If you're running IPTV on Apple TV, Roku, or any smart TV without a VPN app, the only way to get VPN coverage is at the router level. This is also the only sensible way to apply QoS (Quality of Service) rules that prioritise IPTV traffic — which fixes the nighttime buffering almost every IPTV user experiences.

The three router tiers for IPTV

Setting up router-level VPN (GL.iNet walk-through)

  1. Connect the GL.iNet between your ISP router and your TV. Set its WAN port to your ISP router; the TV joins its LAN/WiFi.
  2. In the GL.iNet admin (http://192.168.8.1): VPN → WireGuard Client → Import config file (downloaded from Mullvad/Proton).
  3. Toggle the client ON. Check Status — you should see a green tunnel and a new public IP.
  4. VPN Policy: set "Based on the VPN Client" → "All traffic goes through VPN". Now every device behind the GL.iNet uses the tunnel.

QoS: the setting that fixes 80% of buffering

ISPs oversubscribe their networks during peak hours (7–11pm local time). QoS on your router tells the router which packets to prioritise when your upstream is saturated. For IPTV, you want live-streaming traffic prioritised above everything else.

On Asus-Merlin: Adaptive QoS → Traditional QoS → set "Streaming" to priority 1, "Web Surfing" to 2, "File Downloads" to 5. On OpenWrt/GL.iNet: SQM-Cake with 95% of measured speed and DiffServ=enabled.

Multicast (for ISP-provided IPTV)

If you're on a fibre ISP that ships IPTV through its own box (BT TV, Orange TV, Deutsche Telekom Entertain), those streams are delivered via multicast (IGMP). You need IGMP Snooping enabled on your router and switch, or the streams flood every port on your LAN and tank your WiFi.

This does not apply to over-the-top IPTV (Apollo, Kemo, Xtrix, etc. — anything you configured by M3U or Xtream Codes). OTT IPTV uses unicast TCP/UDP; IGMP is irrelevant. It only matters if your ISP's branded IPTV box is on the same LAN.