Local Network Access - Mullvad VPN

Overview

Local network access (also called “Allow LAN” or “Local network sharing”) controls whether your device can communicate with other devices on your local network while connected to Mullvad VPN. When enabled:

Access printers, NAS, file shares, media servers
Connect to local services (home assistant, routers, IoT devices)
Participate in local multiplayer games
Use Chromecast, AirPlay, and local streaming

When disabled (default):

Maximum security and privacy
No local network communication
Protection against local network attacks

Local network access is available on all platforms: Windows, Linux, macOS, Android, and iOS. On iOS, the local network is always accessible due to platform limitations.

How It Works

Without VPN (Normal Network Access)

[Your Device] ←─────────────────────► [Local Devices]
       │                              Printer, NAS, etc.
       ▼
    Internet

VPN Connected with Local Network Access Disabled (Default)

[Your Device] ────X──── [Local Devices]  ← BLOCKED
       │
       ▼
  [VPN Tunnel] ────► Internet

Firewall blocks local network traffic for maximum security.

VPN Connected with Local Network Access Enabled

[Your Device] ←─────────────────────► [Local Devices]  ← ALLOWED
       │                              Printer, NAS, etc.
       ▼
  [VPN Tunnel] ────► Internet

Firewall allows traffic to private IP ranges.

Private IP Address Ranges

When local network access is enabled, Mullvad allows traffic to these private (non-routable) IP ranges:

IPv4 Private Ranges

Range	Description	Common Use
`10.0.0.0/8`	Class A private	Large networks, VPNs
`172.16.0.0/12`	Class B private	Medium networks
`192.168.0.0/16`	Class C private	Home networks
`169.254.0.0/16`	Link-local	Auto-configuration (APIPA)

IPv6 Private Ranges

Range	Description
`fe80::/10`	Link-local addresses
`fc00::/7`	Unique local addresses (ULA)

Multicast Ranges (Outgoing Only)

When local network access is enabled, outgoing traffic to local multicast is allowed: IPv4 Multicast:

224.0.0.0/24 - Local subnet multicast
239.0.0.0/8 - Administratively scoped multicast (mDNS, SSDP)
255.255.255.255/32 - Broadcast

IPv6 Multicast:

ff01::/16 - Interface-local multicast
ff02::/16 - Link-local multicast
ff03::/16 - Realm-local multicast
ff04::/16 - Admin-local multicast
ff05::/16 - Site-local multicast

Multicast is used by service discovery protocols like mDNS (Bonjour), SSDP (UPnP), and device discovery.

Enabling Local Network Access

Using the GUI

Open Settings

Navigate to Settings → VPN settings

Find Local Network Sharing

Look for Local network sharing or Allow LAN setting

Enable or Disable

Toggle On to allow local network access
Toggle Off to block local network access (maximum security)

Changes Apply Immediately

No reconnection required - firewall rules update instantly

Using the CLI

# Enable local network access
mullvad lan set allow

# Disable local network access (default)
mullvad lan set block

# Check current setting
mullvad lan get

Output:

Local network sharing setting: allow

Local network sharing setting: block

What You Can Access

When local network access is enabled:

Network Services

✅ Accessible:

Printers: Network and WiFi printers
File shares: SMB/CIFS, NFS, AFP
Network storage: NAS devices, file servers
Media servers: Plex, Jellyfin, DLNA
Streaming devices: Chromecast, AirPlay, Roku
Gaming: Local multiplayer, game servers on LAN
IoT devices: Smart home hubs, lights, cameras
Routers: Web interfaces, management panels
Development servers: Local web servers, databases

Service Discovery Protocols

✅ Works:

mDNS/Bonjour: Discover devices (.local domains)
SSDP/UPnP: Media devices, DLNA
NetBIOS: Windows network browsing
SMB discovery: Network neighborhood

Security Implications

Risks of Enabling Local Network Access

Potential security risks:

Local network attacks: Malicious devices on local network can attack your device
Compromised networks: If local network is compromised, your device is exposed
Public WiFi risks: Dangerous on untrusted networks (cafes, hotels, airports)
Rogue devices: Attackers on same WiFi can scan and probe your device
ARP spoofing: Man-in-the-middle attacks on local network

When to Enable

✅ Safe to enable on:

Home networks: Trusted environment you control
Office networks: Corporate networks with security measures
Trusted private networks: Friends, family, known safe environments

When to Disable

❌ Should disable on:

Public WiFi: Coffee shops, airports, hotels
Shared networks: Coworking spaces, libraries
Untrusted networks: Any network you don’t control or trust
Travel: Unfamiliar networks abroad

Best practice: Disable local network access by default. Enable only when needed and on trusted networks. Disable again when leaving home.

