Easy WireGuard + Mullvad setup on Linux
We'll walk you through our easy browser-based configuration setup and the necessary terminal-based commands to use the WireGuard protocol with Mullvad on Linux.
We also have an advanced terminal-only setup guide.
Step 1) Install WireGuard
sudo add-apt-repository ppa:wireguard/wireguard && sudo apt-get update && sudo apt-get install openresolv curl linux-headers-$(uname -r) wireguard-dkms wireguard-tools
For non-Debian based distributions, follow the official installation instructions.
Step 2) Generate a configuration file
Save the downloaded file in your local directory /etc/wireguard,
Also make sure you set the correct permissions so only root can read them:
sudo chown root:root -R /etc/wireugard/*.conf && sudo chmod 600 -R /etc/wireguard/*.conf &&
Step 3) Turn on WireGuard
For this guide, we have selected Malmö, Sweden (se1), as our first server location. The downloaded config file is named mullvad-se1-wireguard.conf.
Run the following command but replace "se1" with your selected location's alias.
wg-quick up mullvad-se1
As before, replace "se1" with your selection.
wg-quick down mullvad-se1
Verify your connection
To verify that WireGuard is working, use our online tool Am I Mullvad to check your IP.
When using our config generator in step two, you have the option of selecting a second server location. Doing so allows your traffic to "hop" from the first location to the second before exiting at your destination.
Multihop can be used for many different reasons, for example, increasing your privacy or improving latency/performance due to suboptimal ISP peering.
Multihop via SOCKS5 proxies
Our SOCKS5 proxy guide includes steps for configuring your browser or other programs to multihop using our WireGuard SOCKS5 proxies.
Using this together with the multihop option in step 2 of this guide will give you an additional hop for a total of three.
If you run into any issues while using WireGuard, please contact us at email@example.com and let us know what you experience.
Due to a Debian bug, Debian/Ubuntu users may want to install openresolv rather than Debian's broken resolvconf, in order to prevent DNS leaks.
DNS leaking Ubuntu 18.04 or newer (or other systems that use systemd-resolved)
Replace the 'DNS = ' line with : PostUp = systemd-resolve -i %i --set-dns=220.127.116.11 --set-domain=~.
Q: How do I make it autostart ?
A: systemctl enable wg-quick@mullvad-se4 (replace mullvad-se4 with the WireGuard server you wish to use)
Q: How do I enable port forwarding?
A: Log in with your account on our website and then add the ports from your account page, keep in mind that the ports will be forwarded to the latest pubkey that you have added.
- WireGuard homepage
- WireGuard Whitepaper (PDF)
- Installation Instructions
- Quickstart Instructions
- Donate to Upstream WireGuard Development
- Formal Verification of WireGuard Protocol
- wg(8) man page
- wg-quick(8) man page
"WireGuard" is a registered trademark of Jason A. Donenfeld.