mullvad / mullvadvpn-app

The Mullvad VPN client app for desktop and mobile

Mullvad VPN desktop and mobile app

Welcome to the Mullvad VPN client app source code repository. This is the VPN client software for the Mullvad VPN service. For more information about the service, please visit our website, mullvad.net (Also accessible via Tor on our onion service).

This repository contains all the source code for the desktop and mobile versions of the app. For desktop this includes the system service/daemon (mullvad-daemon), a graphical user interface (GUI) and a command line interface (CLI). The Android app uses the same backing system service for the tunnel and security but has a dedicated frontend in android/. iOS consists of a completely standalone implementation that resides in ios/.

Releases

There are built and signed releases for macOS, Windows, Linux and Android available on our website and on Github. The Android app is also available on Google Play and F-Droid and the iOS version on App Store.

You can find our code signing keys as well as instructions for how to cryptographically verify your download on Mullvad's Open Source page.

Platform/OS support

These are the operating systems and their versions that the app officially supports. It might work on many more versions, but we don't test for those and can't guarantee the quality or security.

OS/Platform	Supported versions
Windows	10 and 11
macOS	The three latest major releases
Linux (Ubuntu)	The two latest LTS releases and the latest non-LTS releases
Linux (Fedora)	The versions that are not yet EOL
Linux (Debian)	11 and newer
Android	8 and newer
iOS	14.2 and newer

On Linux we test using the Gnome desktop environment. The app should, and probably does work in other DEs, but we don't regularly test those.

Features

Here is a table containing the features of the app across platforms. This is intended to reflect the current state of the latest code in git, not necessarily any existing release.

	Windows	Linux	macOS	Android	iOS
OpenVPN	✓	✓	✓
WireGuard	✓	✓	✓	✓	✓
Quantum-resistant tunnels	✓	✓	✓	✓	✓
DAITA	✓	✓	✓
WireGuard multihop	✓	✓	✓
WireGuard over TCP	✓	✓	✓	✓	✓
OpenVPN over Shadowsocks	✓	✓	✓
Split tunneling	✓	✓	✓	✓
Custom DNS server	✓	✓	✓	✓	✓
Content blockers (Ads etc)	✓	✓	✓	✓	✓
Optional local network access	✓	✓	✓	✓	✓*
Externally audited	✓	✓	✓	✓	✓

* The local network is always accessible on iOS with the current implementation

Security and anonymity

This app is a privacy preserving VPN client. As such it goes to great lengths to stop traffic leaks. And basically all settings default to the more secure/private option. The user has to explicitly allow more loose rules if desired. See the dedicated security document for details on what the app blocks and allows, as well as how it does it.

Checking out the code

This repository contains submodules needed for building the app. However, some of those submodules also have further submodules that are quite large and not needed to build the app. So unless you want the source code for OpenSSL, OpenVPN and a few other projects you should avoid a recursive clone of the repository. Instead clone the repository normally and then get one level of submodules:

git clone https://github.com/mullvad/mullvadvpn-app.git
cd mullvadvpn-app
git submodule update --init

On Android, Linux and macOS you also want to checkout the wireguard-go submodule recursively:

git submodule update --init --recursive --depth=1 wireguard-go-rs

Further details on why this is necessary can be found in the wireguard-go-rs crate.

We sign every commit on the main branch as well as our release tags. If you would like to verify your checkout, you can find our developer keys on Mullvad's Open Source page.

Binaries submodule

This repository has a git submodule at dist-assets/binaries. This submodule contains binaries and build scripts for third party code we need to bundle with the app. Such as OpenVPN, Wintun etc.

This submodule conforms to the same integrity/security standards as this repository. Every merge commit should be signed. And this main repository should only ever point to a signed merge commit of the binaries submodule.

See the binaries submodule's README for more details about that repository.

Building the app

See the build instructions for help building the app on desktop platforms.

For building the Android app, see the instructions for Android.

For building the iOS app, see the instructions for iOS.

Releasing the app

See this for instructions on how to make a new release.

