Desktop Applications

​

Supported Operating Systems

​

Windows

• Windows 10
• Windows 11

​

macOS

• The three latest major releases

​

Linux

​

Architecture

​

System Service (mullvad-daemon)

• Location: Runs as a system service/daemon
• Privileges: Requires administrator/root access
• Always Running: Operates continuously in the background, even when GUI is closed
• Management Interface: Exposes control via Unix domain sockets (Linux/macOS) or named pipes (Windows)
• Responsibilities:
  • Tunnel management
  • Firewall rule configuration
  • DNS settings management
  • Kill switch enforcement
  • API communication

​

Graphical User Interface (GUI)

• Technology: Built with Electron + React
• Security: Only loads local resources, never remote content
• Communication: Connects exclusively to mullvad-daemon via management interface
• Per-User Settings: Stores GUI preferences separately for each user
• Location:
  • Linux: $XDG_CONFIG_HOME/Mullvad VPN/gui_settings.json
  • macOS: ~/Library/Application Support/Mullvad VPN/gui_settings.json
  • Windows: %LOCALAPPDATA%\Mullvad VPN\gui_settings.json

​

Command-Line Interface (CLI)

• Binary Name: mullvad
• Full Control: Access to all daemon functionality
• Automation: Ideal for scripts and automation
• See: CLI documentation for complete reference

​

Installation

​

Windows

1. Download the installer from mullvad.net/download
2. Run the .exe installer
3. The installer will:
   • Install the system service
   • Configure Windows Firewall Integration (WFP)
   • Create Start Menu shortcuts
   • Set up auto-start (optional)

​

macOS

1. Download the .pkg installer from mullvad.net/download
2. Open and run the installer package
3. The installer will:
   • Install the system service as a LaunchDaemon
   • Configure Packet Filter (PF) integration
   • Install the application to /Applications

​

Linux

​

Debian/Ubuntu

# Download the .deb package
wget https://mullvad.net/download/app/deb/latest

# Install using apt
sudo apt install ./mullvad-vpn_*.deb

​

Fedora

# Download the .rpm package
wget https://mullvad.net/download/app/rpm/latest

# Install using dnf
sudo dnf install ./mullvad-vpn-*.rpm

​

Arch Linux

yay -S mullvad-vpn

• Systemd service: mullvad-daemon.service
• nftables firewall integration
• Desktop entry for application menu

​

Features

​

Firewall Integration

• Windows: Windows Filtering Platform (WFP)
• macOS: Packet Filter (PF)
• Linux: nftables

​

Kill Switch

• Automatic: Enabled by default, cannot be disabled
• Blocks All Traffic: When connecting, disconnecting, or in error state
• No Leak Windows: Atomic firewall transactions prevent gaps
• See: Security documentation for details

​

Lockdown Mode

• Purpose: Ensures device can only communicate via VPN
• Setting: Enable in app settings
• Effect: Applies firewall rules even in disconnected state

​

Split Tunneling

• Platform Support: Windows, macOS, and Linux
• Use Cases:
  • Local network services
  • Applications requiring direct internet access
  • Performance-sensitive applications
• Configuration: Available in app settings or via CLI

​

Custom DNS

• Default: Uses VPN server’s DNS
• Custom Options:
  • Custom DNS servers (through tunnel)
  • DNS content blocking (ads, trackers, malware)
• Leak Protection: DNS queries always go through tunnel

​

Local Network Sharing

• When Enabled: Traffic to private IP ranges is allowed
• Use Cases:
  • Printers
  • File shares
  • IoT devices
• IP Ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, link-local addresses

​

WireGuard Features

• Multihop: Route through two VPN servers
• Quantum-Resistant: Post-quantum cryptography support
• Transport Options: TCP, Shadowsocks, QUIC obfuscation
• DAITA: Defense Against AI-Guided Traffic Analysis
• LWO: Lightweight WireGuard Obfuscation

​

System Service Management

​

Windows

# Stop the service
sc.exe stop mullvadvpn

# Start the service
sc.exe start mullvadvpn

# Check status
sc.exe query mullvadvpn

​

macOS

# Stop the service
sudo launchctl unload -w /Library/LaunchDaemons/net.mullvad.daemon.plist

# Start the service
sudo launchctl load -w /Library/LaunchDaemons/net.mullvad.daemon.plist

# Check status
sudo launchctl list | grep mullvad

​

Linux

# Stop the service
sudo systemctl stop mullvad-daemon

# Start the service
sudo systemctl start mullvad-daemon

# Enable at boot
sudo systemctl enable mullvad-daemon

# Check status
sudo systemctl status mullvad-daemon

​

File Locations

​

Settings

​

Logs

​

Cache

​

Tray Icon (Linux)

​

GNOME

1. Visit GNOME Extensions
2. Install “AppIndicator and KStatusNotifierItem Support”

​

Other Desktop Environments

• libappindicator3-1
• libappindicator1
• libappindicator

​

Environment Variables

​

Common Variables

• TALPID_FORCE_USERSPACE_WIREGUARD: Force userspace WireGuard implementation
• TALPID_DISABLE_OFFLINE_MONITOR: Always assume host is online
• MULLVAD_MANAGEMENT_SOCKET_GROUP: (Linux/macOS) Restrict management interface access to specific group

​

Setting Environment Variables

​

Windows

setx TALPID_DISABLE_OFFLINE_MONITOR 1 /m
sc.exe stop mullvadvpn
sc.exe start mullvadvpn

​

Linux

sudo systemctl edit mullvad-daemon.service
# Add:
# [Service]
# Environment="TALPID_DISABLE_OFFLINE_MONITOR=1"

sudo systemctl restart mullvad-daemon

​

macOS

sudo plutil -replace EnvironmentVariables -json '{"TALPID_DISABLE_OFFLINE_MONITOR": "1"}' \
  /Library/LaunchDaemons/net.mullvad.daemon.plist
launchctl unload -w /Library/LaunchDaemons/net.mullvad.daemon.plist
launchctl load -w /Library/LaunchDaemons/net.mullvad.daemon.plist

​

Troubleshooting

​

Connection Issues

1. Check daemon status using system service commands
2. Review logs in the log directory for your platform
3. Try connecting via CLI: mullvad connect
4. Check firewall rules aren’t conflicting

​

Firewall Issues

• Windows: Ensure WFP isn’t blocked by other security software
• macOS: Check PF isn’t disabled or conflicting with other rules
• Linux: Verify nftables is installed and no conflicting iptables rules exist

​

GUI Not Connecting

1. Ensure daemon service is running
2. Check management interface socket/pipe permissions
3. Verify no other security software is blocking communication

​

Next Steps