WireGuard on Linux terminal (easy)


Dernière mise à jour: 13 mars 2023

We'll walk you through our easy browser-based configuration setup and the necessary terminal-based commands to use the WireGuard® protocol with Mullvad on Linux.

We also have an advanced terminal-only setup guide.

Option 1: use the Mullvad app

The Mullvad VPN app for Linux uses the WireGuard protocol by default, so all you need to do is connect.

Option 2: use WireGuard

1. Install WireGuard

Ubuntu / Debian

This applies to Ubuntu  (using kernel 5.4 or newer). Users with Debian releases older than Debian 11 (Bullseye) should first enable backports. Then install openresolv and wireguard:

sudo apt update && sudo apt install openresolv wireguard


This applies to Fedora 32 and newer (using kernel 5.6 or newer).

sudo dnf install wireguard-tools

For other Linux distributions, follow the official installation instructions.

2. Generate a configuration file

Use our WireGuard config generator to automatically generate the necessary file. Options include enabling a kill switch and selecting two locations for multihopping.

If you're running WireGuard on multiple devices, generate a separate key pair for each device and each connection. You will otherwise likely run into connectivity issues.

Save the downloaded file in your local directory and then copy its content to /etc/wireguard.

Also make sure you set the correct permissions so only root can read them:

sudo chown root:root -R /etc/wireguard && sudo chmod 600 -R /etc/wireguard

3. Turn on WireGuard

For this guide, we have selected Malmö, Sweden (se3), as our first server location. The downloaded config file is named se3-wireguard.conf.

Run the following command but replace se3 with your selected location's alias.

wg-quick up se3-wireguard


As before, replace se3 with your selection.

wg-quick down se3-wireguard

Verify your connection

To verify that WireGuard is working, use our Connection check to check your IP and verify that you don't leak DNS.

Multihop with WireGuard

When using our config generator in step two, you have the option of selecting a second server location. Doing so allows your traffic to "hop" from the first location to the second before exiting at your destination.

Multihop can be used for many different reasons, for example, increasing your privacy or improving latency/performance due to suboptimal ISP peering.

Multihop via SOCKS5 proxies

Our SOCKS5 proxy guide includes steps for configuring your browser or other programs to multihop using our WireGuard SOCKS5 proxies.

Using this together with the multihop option in step 2 of this guide will give you an additional hop for a total of three.


If you run into any issues while using WireGuard, please contact us at support@mullvad.net and let us know what you experience.


How do I enable port forwarding?

Log in to your account page and add ports from there. Keep in mind that the ports will be forwarded to the latest pubkey that you have added.

How do I make WireGuard start automatically on boot?

Run the following command, replacing mullvad-se3 with the WireGuard server you wish to use.

systemctl enable wg-quick@se3-wireguard

External resources

"WireGuard" is a registered trademark of Jason A. Donenfeld.