Environment variables used by the service

• TALPID_FIREWALL_DEBUG - Helps debugging the firewall. Does different things depending on platform:

  • Linux: Set to "1" to add packet counters to all firewall rules.
  • macOS: Makes rules log the packets they match to the pflog0 interface.
    • Set to "all" to add logging to all rules.
    • Set to "pass" to add logging to rules allowing packets.
    • Set to "drop" to add logging to rules blocking packets.

• TALPID_FIREWALL_DONT_SET_SRC_VALID_MARK - Forces the daemon to not set src_valid_mark config on Linux. The kernel config option is set because otherwise strict reverse path filtering may prevent relay traffic from reaching the daemon. If rp_filter is set to 1 on the interface that will be receiving relay traffic, and src_valid_mark is not set to 1, the daemon will not be able to receive relay traffic.

• TALPID_DNS_MODULE - Allows changing the method that will be used for DNS configuration. By default this is automatically detected, but you can set it to one of the options below to choose a specific method.

  • Linux

    • "static-file": change the /etc/resolv.conf file directly
    • "resolvconf": use the resolvconf program
    • "systemd": use systemd's resolved service through DBus
    • "network-manager": use NetworkManager service through DBus

  • Windows

    • iphlpapi: use the IP helper API
    • netsh: use the netsh program
    • tcpip: set TCP/IP parameters in the registry

• TALPID_FORCE_USERSPACE_WIREGUARD - Forces the daemon to use the userspace implementation of WireGuard on Linux.

• TALPID_DISABLE_OFFLINE_MONITOR - Forces the daemon to always assume the host is online.

• TALPID_NET_CLS_MOUNT_DIR - On Linux, forces the daemon to mount the net_cls controller in the specified directory if it isn't mounted already.

• MULLVAD_MANAGEMENT_SOCKET_GROUP - On Linux and macOS, this restricts access to the management interface UDS socket to users in the specified group. This means that only users in that group can use the CLI and GUI. By default, everyone has access to the socket.

Development builds only

• MULLVAD_API_HOST - Set the hostname to use in API requests. E.g. api.mullvad.net.

• MULLVAD_API_ADDR - Set the IP address and port to use in API requests. E.g. 10.10.1.2:443.

• MULLVAD_API_DISABLE_TLS - Use plain HTTP for API requests.

• MULLVAD_CONNCHECK_HOST - Set the hostname to use in connection check requests. E.g. am.i.mullvad.net.

Setting environment variables

Windows

Use setx from an elevated shell:

setx TALPID_DISABLE_OFFLINE 1 /m

For the change to take effect, restart the daemon:

sc.exe stop mullvadvpn
sc.exe start mullvadvpn

Linux

Edit the systemd unit file via systemctl edit mullvad-daemon.service:

[Service]
Environment="TALPID_DISABLE_OFFLINE_MONITOR=1"

For the change to take effect, restart the daemon:

sudo systemctl restart mullvad-daemon

macOS

Use launchctl:

sudo launchctl setenv TALPID_DISABLE_OFFLINE_MONITOR 1

For the change to take effect, restart the daemon:

launchctl unload -w /Library/LaunchDaemons/net.mullvad.daemon.plist
launchctl load -w /Library/LaunchDaemons/net.mullvad.daemon.plist

Environment variables used by the GUI frontend

• MULLVAD_PATH - Allows changing the path to the folder with the mullvad-problem-report tool when running in development mode. Defaults to: <repo>/target/debug/.
• MULLVAD_DISABLE_UPDATE_NOTIFICATION - If set to 1, GUI notification will be disabled when an update is available.

