Firewall Integration

​

Overview

• Windows: Windows Filtering Platform (WFP)
• macOS: Packet Filter (PF)
• Linux: nftables
• Android/iOS: VPN Service API / Network Extension (no direct firewall access)

​

Windows - WFP Integration

​

Implementation

​

Architecture

​

Baseline Sublayer

• Highest weight to process all traffic first
• Contains permit-filters (highest weight within sublayer)
• Contains blocking filters (lowest weight within sublayer)
• Permit-filters “lift” matched traffic to next sublayer
• Blocking verdict is final - matched traffic is dropped

​

Specialized Sublayers

• DNS sublayer: Filters DNS traffic (port 53)
• Endpoint sublayers: Handle relay and API endpoints
• All weighted slightly lower than baseline

• High-weighted permit-filters for whitelisted traffic
• Low-weighted blocking filters as catch-all

​

Persistent Sublayer

• Created with highest possible weight
• Contains blocking filters only
• Persists across BFE restarts and reboots
• Ensures traffic blocked until daemon reinitializes
• Active before BFE service starts during boot

​

Key Functions

// Initialize WFP session
winfw::initialize()

// Apply firewall policies
winfw::apply_policy_connecting()  // During connection
winfw::apply_policy_connected()   // When connected
winfw::apply_policy_blocked()     // In error/blocked state

// Cleanup
winfw::deinit(cleanup_policy)     // Remove or persist rules

​

Hyper-V Leak Protection

• Uses WMI to enumerate Hyper-V virtual switches
• Adds blocking rules for virtual adapters
• Can be disabled via TALPID_FIREWALL_BLOCK_HYPERV=0

​

Process Restrictions

• Connecting state: Only mullvad-daemon.exe or root processes
• Connected state: Only tunnel interface or root processes
• Uses binary path matching on Windows
• Prevents unprivileged programs from fingerprinting endpoint

​

macOS - PF Integration

​

Implementation

​

Architecture

​

Anchor System

• Creates anchor named mullvad
• Anchor contains filter rules, NAT rules, and scrub rules
• Atomic rule updates via pfctl::AnchorChange
• Preserves/restores PF enabled state

​

Rule Types

• Pass rules (allow traffic)
• Drop rules (block with return or drop action)
• All rules can have quick flag for immediate verdict

• Force traffic through VPN interface
• Fixes Apple services bypassing tunnel
• Masquerade non-loopback, non-LAN traffic to tunnel IP
• Disabled on unaffected macOS versions

• Reassemble packet fragments
• Ensures complete transport headers for filtering

​

State Management

flush_states(&policy, is_toggling_split_tunneling)

• Clears connection states on policy changes
• Preserves VPN endpoint connections
• Preserves in-tunnel allowed traffic during multihop
• Preserves LAN traffic when allowed
• Flushes all states when toggling split tunneling

​

Process Restrictions

• Uses user condition matching UID 0
• Only root processes can reach relay endpoints in blocking states
• Prevents unprivileged leak attempts

​

Debugging

• pass - Log allowing rules only
• drop - Log blocking rules only
• all - Log all rules
• Rules logged to pflog0 interface
• View with: tcpdump -netttti pflog0

​

Linux - nftables Integration

​

Implementation

​

Architecture

​

Table and Chains

​

Atomic Updates

1. Create table (if not exists)
2. Delete table (clear existing rules)
3. Re-create table with new chains
4. Add all rules in single batch
5. Verify table exists in kernel

​

Firewall Mark

• Marked packets can bypass tunnel (split tunneling)
• Applied to relay endpoint traffic
• Applied to split-tunneled process traffic
• Prevents reverse path filter issues

​

Process Restrictions

• Uses meta skuid to match root user (UID 0)
• Alternatively uses meta mark matching fwmark
• Only root or marked traffic reaches endpoints in blocking states

​

Kernel Parameters

​

src_valid_mark

net.ipv4.conf.all.src_valid_mark = 1

• Enables fwmark consideration for reverse path filtering
• Prevents strict rp_filter from blocking relay traffic
• Disable via TALPID_FIREWALL_DONT_SET_SRC_VALID_MARK=1

​

arp_ignore

net.ipv4.conf.all.arp_ignore = 2

• Reply to ARP only for IPs on receiving interface
• Prevents ARP probing of in-tunnel IP (CVE-2019-14899 mitigation)
• Disable via TALPID_FIREWALL_DONT_SET_ARP_IGNORE=1

​

Debugging

# View rules with counters
sudo nft list ruleset

# View only Mullvad table
sudo nft list table inet mullvad

​

Common Firewall Rules

​

Always Allowed

1. Loopback traffic - Always permitted
2. DHCP client - UDP 68→67 (v4), UDP 546→547 (v6)
3. DHCP server (when Allow LAN) - UDP 67→68 (v4)
4. NDP (Neighbor Discovery Protocol):
   • Router solicitation (type 133)
   • Router advertisement (type 134) from fe80::/10
   • Redirect (type 137) from fe80::/10
   • Neighbor solicitation (type 135)
   • Neighbor advertisement (type 136)

​

LAN Access (when enabled)

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16
• 169.254.0.0/16 (link-local IPv4)
• fe80::/10 (link-local IPv6)
• fc00::/7 (ULA)

• 224.0.0.0/24 (local IPv4)
• 239.0.0.0/8 (admin IPv4)
• 255.255.255.255/32 (broadcast)
• ff01::/16 through ff05::/16 (IPv6 multicast)

​

Policy-Specific Rules

​

Connecting State

• Allow tunnel endpoint (IP:port:protocol)
• Allow API endpoint (root only)
• Block all DNS except to relay (if multihop)
• Allow in-tunnel traffic (if created)
• Allow LAN (if enabled)

​

Connected State

• Allow tunnel endpoint
• Allow DNS to relay or custom servers only
• Block all other DNS
• Allow all tunnel interface traffic
• Allow LAN (if enabled)

​

Blocked State

• Allow API endpoint (root only, if specified)
• Block all DNS
• Allow LAN (if enabled)

​

API Access

• Connected: API traffic goes through tunnel
• Other states: API bypasses firewall
• Windows: Only mullvad-daemon.exe and problem report tool
• macOS/Linux: Only root processes

​

Mobile Platforms

​

Android

• Routes 0.0.0.0/0 and ::/0 through app
• Applies in connecting, connected, and error states
• System “Block connections without VPN” provides OS-level enforcement
• Exempt traffic: connectivity checks, NTP, hotspot

​

iOS

• Packet tunnel process handles all traffic
• Routing rules force all traffic through tunnel
• Delegates to wireguard-go for tun interface
• Local network always accessible