Skip to main content

Using Mullvad VPN in restrictive locations

Mullvad app Connectivity Bridges Windows Linux Android Mobile Installation macOS Desktop iOS Multihop Censorship circumvention 

Last updated:

Some countries use firewalls to block VPNs. They use lists of known VPN server IP addresses and Deep Packet Inspection to find traffic that looks like VPN traffic, and then they block or slow down that traffic.

This guide lists different settings and methods to connect to Mullvad VPN from networks and countries where connecting to a VPN is difficult. This includes countries such as China, Egypt, Iran, Pakistan, Russia, Saudi Arabia, Turkey, Turkmenistan, United Arab Emirates and Uzbekistan.

What this guide covers

Countries

Russia

The Roskomnadzor in Russia is blocking most Mullvad servers. Try to connect to different countries, cities and servers in Europe, using QUIC or Shadowsocks obfuscation.

iOS: The Mullvad VPN app for iOS has been removed by Apple from the App Store in Russia due to laws/regulations. For users who already have the app, in-app purchases no longer work.

China

The great firewall of China is blocking all Mullvad servers in Asia. Try to connect to different cities and servers in the USA instead, using the different obfuscation methods.

Using Multihop to exit in your preferred location

If you are not able to connect directly the location that you want to, then you can enable Multihop in the Mullvad VPN app settings. Then click on Switch location and select an Entry server that you are able to connect to, and select an Exit server anywhere you want.

Getting started with Mullvad

Creating a Mullvad account

You can create a Mullvad account in one of the following ways:

  1. On our website.
  2. In the Mullvad VPN app.
  3. On our website using the onion address in Tor browser.

Adding time to your Mullvad account

You can add time to a Mullvad account in one of the following ways:

  1. On our website using different payment methods.
  2. In the Mullvad iOS app with an Apple in-app purchase.
  3. In the Mullvad Android app with a Google in-app purchase.
  4. On our website using the onion address in Tor browser (limited to crypto and cash payments).

Downloading the Mullvad VPN app

You can download the Mullvad VPN app in one of the following ways:

  1. On our website.
  2. On our Github page (see details below).
  3. (Android only) on Google Play or using the F-Droid app or website.

Downloading from Github

Go to GitHub and click on Assets to download the app for your operating system: Windows (exe), macOS (pkg), Ubuntu/Debian (deb), Fedora (rpm) or Android (apk). If you download the Android app here then you have to remember to update it manually in the future as the app won't notify you.

Logging in to the Mullvad VPN app

If you have a problem to log in to the Mullvad VPN app, then you can test the API connection by going to the Mullvad VPN app settings > API access. Then click on all the round buttons with three dots inside and select Test a couple of times. If it works then it should say "API reachable" for a moment. If it says "unreachable" several times then you can try to turn off that method. In some cases it may work better if you turn off "Encrypted DNS proxy". The app will use different bridge servers if you try to log in several times.

If you are using a phone then you can try it both on Wi-Fi and using mobile data.

Anti-censorship methods

You can try to enable the following Anti-censorship methods one by one:

  • WireGuard port
  • LWO
  • QUIC
  • Shadowsocks
  • UDP-over-TCP

WireGuard port

This method does not use any obfuscation, so it's not effective against packet inspection firewalls. However it can be effective against firewalls that block certain ports.

  1. Go to the Mullvad VPN app settings by clicking on the gear icon in the top right corner of the app.
  2. Do the following depending on which operating system you use:

    Windows / macOS / Linux:
    Click on VPN settings > Anti-censorship and select WireGuard port. Then click on the arrow on the right side of "WireGuard port".

    iOS:
    Tap on VPN settings > WireGuard port.

    Android:
    Tap on VPN settings and scroll down to WireGuard port.

  3. You can try to select port 51820 or 53, or enter a custom port such as 123. Click on the information (i) icon to learn which ports you can use.

Obfuscation: LWO, QUIC, Shadowsocks, UDP-over-TCP

  1. Go to the Mullvad VPN app settings by clicking on the gear icon in the top right corner of the app.
  2. Do the following depending on which operating system you use:

    Windows / macOS / Linux:
    Click on VPN settings > Anti-censorship and select one of the methods described below.

    iOS:
    Tap on VPN settings > WireGuard obfuscation and select one of the methods described below.

    Android:
    Tap on VPN settings and scroll down to WireGuard obfuscation and select one of the methods described below.

LWO

LWO means "Lightweight WireGuard Obfuscation". This uses a random port number. If you want to learn more, see our blog post Introducing Lightweight WireGuard Obfuscation. It is currently not available in the Mullvad app for iOS.

QUIC

QUIC uses UDP port 443. It is made to make your VPN traffic look like normal web traffic.

Shadowsocks

You can try Shadowsocks with Automatic port. If it doesn't work then enter custom port 443.

Note (port 443): If you use the Mullvad VPN app for iOS then the location list will show you only the servers that support port 443 when you enable it. If you use the Mullvad VPN app on another platform then most servers will say "No servers match your settings, try changing servers or other settings" if you try to connect to a server which does not support Shadowsocks on port 443.

UDP-over-TCP

This makes WireGuard work over TCP. You can choose between port 80 or 5001. Port 443 is currently only available in the Mullvad app for iOS.

Using a Server IP Override

In some cases you may get a Server IP override file to try with if you contact support@mullvadvpn.net. Follow these instructions to use it:

  1. Go to the Mullvad VPN app settings (click on the gear icon in the top right corner).
  2. Click on VPN settings.
  3. Click on Server IP override.
  4. Click on Import file (Android: Import).
  5. Go back and click on WireGuard settings (in Android just scroll down).
  6. Set Obfuscation to Shadowsocks.
  7. Go back and click on Switch location.
  8. Select the server that you have an IP override for.

Using WireGuard

Note that obfuscation methods are not available if you use WireGuard outside of the Mullvad app. If it is not needed in your location and you can not use the Mullvad app (the API may be blocked), then you can try to use the WireGuard app instead.

Platform Source Guide
iOS App Store WireGuard on iOS
Android Play Store WireGuard on Android
Windows WireGuard website WireGuard on Windows
macOS macOS App Store WireGuard on macOS
Linux Repository WireGuard on Linux