Command line tools for Electron GUI app development

• $ npm run develop - develop app with live-reload enabled
• $ npm run lint - lint code
• $ npm run pack:<OS> - prepare app for distribution for your platform. Where <OS> can be linux, mac or win
• $ npm test - run tests

Tray icon on Linux

The requirements for displaying a tray icon varies between different desktop environments. If the tray icon doesn't appear, try installing one of these packages:

• libappindicator3-1
• libappindicator1
• libappindicator

If you're using GNOME, try installing one of these GNOME Shell extensions:

• TopIconsFix
• TopIcons Plus

Repository structure

Electron GUI app and electron-builder packaging assets

• gui/
  • assets/ - Graphical assets and stylesheets
  • src/
    • main/
      • index.ts - Entry file for the main process
    • renderer/
      • app.tsx - Entry file for the renderer process
      • routes.tsx - Routes configurator
      • transitions.ts - Transition rules between views
    • config.json - App color definitions and URLs to external resources
  • tasks/ - Gulp tasks used to build app and watch for changes during development
    • distribution.js - Configuration for electron-builder
  • test/ - Electron GUI tests
• dist-assets/ - Icons, binaries and other files used when creating the distributables
  • binaries/ - Git submodule containing binaries bundled with the app. For example the statically linked OpenVPN binary. See the README in the submodule for details
  • linux/ - Scripts and configuration files for the deb and rpm artifacts
  • pkg-scripts/ - Scripts bundled with and executed by the macOS pkg installer
  • windows/ - Windows NSIS installer configuration and assets
  • ca.crt - The Mullvad relay server root CA. Bundled with the app and only OpenVPN relays signed by this CA are trusted

Building, testing and misc

• build-windows-modules.sh - Compiles the C++ libraries needed on Windows
• build.sh - Sanity checks the working directory state and then builds installers for the app

Mullvad Daemon

The daemon is implemented in Rust and is implemented in several crates. The main, or top level, crate that builds the final daemon binary is mullvad-daemon which then depend on the others.

In general one can look at the daemon as split into two parts, the crates starting with talpid and the crates starting with mullvad. The talpid crates are supposed to be completely unrelated to Mullvad specific things. A talpid crate is not allowed to know anything about the API through which the daemon fetch Mullvad account details or download VPN server lists for example. The talpid components should be viewed as a generic VPN client with extra privacy and anonymity preserving features. The crates having mullvad in their name on the other hand make use of the talpid components to build a secure and Mullvad specific VPN client.

• Cargo.toml - Main Rust workspace definition. See this file for which folders here are daemon Rust crates.
• mullvad-daemon/ - Main Rust crate building the daemon binary.
• talpid-core/ - Main crate of the VPN client implementation itself. Completely Mullvad agnostic privacy preserving VPN client library.

Vocabulary

Explanations for some common words used in the documentation and code in this repository.

• App - This entire product (everything in this repository) is the "Mullvad VPN App", or App for short.
  • Daemon - Refers to the mullvad-daemon Rust program. This headless program exposes a management interface that can be used to control the daemon
  • Frontend - Term used for any program or component that connects to the daemon management interface and allows a user to control the daemon.
    • GUI - The Electron + React program that is a graphical frontend for the Mullvad VPN App.
    • CLI - The Rust program named mullvad that is a terminal based frontend for the Mullvad VPN app.

File paths used by Mullvad VPN app

A list of file paths written to and read from by the various components of the Mullvad VPN app

Daemon

On Windows, when a process runs as a system service the variable %LOCALAPPDATA% expands to C:\Windows\system32\config\systemprofile\AppData\Local.

All directory paths are defined in, and fetched from, the mullvad-paths crate.

Settings

The settings directory can be changed by setting the MULLVAD_SETTINGS_DIR environment variable.

Platform	Path
Linux	/etc/mullvad-vpn/
macOS	/etc/mullvad-vpn/
Windows	%LOCALAPPDATA%\Mullvad VPN\
Android	getFilesDir()

Logs

The log directory can be changed by setting the MULLVAD_LOG_DIR environment variable.

Platform	Path
Linux	/var/log/mullvad-vpn/ + systemd
macOS	/var/log/mullvad-vpn/
Windows	C:\ProgramData\Mullvad VPN\
Android	getFilesDir()

Cache

The cache directory can be changed by setting the MULLVAD_CACHE_DIR environment variable.

Platform	Path
Linux	/var/cache/mullvad-vpn/
macOS	/Library/Caches/mullvad-vpn/
Windows	C:\ProgramData\Mullvad VPN\cache
Android	getCacheDir()

RPC address file

The full path to the RPC address file can be changed by setting the MULLVAD_RPC_SOCKET_PATH environment variable.

