Install WireGuard with Mullvad on Linux by installing the
wireguard package via your distribution's package manager, downloading your unique configuration files from the Mullvad account dashboard, and placing them in the
/etc/wireguard/ directory. Once configured, enable and start the service using standard systemd commands to establish a secure encrypted tunnel for your internet traffic.
Prerequisites and System Preparation
Before configuring the connection, ensure your system meets the basic requirements. You need a Linux machine with administrative privileges (root or sudo access) and an active internet connection. Most modern distributions include WireGuard kernel modules by default, but you must install the user-space tools to manage connections.
It is also helpful to have your Mullvad account credentials ready. While the actual login happens on the website, you will need to know which specific server location you intend to use when generating the configuration files later. If you are unsure about your current network status, checking your public IP address beforehand can serve as a baseline for testing connectivity after setup.
Installing the WireGuard Software
The installation process varies slightly depending on your Linux distribution. The goal is to install the
wireguard-tools package, which provides the necessary utilities like
wg and
wg-quick.
For Debian-based systems such as Ubuntu or Linux Mint, update your package list first to ensure you get the latest version available in the repository. Then, install the software using the following command:
sudo apt update
sudo apt install wireguard-tools
On Fedora or RHEL-based systems, the package name might differ slightly, often being just
wireguard-tools or included in the base set of utilities. Use your system's native package manager:
sudo dnf install wireguard-tools
Arch Linux users typically install it directly from the community repositories:
sudo pacman -S wireguard-tools
After installation, verify that the tools are correctly installed by running
wg --version. This should return the version number of the WireGuard tools, confirming that the binary is accessible in your system path.
Retrieving Configuration Files from Mullvad
Mullvad simplifies the setup process by providing pre-configured files for each server location. Log in to your Mullvad account on their official website and navigate to the "Config generator" section. Here, you can select the specific server location you wish to connect to, such as a city or country close to your physical location for better latency.
Once you select a server, the website generates a unique configuration file tailored to your account. Download this
.conf file. It contains all the necessary cryptographic keys, endpoint addresses, and peer settings required to authenticate with Mullvad's infrastructure. Do not share this file publicly, as it grants access to your VPN session.
If you plan to use multiple servers frequently, you can download configurations for several locations. However, for the initial setup, one file is sufficient. Save the downloaded file to a temporary location on your computer before moving it to the system directory.
Placing Configuration in the Correct Directory
Linux systems expect WireGuard configuration files to reside in a specific directory structure. Create a new file inside
/etc/wireguard/ with a descriptive name, such as
mullvad.conf. It is best practice to name the file based on the server location, for example,
se-stocholm.conf for Stockholm, Sweden.
Copy the content of the downloaded configuration file into this new file. You can do this using a text editor like
nano or
vim, or by copying the file directly if you downloaded it to your home directory. Ensure the file permissions are restricted to root only for security reasons. Run the following commands to set the correct ownership and permissions:
sudo cp ~/Downloads/mullvad.conf /etc/wireguard/mullvad.conf
sudo chmod 600 /etc/wireguard/mullvad.conf
This ensures that only the root user can read the sensitive private keys contained within the configuration file. Incorrect permissions may prevent the service from starting or pose a security risk.
Enabling and Starting the Service
With the configuration file in place, you can now activate the WireGuard interface. Use the
systemctl command to enable and start the service. The service name corresponds to the filename you created, without the
.conf extension. For example, if your file is named
mullvad.conf, the service name is
[email protected].
Run the following commands to start the connection immediately and ensure it starts automatically on boot:
sudo systemctl enable wg-quick@mullvad
sudo systemctl start wg-quick@mullvad
You can check the status of the connection using
sudo systemctl status wg-quick@mullvad. If the service is active and running, you should see green text indicating success. To verify that your traffic is actually routing through the VPN, visit a site like
whatismyipaddress.com and compare your IP address with the one shown in your Mullvad account dashboard.
For advanced users interested in customizing traffic routing, exploring
Bypass/split tunnel wireguard options can be beneficial. Split tunneling allows you to route only specific applications through the VPN while keeping others on your local network, which can improve performance for local resources.
Troubleshooting connection issues often involves checking logs or verifying peer connectivity. If you encounter problems establishing links between devices, refer to
Troubleshooting WireGuard Client-to-Client Communication Issues for detailed diagnostic steps.
Frequently Asked Questions
How do I disconnect from the Mullvad VPN?
To disconnect, stop the WireGuard service using the command
sudo systemctl stop wg-quick@mullvad. This will immediately tear down the encrypted tunnel and restore your direct internet connection. You can also disable automatic startup at boot with
sudo systemctl disable wg-quick@mullvad.
Can I use Mullvad with multiple servers simultaneously?
Standard WireGuard configurations typically support one active interface per profile. To use multiple servers, you would need to create separate configuration files for each location and run them as distinct services. However, most clients cannot route traffic through two VPNs at once effectively without complex policy routing setups.
What should I do if the service fails to start?
Check the system logs using
journalctl -u wg-quick@mullvad to identify error messages. Common issues include incorrect file permissions, missing dependencies, or firewall rules blocking UDP traffic. Ensure that your system firewall allows outbound UDP connections to the Mullvad server ports.
Is WireGuard faster than OpenVPN for Mullvad?
WireGuard is generally considered faster and more lightweight than OpenVPN due to its simpler codebase and modern cryptographic protocols. It offers lower overhead and quicker handshake times, resulting in better throughput and reduced latency for most users.
How do I update my Mullvad configuration?
Mullvad occasionally rotates keys or updates server endpoints. Log in to your account dashboard and regenerate the configuration file for your chosen server. Replace the contents of your existing
/etc/wireguard/mullvad.conf file with the new configuration and restart the service.