Use Cases

Home Office Setup

# At home - enable for printer and NAS access
mullvad lan set allow

# When traveling - disable for security
mullvad lan set block

Media Streaming

Access local media servers and casting devices:

Enable local network access
Connect to VPN
Stream to Chromecast, use Plex, access NAS
Internet traffic still goes through VPN

Gaming

Local multiplayer or LAN games:

# Enable LAN for local game servers
mullvad lan set allow

# Host or join LAN games
# Internet traffic (matchmaking, updates) goes through VPN

# Disable after gaming session
mullvad lan set block

Development

Access local development servers:

# Enable to access localhost services on other devices
mullvad lan set allow

# Access: http://192.168.1.100:3000
# (Development server on another machine)

Private Custom DNS

Local network access is required for private custom DNS servers:

# Enable local network access
mullvad lan set allow

# Set private DNS server (e.g., Pi-hole)
mullvad dns set custom 192.168.1.100

Without local network access enabled:

Private DNS servers (192.168.x.x, 10.x.x.x) are unreachable
DNS queries will fail
Internet access may not work

Public custom DNS (e.g., 8.8.8.8, 1.1.1.1) does not require local network access. It’s routed through the VPN tunnel.

Platform Differences

Windows, Linux, macOS

Local network access can be enabled or disabled
Firewall rules enforced at kernel level
Changes apply immediately
Full control over local network access

Android

Local network access can be enabled or disabled
Enforced via VPN Service API routing rules
Works as expected

iOS

iOS limitation: Local network is always accessible regardless of the setting.This is a limitation of iOS VPN APIs. The setting is shown for consistency but has no effect on iOS.

From the README (source/README.md:70):

* The local network is always accessible on iOS with the current implementation

Compatibility

Local network access works with:

No conflicts with any other Mullvad features.

Troubleshooting

Cannot Access Local Devices

If you can’t reach local network devices:

Enable local network access:
```
mullvad lan set allow
```
Verify setting:
```
mullvad lan get
```
Should show: Local network sharing setting: allow
Check device IP: Ensure target device is on private IP range
```
# Ping local device
ping 192.168.1.100
```
Check firewall: Ensure target device’s firewall allows connections
Verify network: Ensure you’re on the same network as target device

Local DNS Not Working

If private DNS server is unreachable:

Enable local network access:
```
mullvad lan set allow
```
Set private DNS:
```
mullvad dns set custom 192.168.1.1
```
Test DNS resolution:
```
nslookup example.com 192.168.1.1
```
Verify DNS server is running: Check DNS server is online and accessible

Chromecast/AirPlay Not Working

If casting devices aren’t discovered:

Enable local network access:
```
mullvad lan set allow
```
Restart casting app: Close and reopen the app
Check device is on same network: Ensure casting device and your device are on same WiFi
Check router: Some routers have AP isolation that prevents device-to-device communication

SMB/Network Shares Not Visible

Enable local network access
Manual connection: Instead of browsing, connect directly by IP:
- Windows: \\192.168.1.100\share
- macOS: smb://192.168.1.100/share
- Linux: smb://192.168.1.100/share
Check credentials: Ensure you have correct username/password
Check SMB version: Older SMB versions may be disabled on modern systems

Best Practices

Network-Specific Settings

Home Network
Office Network
Public WiFi
Travel

# Safe to enable at home
mullvad lan set allow

Access your printers, NAS, smart home devices.

# Enable if needed for work resources
mullvad lan set allow

Access company file shares, printers, internal services.

# ALWAYS disable on public networks
mullvad lan set block

Maximum protection against local network attacks.