Platform	Path
Linux	/var/run/mullvad-vpn
macOS	/var/run/mullvad-vpn
Windows	//./pipe/Mullvad VPN
Android	getNoBackupFilesDir()

GUI

The GUI has a specific settings file that is configured for each user. The path is set in the gui/packages/desktop/main/gui-settings.ts file.

Platform	Path
Linux	$XDG_CONFIG_HOME/Mullvad VPN/gui_settings.json
macOS	~/Library/Application Support/Mullvad VPN/gui_settings.json
Windows	%LOCALAPPDATA%\Mullvad VPN\gui_settings.json
Android	Present in Android's logcat

Icons

See graphics README for information about icons.

Locales and translations

Instructions for how to handle locales and translations are found here.

For instructions specific to the Android app, see here.

Audits, pentests and external security reviews

Mullvad has used external pentesting companies to carry out security audits of this VPN app. Read more about them in the audits readme.

License

Copyright (C) 2024 Mullvad VPN AB

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

For the full license agreement, see the LICENSE.md file

The source code for the iOS app is GPL-3 licensed like everything else in this repository. But the distributed app on the Apple App Store is not GPL licensed, it falls under the Apple App Store EULA.

mullvadvpn-app's Issues

VM connection problem

After installing the 2018.4-beta3 (Host Windows) I am having problems with my VM client (Windows),
The network connection on my VM client (Windows) is a NAT connection and sharing my host's IP.

Internet connection status: connected
Ping: pakkets send 4, packets received 4

When I launch a browser my internet connection drops every time, when I ping google it sends and receives all packets. Could this be a DNS problem with the mullvad app?

Conflicts when having more than one TAP-Win32 adapter

When using other VPNs, like tinc (https://tinc-vpn.org/), that also make use of TAP-Win32 adapters, the new Mullvad client is never connecting, and when uninstalling it removes ALL instances of the adapter, even the ones not added by the installer.

The old client also had some issues (like replacing the info of a previously existing adapter, when installing the client) BUT in general you were able to connect, you would just needed to have in mind that the "Mullvad TAP-Win32" adapter was going to be the 1st one (the one that got installed first, subsequent adapters were ignored). I'm not sure how the then client decides "which" adapter to use, because it seems it's not using the right one...

Chinese ISPs to block TCP ports 80, 8080, and 443 by January 11, 2018

https://www.networkworld.com/article/3245795/sd-wan/china-to-block-sd-wan-and-vpn-traffic-by-jan-11.html
Any plans?

Mullvad's problem is not their app.

In all the world, there isn't a gui availabe for Linux VPN use that approaches the expert, reliable and simple approach Mullvad has brought to VPN users. Their "I don't want to know who you are" approach to satisfying a market for VPN users brings with it a big problem. Most users would need to use a credit card. The rest send cash, use bitcoin or whatever. The problem with this, Mullvad decides willy nilly whether they will accept a credit payment based on nothing whatsoever. Try the service out for a few hours for free. Decide to try it for a month, and pay them the five euros via credit card. Then try another six months worth and everything goes well, you try to pay for a year's service. At this point they suddenly flip out and throw your account into a "bad boy" category in which you don't know if you will have a VPN service or not at the end of the period you've already paid for.

A clear case of scientists and accountants running a company into the ground.

Mullvad 2018.5 GUI window not visible on macOS VM

I believe this is a similar issue as #531. I'm running a macOS VM as a guest OS inside a macOS host (yeah, I'm that person). Mullvad installed fine, but when I click on the lock icon in the menu bar, only a few pixels at the top of the window show up.

