Checking connection...

Using WireGuard on macOS

WIREGUARD

Last updated: 12 December 2019


This guide for macOS users explains how to connect to Mullvad’s WireGuard® servers.

Choose one of the two following options. Do not use them simultaneously.

Option 1: use the Mullvad app

If you’re using the Mullvad VPN app, follow our guide on how to turn on WireGuard in the app.

Option 2: use the WireGuard app

Currently, the WireGuard app requires macOS version 10.14 or newer.

Download WireGuard app

  1. Open the macOS App Store and find the WireGuard app.
  2. Click Get/Install to download and install the app.
  3. Start the WireGuard app from your computer's Launchpad or Application folder. The WireGuard icon will display in your desktop's top menu bar (no window will automatically open).

Generate a configuration file

  1. In a browser window, navigate to our WireGuard configuration generator.
  2. Enter your Mullvad account number in the Account number field.
  3. Under Platform, choose macOS.
  4. Click on Generate a new key pair. (Generate a separate key pair for each device that you use.)
  5. From the Server drop-down menu, select the server of your choice.
  6. Click on Download and wait for the file to download.

Import the configuration file

  1. Click on the WireGuard icon located in your desktop's top menu bar.
  2. In the drop-down menu, select Import tunnel(s) from file...
  3. Navigate to your Download folder and select the configuration file that you downloaded from Mullvad's website.
  4. Click Import.
  5. Click Allow if you get a pop-up saying "'WireGuard' would like to Add VPN Configurations."

Connect

  1. Click on the WireGuard icon located in your desktop's top menu bar.
  2. In the drop-down menu, select the Mullvad VPN server that you want to connect to, for example "mullvad-se2".
  3. A checkmark will appear next to it. That's it!
  4. You can visit am.i.mullvad.net to check that you're connected.

Disconnect

  1. Click on the WireGuard icon located in your desktop's top menu bar.
  2. In the drop-down menu, click on the server that you're connected to (the one with a checkmark next to it).
  3. The checkmark will disappear, signaling that you are disconnected.

 

Want to access your local network when connected with WireGuard?

  1. Click on the server profile
  2. Click on the edit icon
  3. Check the "Exclude private IPs" checkbox
  4. Add 10.64.0.0/10 to the end of AllowedIPs
  5. Click on the Save icon
  6. Disable and then Enable the server profile that you edited

 

Is it working?

While on your device, visit am.i.mullvad.net to get a quick overview of your Mullvad-WireGuard connection status. In addition, it's a good time to check if your browser is leaking information and therefore jeopardizing your privacy.

FAQ

Q: I get a pop-up, "'WireGuard' is trying to view tunnel private keys," when trying to edit a tunnel. Is this normal?
A. Yes. Click on Use Password if you want to continue.

External resources

"WireGuard" is a registered trademark of Jason A. Donenfeld.