CLI commands for using WireGuard
WireGuard Windows Linux macOS Desktop Feature Command Line Interface
Last updated:
This guide explains how to use the Mullvad command line interface (CLI) to connect to Mullvad, and how to use WireGuard related commands. For other general Mullvad commands see the guide How to use the Mullvad CLI.
You can use the CLI and the GUI interchangeably, you don't have to stick with one way. If you have a headless server then you can use Mullvad VPN by using only the Mullvad CLI.
The guide was tested with Mullvad VPN version 2025.14. In earlier versions, some commands were different.
What this guide covers
Requirements
You need:
- Linux, macOS or Windows
- The Mullvad VPN app
- To use the Terminal (macOS/Linux) or Command Prompt (Windows)
Basic commands
1. Set your account
This is only necessary if you are not already logged in. Replace the number string with your Mullvad account number.
mullvad account login 1234123412341234
2. Select a country
Set a country by using the two letter country code. (USA = us and UK = gb).
mullvad relay set location se
3. Connect
Connect to the country/location that you selected.
mullvad connect
4. Status
Check status of connection.
mullvad status
Note: If you get the error message below, it means that your selected server does not support the options you have enabled.
"Blocked: Failure to generate tunnel parameters: Failure to select a matching tunnel relay".
Select another location/server, or disable the option.
5. View tunnel configuration
Use this command to check your tunnel options and WireGuard key.
mullvad tunnel get
Enable DAITA
To enable DAITA use the following command. Note that if you select a WireGuard server or location which is not DAITA enabled, then Mullvad will connect to it using multihop via the closest DAITA enabled WireGuard server.
mullvad tunnel set daita on
To check if DAITA is enabled, and if multihop is used, run the following command.
mullvad status
To turn off DAITA use the following command.
mullvad tunnel set daita off
Quantum-resistant tunnel
Quantum resistant tunnel is enabled by default. If you want to turn it off, use this command.
mullvad tunnel set quantum-resistant off
To check the status, use the following command. It should say "Quantum Resistance" if it is on.
mullvad status
Anti-censorship methods
Use a specific WireGuard server port
Use both of the following commands to set the WireGuard port that you want to connect to.
mullvad relay set port 123
mullvad obfuscation set mode port
To set the port back to automatic use both of these commands.
mullvad relay set port any
mullvad obfuscation set mode auto
Use UDP-over-TCP / Shadowsocks / QUIC / LWO obfuscation
To enable a WireGuard obfuscation method, use one of these commands.
mullvad obfuscation set mode udp2tcp
mullvad obfuscation set mode shadowsocks
mullvad obfuscation set mode quic
mullvad obfuscation set mode lwo
To set the WireGuard obfuscation back to Automatic, use this command.
mullvad obfuscation set mode auto
To check if obfuscation is on, use this command.
mullvad status
Multihop
See our guide Multihop with WireGuard to learn more about this feature.
1. Enable Multihop
Use this command to enable Multihop.
mullvad relay set multihop on
2. Select the entry server (first hop)
Select either a country, city or a specific server. Use one of the following commands.
mullvad relay set entry location dk
mullvad relay set entry location dk cph
mullvad relay set entry location dk cph dk-cph-wg-001
(dk=Denmark) (dk cph=Denmark Copenhagen)
3. Select the exit server (second hop)
Choose the exit server in the same way that you do without multihop. Select either a country, city or a specific server using one of the following commands.
mullvad relay set location se
mullvad relay set location se got
mullvad relay set location se-got-wg-001
(se=Sweden) (se got=Sweden Gothenburg)
4. Check the status
To verify that you are using multihop use the "mullvad status" command.
mullvad status
Connected
Relay: se-got-wg-001 via dk-cph-wg-001
Features: Multihop
Visible location: Sweden, Gothenburg. IPv4: xxx.xxx.xxx.xxx
The "via" part of the output shows the entry server, which verifies that you are using multihop.
5. Turn off multihop
To disable multihop use the following command.
mullvad relay set multihop off
Other commands
Enable "In-tunnel IPv6"
This will give your device a Mullvad IPv6 exit address, in addition to the Mullvad IPv4 exit IP.
mullvad tunnel set ipv6 on
Set "Device IP version" to use IPv6 only when connecting to servers
With this command you can enable connecting to the Mullvad servers using their IPv6 addresses.
mullvad relay set ip-version ipv6
Generate a new WireGuard key
This command will replace your current key.
mullvad tunnel set rotate-key
Note: You may need to wait up to two minutes before the key starts working.
Change the key rotation interval
This command manages the automatic key rotation interval (given in hours). The default is 720 hours (30 days). To set it to every three days for example, use this command.
mullvad tunnel set rotation-interval 72
Server IP override
A Server IP override may help if you are Using Mullvad VPN in restrictive locations. An override might be provided by Mullvad support in special cases. Note that a Server IP override only changes the IP address that you connect with to the VPN server, it does not change the out exit IP that you get from the server, so it won't help to unblock websites or for TV streaming.
Set a Server IP override for a server. Replace xx-xxx-wg-xxx with the server name and ###.###.###.### with the override IP address.
mullvad relay override set ipv4 xx-xxx-wg-xxx ###.###.###.###
Show all server IP overrides that has been set
mullvad relay override get
Remove a Server IP override. Replace xx-xxx-wg-xxx with the server name.
mullvad relay override unset ipv4 xx-xxx-wg-xxx
Remove all server IP overrides
mullvad relay override clear-all
Export a Server IP override file
mullvad export-settings overrides.json
Import a Server IP override file
mullvad import-settings overrides.json
"WireGuard" is a registered trademark of Jason A. Donenfeld.