Back to Guides

Easy WireGuard + Mullvad setup on Linux

We'll walk you through our easy browser-based configuration setup and the necessary terminal-based commands to use the WireGuard protocol with Mullvad on Linux.

We also have an advanced terminal-only setup guide.
 

Step 1) Install WireGuard

sudo add-apt-repository ppa:wireguard/wireguard && sudo apt-get update && sudo apt-get install openresolv curl linux-headers-$(uname -r) wireguard-dkms wireguard-tools

For non-Debian based distributions, follow the official installation instructions.
 

Step 2) Generate a configuration file

Use our WireGuard config generator to automatically generate the necessary file. Options include enabling a kill switch and selecting two locations for multihopping.

Save the downloaded file in your local directory /etc/wireguard,

Also make sure you set the correct permissions so only root can read them:
sudo chown root:root -R /etc/wireugard/*.conf && sudo chmod 600 -R /etc/wireguard/*.conf &&

 

Step 3) Turn on WireGuard

For this guide, we have selected Malmö, Sweden (se1), as our first server location. The downloaded config file is named mullvad-se1-wireguard.conf.

Run the following command but replace "se1" with your selected location's alias.

wg-quick up mullvad-se1


Disconnect

As before, replace "se1" with your selection.

wg-quick down mullvad-se1


Verify your connection

To verify that WireGuard is working, use our online tool Am I Mullvad to check your IP.
 

Multihop with WireGuard

When using our config generator in step two, you have the option of selecting a second server location. Doing so allows your traffic to "hop" from the first location to the second before exiting at your destination.

Multihop can be used for many different reasons, for example, increasing your privacy or improving latency/performance due to suboptimal ISP peering.
 

Multihop via SOCKS5 proxies

Our SOCKS5 proxy guide includes steps for configuring your browser or other programs to multihop using our WireGuard SOCKS5 proxies.

Using this together with the multihop option in step 2 of this guide will give you an additional hop for a total of three.
 

Troubleshooting

If you run into any issues while using WireGuard, please contact us at support@mullvad.net and let us know what you experience.

Due to a Debian bug, Debian/Ubuntu users may want to install openresolv rather than Debian's broken resolvconf, in order to prevent DNS leaks.

DNS leaking Ubuntu 18.04 or newer (or other systems that use systemd-resolved)
Replace the 'DNS = ' line with : PostUp = systemd-resolve -i %i --set-dns=193.138.219.228 --set-domain=~.

 

Q: How do I make it autostart ?
A: systemctl enable wg-quick@mullvad-se4  (replace mullvad-se4 with the WireGuard server you wish to use)

 

 

FAQ

Q: How do I enable port forwarding?
A: Log in with your account on our website and then add the ports from your account page,  keep in mind that the ports will be forwarded to the latest pubkey that you have added.

 

External resources

"WireGuard" is a registered trademark of Jason A. Donenfeld.