Skip to main content

​
Daemon Environment Variables

These environment variables control the behavior of the Mullvad VPN daemon.

​
Firewall Configuration

​
TALPID_FIREWALL_DEBUG

Helps debug firewall rules. Behavior varies by platform:
Set to "1" to add packet counters to all firewall rules.
export TALPID_FIREWALL_DEBUG=1

​
TALPID_FIREWALL_DONT_SET_SRC_VALID_MARK

Set to 1 to prevent the daemon from setting the net.ipv4.conf.all.src_valid_mark kernel parameter on Linux. 
export TALPID_FIREWALL_DONT_SET_SRC_VALID_MARK=1
By default, the daemon sets this kernel parameter to 1 to prevent strict reverse path filtering from blocking relay traffic. Only disable if you understand the implications.

​
TALPID_FIREWALL_DONT_SET_ARP_IGNORE

Set to 1 to prevent the daemon from setting the net.ipv4.conf.all.arp_ignore kernel parameter on Linux. 
export TALPID_FIREWALL_DONT_SET_ARP_IGNORE=1
By default, this parameter is set to 2 to prevent attackers from discovering the in-tunnel IP via ARP requests. Only disable for testing purposes.

​
DNS Configuration

​
TALPID_DNS_MODULE

Override the automatic DNS configuration method detection.
Available options:
  • "static-file" - Modify /etc/resolv.conf directly
  • "resolvconf" - Use the resolvconf program
  • "systemd" - Use systemd’s resolved service via DBus
  • "network-manager" - Use NetworkManager via DBus
export TALPID_DNS_MODULE=systemd

​
TALPID_DISABLE_LOCAL_DNS_RESOLVER

Set to 1 to disable the local DNS resolver (macOS only). 
export TALPID_DISABLE_LOCAL_DNS_RESOLVER=1

​
TALPID_NEVER_FILTER_AAAA_QUERIES

Set to 1 to never ignore DNS AAAA queries (macOS only). 
export TALPID_NEVER_FILTER_AAAA_QUERIES=1

​
WireGuard Configuration

​
TALPID_FORCE_USERSPACE_WIREGUARD

Forces the daemon to use the userspace implementation of WireGuard instead of the kernel module. 
export TALPID_FORCE_USERSPACE_WIREGUARD=1

​
Network Monitoring

​
TALPID_DISABLE_OFFLINE_MONITOR

Forces the daemon to always assume the host is online, disabling network connectivity checks. 
export TALPID_DISABLE_OFFLINE_MONITOR=1

​
Split Tunneling (Linux)

​
TALPID_CGROUP2_FS

Forces the daemon to look for the cgroup2 filesystem at a custom path instead of /sys/fs/cgroup. 
export TALPID_CGROUP2_FS=/custom/cgroup/path

​
TALPID_NET_CLS_MOUNT_DIR

Forces the daemon to mount the net_cls controller in a specific directory (cgroup v1 systems only). 
export TALPID_NET_CLS_MOUNT_DIR=/custom/mount/dir

​
Access Control

​
MULLVAD_MANAGEMENT_SOCKET_GROUP

Restricts access to the management interface socket to users in a specific group (Linux and macOS only). 
export MULLVAD_MANAGEMENT_SOCKET_GROUP=mullvad-users
By default, everyone has access to the management socket. Use this variable to restrict CLI and GUI access.

​
Debugging

​
MULLVAD_BACKTRACE_ON_FAULT

Controls whether the daemon logs a backtrace when encountering a fault (e.g., SIGSEGV).
  • 1 - Enable backtrace logging
  • 0 - Disable backtrace logging
  • Default: Enabled in debug builds, disabled in release builds
export MULLVAD_BACKTRACE_ON_FAULT=1
Backtrace logging causes heap allocation in the signal handler, which is technically undefined behavior. Enable at your own risk.

​
File Paths

These environment variables override default file and directory locations:

​
MULLVAD_SETTINGS_DIR

Customize the settings directory location. 
export MULLVAD_SETTINGS_DIR=/custom/settings/path

​
MULLVAD_LOG_DIR

Customize the log directory location. 
export MULLVAD_LOG_DIR=/custom/logs/path

​
MULLVAD_CACHE_DIR

Customize the cache directory location. 
export MULLVAD_CACHE_DIR=/custom/cache/path

​
MULLVAD_RPC_SOCKET_PATH

Customize the full path to the RPC socket. 
export MULLVAD_RPC_SOCKET_PATH=/custom/socket/path
See File Paths for default locations.

​
Development-Only Variables

These variables only work in development builds and are ignored in release builds.

​
MULLVAD_API_HOST

Set the hostname for API requests. 
export MULLVAD_API_HOST=api.mullvad.net

​
MULLVAD_API_ADDR

Set the IP address and port for API requests. 
export MULLVAD_API_ADDR=10.10.1.2:443

​
MULLVAD_API_DISABLE_TLS

Use plain HTTP for API requests instead of HTTPS. 
export MULLVAD_API_DISABLE_TLS=1

​
MULLVAD_CONNCHECK_HOST

Set the hostname for connection check requests. 
export MULLVAD_CONNCHECK_HOST=am.i.mullvad.net

​
MULLVAD_ENABLE_DEV_UPDATES

Enable version checks in development builds. 
export MULLVAD_ENABLE_DEV_UPDATES=1

​
Desktop Frontend Variables

These variables control the Electron desktop application.

​
MULLVAD_PATH

Customize the path to the mullvad-problem-report tool when running in development mode. 
export MULLVAD_PATH=/path/to/target/debug/
Defaults to <repo>/target/debug/.

​
MULLVAD_DISABLE_UPDATE_NOTIFICATION

Set to 1 to disable notifications when updates are available. 
export MULLVAD_DISABLE_UPDATE_NOTIFICATION=1

​
Setting Environment Variables

The method for setting environment variables varies by platform:
Use setx from an elevated command prompt:
setx TALPID_DISABLE_OFFLINE_MONITOR 1 /m
Restart the daemon for changes to take effect:
sc.exe stop mullvadvpn
sc.exe start mullvadvpn

Build docs developers (and LLMs) love

Get started for freeTalk to us