs ForestVPN is its own device on your account, and the TV joins that router and is then sent through the tunnel. Our download table lists two router platforms: MikroTik RouterOS 7, as a container, and OpenWrt 21.02 or later.

The two do not default the same way:

• MikroTik: out of the box the container tunnels only the router's own traffic, so the TV has to be sent through it with RouterOS configuration. Choosing what goes through the tunnel walks through it.
• OpenWrt: first run asks whether every device, only the devices you choose, or every device except the ones you choose should use ForestVPN. Each device then gets a Through ForestVPN or Direct switch. See first run and whole home or chosen devices.

Setup is closer to network administration than to installing an app. A router is linked by a pairing code (MikroTik) or a pairing code or account number (OpenWrt). It holds a seat until you sign it out (Sign out on the OpenWrt Account page) or remove it in the app.

Full steps are on MikroTik router setup and Install ForestVPN on OpenWrt. In short, for each router:

MikroTik RouterOS 7

1. Check the router runs RouterOS 7.21 or later, with the container package installed and container device-mode enabled. Enabling it needs physical access to the router.
2. Run the install command from the MikroTik download page.
3. Read the pairing code in /log, and enter it in the ForestVPN app on a phone that is signed in to your account.
4. Open the container's status page from a phone on the LAN and pick a location.
5. Route the TV through the container with RouterOS configuration, on the router that routes your LAN; rules on an access point downstream of your real gateway do nothing. Out of the box nothing else on your network uses it.

OpenWrt

1. Check the router runs OpenWrt 21.02 or later on an ARM or x86-64 processor (some MIPS chips are built too; the install page lists which).
2. Install the file for your router's Target Platform from the OpenWrt download page.
3. Set the router password if asked. Open Services, then ForestVPN, and link the router to your account by a code from the app or by account number.
4. Put the TV on Through ForestVPN, in the mode that fits your home.
5. Pick a location, or leave it on Smart location, and turn protection on.

Now the limits. Only the MikroTik install was verified on hardware, on a cAP ax (arm64) running RouterOS 7.24.1; no TV was put behind it, and the OpenWrt pages say they are not yet verified on hardware. A TV behind either router is an expected result, not a measured one.

Share a computer's connection

The other route is a computer that runs a VPN app and shares its connection to the TV, for example over an Ethernet cable, often called Ethernet sharing. We list Windows, Mac and Linux apps, and the sharing itself is a feature of the operating system, not of ours.

We give no steps for this route. If you try it, the check in How do you know the VPN is working on your TV? only reads the computer's own tunnel. The state on the computer does not show whether the TV's traffic goes through that tunnel.

What should Samsung, LG and Fire TV owners do?

Use the router route. Our download table lists no app for Samsung Tizen, LG webOS or Fire TV, so the TV itself is not where the VPN goes. The TV joins a router that runs ForestVPN, by Wi-Fi or by Ethernet, and the router sends it through the tunnel.

Three things follow from the pages above:

1. Check that your router is one of the two platforms in the table, RouterOS 7 or OpenWrt 21.02 or later.
2. Make sure the TV goes through the tunnel. On MikroTik that takes a RouterOS rule. On OpenWrt the TV has to be on Through ForestVPN, which is automatic in the every-device mode.
3. Read the state on the router, since the TV has none of its own.

If your router is neither, the shared-connection route is the one left.

Is a Smart DNS the same as a VPN?

No. A Smart DNS changes the answers the TV gets when it looks up a name, and nothing more. A VPN carries the TV's traffic through a tunnel to an exit server.

Name lookup is the step where a device asks which address belongs to a name; the Domain Name System that does this is defined in RFC 1035. A Smart DNS is a resolver that answers that question. Your traffic goes to whatever address the answer names, over your own connection, so there is no tunnel to read a state from.

That is why the rest of this page is about VPN routes.

If you only want a different DNS provider, that is a setting on the TV or the router, and it is not what ForestVPN's tunnel does. If you want a filtering provider, the Apple TV app's settings let you choose one, named on screen; ForestVPN does not run one for you.

Do TVs have a built-in VPN?

Our data cannot say, brand by brand. The download table only knows what we ship, so for a Samsung, LG or Fire TV the useful test is short: look through the TV's settings and its app store for a VPN entry.

If you find nothing, the router route does not depend on the TV's software.

How do you know the VPN is working on your TV?

Read the main screen. On Apple TV and Android TV a healthy tunnel says Protected, and the eight connection verdicts sit behind it.

ForestVPN has no "Connected" state, and the uptime line on Android TV is a timer, not a verdict. The app reaches one of eight verdicts from the tunnel's own packet counters. Working is the verdict that means data flows both ways.

On a TV this matters more than on a phone. There is no address bar to test with, and the menus are slow to back out of. Look at the state before you open a video app and assume the problem is the app.

The Apple TV Connection screen shows the state word. For a fault it adds a Verdict section with the same words and the code beside them, net.degraded for example. A healthy tunnel has no verdict entry there; it reads Nothing wrong.

Android TV's connect screen also says Protected. Working appears as the title of the healthy tile in Connection details. That tile reads Working for an idle tunnel too, so it means no fault was found, not that data is moving right now.

Reading the state behind a router

A TV behind a router has no ForestVPN state of its own; the router has.

• MikroTik: the container's status page, opened from a phone on the LAN.
• OpenWrt: the status page does not use the verdict names. It shows "ForestVPN is on" and then "Protected". Per OpenWrt first run, Protected appears only after packets are proven to flow both ways, not from a handshake alone.

What the router reports is the router's tunnel, nothing more. The TV is in that tunnel only when the RouterOS rule, its Through ForestVPN switch or the every-device mode puts it there.

For a tunnel that looks like a dead connection, see VPN connected but no internet.

What can a VPN on a smart TV not do?

Four limits, stated before you spend money on a new streaming stick.

• It is not a promise about any service. A tunnel changes the path your traffic takes. It does not guarantee how an app or website treats the address at the other end, and we make no such promise.
• A kill switch is not absolute. A kill switch exists on the router routes: OpenWrt has one built from a routing rule and firewall sections (OpenWrt kill switch), and the MikroTik recipes in Choosing what goes through the tunnel include one. Both TV apps have a kill switch setting too, and none is absolute: on Apple TV the system decides what an app can capture, so a few system services can still go around the tunnel, as the limits on the kill switch page describe.
• The router route is set up per router, not per TV. The TV cannot pick its own location; every device behind the router shares one plan and one location.
• Remotes are slow to type on. That is why the TV apps pair by code instead of asking for a number.

Which route should you pick?

Pick the app if your TV is an Apple TV or an Android TV. It is the quickest route and the only one with an app-store listing behind it.

Choose the router if you have a Samsung, LG or Fire TV and a router that can run the container or the OpenWrt package, or if you want every device in the house on one tunnel. Read the router pages before you commit: they are written for people who do not mind a command line.

Not sure which case you are in? Ask the assistant, then check the answer against the download page for your device.

Ask about this

How was this TV table checked?