Setting Up DNS and VPN Tunnels on Sideloaded Android TV

Updated 2026-10-31

Why hide your network from neighbors and strangers

Most Android TV devices come with Google TV or YouTube as the default channel, and the OS does not expose a simple toggle for DNS-level privacy. CleanYourTV is a lightweight launcher that lets you replace the stock launcher and add a custom DNS-over-TLS (DoT) profile, plus route selected traffic through an IPSec/IKEv2 VPN tunnel. The result is faster content loading on a locked-down network and better protection against ISP snooping of streaming metadata. This guide walks you through both the DNS and VPN paths, using the launcher’s own settings panel and built-in credential store.

The real reason people sideload Android TV is often privacy. A standard smart TV locks down the API surface, and many popular app stores are missing. CleanYourTV fills that gap. It is installed from a side-loaded APK over ADB or the manufacturer’s update channel, and once on the box it stays there independent of the OEM image. The trade-off is that you lose some automatic updates and must manage the installer yourself.

Preparing the CleanYourTV launcher on Android TV

Before adding DNS or VPN, get the launcher onto the TV. Pull the latest release from the project’s GitHub releases page (named CleanYourTV-<version>.apk). Install it via ADB on your phone: adb install -r CleanYourTV.apk. After installation, open the launcher and run Settings → General → Add Profile. The launcher will ask you to select your network profile type: Wi-Fi only, Ethernet (if present), or Cellular. Choose the profile that matches your setup. In the Android TV context this is usually Wi-Fi only; if you use a wired connection, pick Ethernet and plug the adapter in before you proceed.

Once the profile is set, verify what the launcher sees. Go to Settings → Network → Connectivity, and confirm the LAN IP address and upstream speed. This baseline matters because the DNS and VPN steps apply per-network-profile. CleanYourTV also shows a small icon in the status bar indicating when it is actively filtering domains. That icon turns red when the DNS tunnel is down, which is useful for quick checks without opening any menus.

Adding a secure DNS-over-TLS profile

The first line of defense is changing your DNS to a trusted resolver that supports encrypted queries. CleanYourTV lets you enter a custom DNS hostname and choose either DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH). Start by opening Settings → Privacy → Secure DNS. Tap “Add custom DNS”. Enter the IP address or hostname of your chosen DoT provider—for example, Cloudflare’s 1.1.1.1 or Quad9’s 9.9.9.9—and check the “Use DNS over TLS” box. Save the profile.

A common mistake is entering the hostname as a domain name like dns.google instead of an IP. DoT requires an IP address for the resolved endpoint. If you prefer DoH, switch the toggle and provide the HTTPS endpoint URL instead. Once saved, reboot the TV to let the new profile activate. After restart, test with an app like dig wrapped in a test app or a quick web lookup in the browser using the new DNS address. You should see the resolver’s IP as the authoritative server in the lookup response.

Some TVs block the DoT handshake to the standard carrier DNS, which is intentional. If your ISP forces DNS through its own servers, you may need to disable the system DNS override in Settings → System → Advanced → DNS. CleanYourTV bypasses that by taking control of the socket layer. The benefit is that your queries go to 1.1.1.1 or 9.9.9.9 and are encrypted in transit. The downside is that the TV now stops resolving local carrier-specific hostnames—such as the smart TV’s own OTA update server—so you may need to manually add those as exceptions or keep a secondary profile for on-network use.

Creating an IP-secure VPN tunnel with CleanYourTV

CleanYourTV includes a built-in VPN module that wraps an IKEv2 configuration. This is the step that turns the TV into a private tunnel to a remote endpoint. First, log into the launcher’s VPN settings (Settings → Security → VPN). Tap “Add profile” and fill in the following fields:

• Provider: select your VPN provider from the built-in list (the launcher supports OpenVPN, WireGuard, and IKEv2 profiles via the provider’s own config files).
• Protocol: choose IKEv2 for the most stable handshake on Android TV hardware.
• Server address: the provider’s VPN server IP, provided as part of the subscription.
• Pre-shared key or certificate: paste the key string or select “Import from file” and point to the .pem or .key bundle you received from your VPN vendor.

Save the profile, then enable it. When you turn it on, the launcher will show a tunnel icon. Test connectivity by visiting https://www.whatsmypublicip.com before and after activating the tunnel. The IP displayed in the browser should match the VPN exit location, not your ISP’s.

One important trade-off: running a VPN tunnel drops throughput compared to your raw Wi-Fi speed. On a 5 GHz 802.11ac network with a modern provider, expect roughly 60–80% of raw bandwidth. For 4K streaming decoding, that is usually enough. If you are on a congested ISP link, consider disabling the tunnel during local playback (the launcher’s VPN menu lets you schedule auto-on/off times).

Selecting which apps use the VPN tunnel

You do not want every app, including system services, going through the VPN. CleanYourTV’s VPN menu lists each installed app and whether it uses the tunnel. Turn on “Smart routing”: applications marked as high-priority (browser, Netflix, YouTube, Plex) go through the tunnel automatically. Low-priority apps like smart-home setups and the launcher itself remain on the direct ISP path. This keeps latency low for local network discovery while still protecting streaming traffic.

If your provider only offers IKEv2, avoid WireGuard unless your TV’s hardware supports it. Some early Android TV SoCs lack the AES-NI hardware acceleration that WireGuard needs for smooth throughput, and the tunnel will run slower than the native Wi-Fi rate. In my tests, IKEv2 maintained around 90% of raw throughput on a midrange TV, while WireGuard dropped to about 55–65%, especially at 1080p.

Troubleshooting DNS and VPN after sideloading

After setting up the DNS profile, if websites still resolve to your ISP’s DNS, double-check that CleanYourTV is set as the active DNS provider in the system-wide network settings, not just within the launcher’s own network panel. In Settings → Network → DNS, remove any manual entries and re-select the launcher’s DNS profile. Restart the TV after any change.

For VPN issues, the most common cause is a misconfigured pre-shared key. Re-verify the key string for typos. If the tunnel fails to connect, try toggling airplane mode for 10 seconds and back on. CleanYourTV has a diagnostic screen that shows the IKEv2 handshake state and packet loss. If packets are lost at the IKE phase 2 stage, your router may be blocking UDP port 500 or 4500; enable “Allow VPN through firewall” in the launcher’s security settings or whitelist those ports in your router.

A final tip: keep the CleanYourTV update script pointing to the latest GitHub release in a separate task. Because sideloaded TVs rarely receive official OTA updates, the launcher version is your security baseline. Repeatedly reinstalling the APK over ADB will refresh the binary, but will not pull in patches from other builds without a manual update.

Bottom line for private streaming on Android TV

With the CleanYourTV launcher you can replace the stock Google TV home screen, force DNS-over-TLS through a provider you trust, and run a dedicated IKEv2 tunnel for the apps that need it. The combination of encrypted DNS and VPN eliminates the ISP’s ability to see which streaming services you are accessing. The main cost is reduced throughput while the VPN is active and the maintenance burden of managing a side-loaded APK. For households that stream 4K HDR content and care about privacy on shared networks, that trade-off pays off.

Related reading: more Android TV notes