I also tried 2018.4 and 2018.3 out of curiosity, same problem. However, the advice from issue #531 works:

$ cd /Applications/Mullvad\ VPN.app/Contents/MacOS/
$ ./Mullvad\ VPN --disable-gpu
[2018-11-24 22:24:17.354][debug] Logging to /Users/jcook/Library/Logs/Mullvad VPN/frontend.log
[2018-11-24 22:24:17.358][info] Running version 2018.5.0
2018-11-24 22:24:17.441 Mullvad VPN[734:11183] *** WARNING: Textured window <AtomNSWindow: 0x7fcda6dd2170> is getting an implicitly transparent titlebar. This will break when linking against newer SDKs. Use NSWindow's -titlebarAppearsTransparent=YES instead.
[2018-11-24 22:24:18.164][info] Connecting to transport with params { path: '/var/run/mullvad-vpn' }
[2018-11-24 22:24:18.252][info] Transport is connected
[2018-11-24 22:24:18.348][debug] Tunnel state: disconnected
[2018-11-24 22:24:18.407][debug] Account token is set. Showing the tunnel view.
[2018-11-24 22:24:19.003][info] Got relay locations
[2018-11-24 22:24:19.857][debug] Autoconnect the tunnel
[2018-11-24 22:24:20.079][debug] Tunnel state: connecting
[2018-11-24 22:24:23.865][debug] Tunnel state: connected
[2018-11-24 22:24:33.909][warn] Request d97d70b0-9a85-4806-b557-b5dc579236f2 timed out:  { id: 'd97d70b0-9a85-4806-b557-b5dc579236f2',
  jsonrpc: '2.0',
  method: 'get_current_location',
  params: [] }
[2018-11-24 22:24:33.910][error] Failed to update the location: Request timed out

Using this method, the GUI shows up! But still sounds like a bug. :)

Sudden incompatibility with Docker

Hi,

I hope it's fine posting here, as it's not an issue with the app itself, but rather an issue that it produces in Docker.

The 2018(.3) version of the app seems to have an incompatibility issue with Docker which the old version of the client does not have. When the new version is active, Docker throws errors about the firewall blocking when trying to share drives to it.

Bottom line is that I cannot run Docker at the same time as the new Mullvad client. The moment I disconnect (or use the old version of the vpn client), everything is just peachy again.

I have found this issue in the Docker repo: docker/for-win#360, as it seems VPNs can throw off the application. But even attempts at changing the subnet address in Docker don't seem to do fix for me. I am posting here in hopes you will be able to recognise what changed between the new and old version of the mullvad client, and can resolve the issue/point me in the right direction.

DNS Leak

am i mullvad shows dns leak... am i doing something wrong?

api.mullvad.net is blocked, please check your firewall

hey there
i have issue on ubuntu 18.04
when i enter account number, it doesn't connect and just throw an error saying: "api.mullvad.net is blocked, please check your firewall"
mullvad version: 2018.2 and 2018.3
system specs: ubuntu 18.04 64bit

Back button mis-formatted in Advanced page

Just got beta-9 and the back button to “Settings” is mis-formatted on the Advanced page. macOS 10.13.3. If you'd rather I not report issues on your Github, let me know. ;) Just figured I'd let you know.

AttributeError during startup on Ubuntu 18.04

When running env MULLVAD_USE_GTK3=yes mullvad on Ubuntu 18.04 it fails with the following output:

Using GTK3
/usr/lib/python2.7/dist-packages/mullvad/mui.py:60: PyGIWarning: AppIndicator3 was imported without specifying a version first. Use gi.require_version('AppIndicator3', '0.1') before import to ensure that the right version gets loaded.
  from gi.repository import AppIndicator3 as appindicator
changing directory to /usr/lib/python2.7/dist-packages/mullvad
Setting logging directory to /home/username/.cache/mullvad/log

(mullvad:4885): Gtk-WARNING **: 10:01:38.719: gtk_disable_setlocale() must be called before gtk_init()
Setting logging directory to /home/username/.cache/mullvad/log
CRITICAL: An uncaught exception occured: Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/wx-3.0-gtk3/wx/_core.py", line 16765, in <lambda>
    lambda event: event.callable(*event.args, **event.kw) )
  File "/usr/lib/python2.7/dist-packages/mullvad/mui.py", line 2088, in _start
    _start_gui(app, root_window, log, settings, tunnel)
  File "/usr/lib/python2.7/dist-packages/mullvad/mui.py", line 2138, in _start_gui
    tray_ui = AppIndicator(root_window, tunnel, settings)
  File "/usr/lib/python2.7/dist-packages/mullvad/mui.py", line 295, in __init__
    appindicator.CATEGORY_COMMUNICATIONS)
  File "/usr/lib/python2.7/dist-packages/gi/module.py", line 137, in __getattr__
    self.__name__, name))
AttributeError: 'gi.repository.AppIndicator3' object has no attribute 'CATEGORY_COMMUNICATIONS'