# Disable on unfamiliar networks
mullvad lan set block

Don’t trust hotel, airport, or cafe networks.

Automation Ideas

Script to toggle based on network (example for macOS/Linux):

#!/bin/bash
# Toggle LAN access based on WiFi SSID

SSID=$(networksetup -getairportnetwork en0 | awk -F': ' '{print $2}')

if [ "$SSID" = "HomeWiFi" ]; then
    mullvad lan set allow
    echo "Enabled LAN access on trusted network"
else
    mullvad lan set block
    echo "Disabled LAN access on untrusted network"
fi

Security Hygiene

Default to disabled: Only enable when needed
Disable on public WiFi: Always block on untrusted networks
Review regularly: Check setting when changing networks
Combine with firewall: Use OS firewall for additional protection
Monitor connections: Check for unexpected network activity

Technical Details

Firewall Implementation

From source code (talpid-core/src/firewall/linux.rs:947):

fn add_allow_lan_rules(&mut self) {
    // Add rules to allow private IP ranges
    // 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, etc.
}

Firewall rules are added/removed based on allow_lan setting.

Always-Allowed Protocols

Regardless of local network access setting, these protocols are always allowed:

DHCPv4: Client-server (ports 67-68)
DHCPv6: Client-server (ports 546-547)
NDP subset: Router solicitation/advertisement, neighbor solicitation/advertisement

These are required for network connectivity and IP configuration.

Android Implementation

From source code (talpid-tunnel/src/tun_provider/android/mod.rs:323-341):

if !config.allow_lan {
    // Block all private IP ranges
} else {
    // Exclude private IPs from VPN routing
    let (lan_ipv4, lan_ipv6) = allowed_lan_networks();
    // Configure VPN to bypass these ranges
}

Android uses VPN Service API to exclude private IPs from VPN routing.

Getting Started

Features

Platform Guides

Security & Privacy

Account & Devices

​Overview

​How It Works

​Without VPN (Normal Network Access)

​VPN Connected with Local Network Access Disabled (Default)

​VPN Connected with Local Network Access Enabled

​Private IP Address Ranges

​IPv4 Private Ranges

​IPv6 Private Ranges

​Multicast Ranges (Outgoing Only)

​Enabling Local Network Access

​Using the GUI

​Using the CLI

​What You Can Access

​Network Services

​Service Discovery Protocols

​Security Implications

​Risks of Enabling Local Network Access

​When to Enable

​When to Disable

​Use Cases

​Home Office Setup

​Media Streaming

​Gaming

​Development

​Private Custom DNS

​Platform Differences

​Windows, Linux, macOS

​Android

​iOS

​Compatibility

​Troubleshooting

​Cannot Access Local Devices

​Local DNS Not Working

​Chromecast/AirPlay Not Working

​SMB/Network Shares Not Visible

​Best Practices

​Network-Specific Settings

​Automation Ideas

​Security Hygiene

​Technical Details

​Firewall Implementation

​Always-Allowed Protocols

​Android Implementation

​Further Reading

​Related Features

Build docs developers (and LLMs) love

Overview

How It Works

Without VPN (Normal Network Access)

VPN Connected with Local Network Access Disabled (Default)

VPN Connected with Local Network Access Enabled

Private IP Address Ranges

IPv4 Private Ranges

IPv6 Private Ranges

Multicast Ranges (Outgoing Only)

Enabling Local Network Access

Using the GUI

Using the CLI

What You Can Access

Network Services

Service Discovery Protocols

Security Implications

Risks of Enabling Local Network Access

When to Enable

When to Disable

Use Cases

Home Office Setup

Media Streaming

Gaming

Development

Private Custom DNS

Platform Differences

Windows, Linux, macOS

Android

iOS

Compatibility

Troubleshooting

Cannot Access Local Devices

Local DNS Not Working

Chromecast/AirPlay Not Working

SMB/Network Shares Not Visible

Best Practices

Network-Specific Settings

Automation Ideas

Security Hygiene

Technical Details

Firewall Implementation

Always-Allowed Protocols

Android Implementation

Further Reading

Related Features