Adding gi.require_version('AppIndicator3', '0.1') in line 60 of mui.py has no effect on the AttributeError.
I have mullvad_67-1_all.deb installed.
Any fix would be greatly appreciated!

App stuck "connecting to daemon"

I have version 2018.2 of the app installed, and if I choose "Run Mullvad VPN" right at the end of the installation, it seems to work fine, but whenever I thereafter have closed the app and try to run it again, it seems to be stuck "connecting to daemon" in the tray; if I click on the red lock icon in the tray, this is all it ever says (neither does anything generally happen when I click the cogwheel). Killing the process tree and restarting has no effect. I have tried uninstalling and installing several times. From support I got a nightly build of the app which was supposed to perhaps fix this problem, but it seems to behave the same.

Add monochrome menu bar icon option

All of my Mac menu bar icons are black/white except for Mullvad which uses color icons. I think it would be ideal to have a setting that allow the user to toggle between color and black/white icons depending which they prefer.

I've taken an initial crack at adding this functionality here:
https://github.com/jeffbowen/mullvadvpn-app/tree/monochrome-tray-icons

I haven't yet tested the animation in action as I can't yet get it to connect per #41.

I also would still need to add a way to persist the user's preference. I've never worked with an Electron app so forgive me if I've approached anything incorrectly. I'm not sure where it would make sense to store the preference. Would you want to actually store it on the backend or in some sort of local storage specific to just this app instance. The latter seems preferable to me but would love to hear what you guys think as you're far more intimately aware with the app and the direction it's headed.

Position of Grey Outline seems to be off

The position of the grey outline at the top of the Mullvad app seems to be off:

I'm using the following setup:

• MacBook Pro with macOS Mojave Version 10.14
• Mullvad VPN app version 2018.4

Windows Defender Firewall Bug (I guess)

I found a bug I think related to the Windows Defender Firewall. I managed to install the app correctly and i got the request to add the exception to the Windows Firewall rules. I clicked add and everything seems to work correctly. I could add the account number but the application struggled to connect to the servers. I tried to restart the PC. Once I did that I couldn't even login since It was saying that I had to add api.mullvad.net to the firewall exception.. but I already did that! I looked at the logs and I found this error repeating every trial of login:

• Failed to log in, Remote JSON-RPC error -32603: Internal error

And the story is not over yet.
I tried to uninstall and reinstall the application.. I couldn't reinstall it since the installation process stopped with an error at approx 80% saying that it couldn't complete the installation due to an error 1.
I'm sorry for my English.
I hope it could be helpful..

hey there

Thank you for wanting to help us improve the Mullvad VPN app by reporting
issues.

Before reporting an issue, please note that this is not the correct
place for:

• General Mullvad support - contact [email protected] for that

• Bugs and issues regarding the old Mullvad client.

  With the old Mullvad client we mean the one written in python and
  with version numbers such as 65, 66, 67 and similar.
  This source code repository is only for the new Mullvad VPN app with version
  numbers looking like <year>.<number>, such as 2018.1 and so on.

Please proceed and report an issue if you have found a bug or a problem with
the new Mullvad VPN app, the one being developed in this repository.

Add license file?

I can see that you have it defined in ‘package.json’ but might be a good idea to include an actual license file now when you have open-sourced this project. 😄

Port options

Hi are there a Way to add a Open port or is it not inplamented yet?

What protocol does this VPN use?

OpenVPN ?

feature: keeping system DNS unchanged or use custom DNS

hi, I have a local DNS resolver for caching reasons and I want to keep using it when I enable mullvad, but the daemon changes resolv.conf without asking and even monitors it and reverts it every time it is changed. I couldn't find a way to disable this

could an option be added to disable this behaviour?

Client's crashing after upgrading to Kubuntu 18.10

Hi,

I have recently upgraded my Kubuntu from 18.04 to 18.10 and since then the Mullvad's client (the GUI application) is constantly crashing when I try to execute it.

A strace excerpt from a single invocation of mullvad-vpn looks like this:

[...]
openat(AT_FDCWD, "/dev/urandom", O_RDONLY) = 3
read(3, "\266\2378<", 4)                = 4
close(3)                                = 0
futex(0x58096d8, FUTEX_WAKE_PRIVATE, 2147483647) = 0
mmap(0x372926742000, 131072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x372926742000                                                                                           
mprotect(0x372926742000, 4096, PROT_NONE) = 0
mmap(0x372926762000, 131072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x372926762000                                                                                           
mprotect(0x372926762000, 4096, PROT_NONE) = 0
mmap(0x372926782000, 131072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x372926782000                                                                                           
mprotect(0x372926782000, 4096, PROT_NONE) = 0
mmap(0x3729267a2000, 61440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3729267a2000                                                                                            
mmap(0x3729267b1000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3729267b1000                                                                                            
mmap(0x3729267b9000, 131072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3729267b9000                                                                                           
mprotect(0x3729267b9000, 4096, PROT_NONE) = 0
mmap(0x3729267d9000, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3729267d9000                                                                                          
mmap(0x3729268d9000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3729268d9000                                                                                            
mmap(0x3729268e1000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3729268e1000                                                                                            
madvise(0x3729267d9000, 1048576, MADV_DONTNEED) = 0
madvise(0x3729267e5000, 4096, MADV_DONTNEED) = 0
madvise(0x3729267f0000, 954368, MADV_DONTNEED) = 0
futex(0x7fc5ac866f18, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7fc5ac866f18, FUTEX_WAKE_PRIVATE, 2147483647) = 0
madvise(0x3729267ed000, 4096, MADV_DONTNEED) = 0
getrandom("\xb5", 1, GRND_NONBLOCK)     = 1
stat("/etc/gnutls/default-priorities", 0x7ffc90d6e880) = -1 ENOENT (No such file or directory)
statfs("/sys/fs/selinux", 0x7ffc90d6e860) = -1 ENOENT (No such file or directory)
statfs("/selinux", 0x7ffc90d6e860)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/proc/filesystems", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tr"..., 1024) = 397
read(3, "", 1024)                       = 0
close(3)                                = 0
madvise(0x37292680c000, 8192, MADV_DONTNEED) = 0
access("/etc/selinux/config", F_OK)     = -1 ENOENT (No such file or directory)
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0xa4fa30} ---
+++ killed by SIGSEGV (core dumped) +++
[1]    18728 segmentation fault (core dumped)  strace "/opt/Mullvad VPN/mullvad-vpn"

It always crashes the same way, before the GUI is shown.

Please let me know if you need anything else or if I rather should send that to [email protected].

Thanks,
Patryk.

Add cli option to start mullvad-vpn client minimized [linux]

Let power users enjoy the indicator icon in systray without having to close the mullvad-vpn window every time system starts up.

How to connect to Mullvad in restricted WLAN guest network

What can I do to be able to connect to Mullvad in a restricted WLAN guest network? It seems that this guest network/hotspot only allows "surfing" and "email". I cannot use any VPN connection and connections with download managers/torrenting and IRC is also blocked. When I use Mullvad in my home WiFi network, everything works well. But this use case (guest network) is actually when I need Mullvad the most.

Windows: RPC address file cannot be retrieved

Hi!
I'm having problems logging in although I am pretty sure the problem is regarding to the following loop I get in the frontend.log:

[2018-07-30 23:14:57.123][debug] Waiting for RPC address file: "C:\ProgramData\Mullvad VPN.mullvad_rpc_address"
[2018-07-30 23:14:57.324][debug] Read RPC connection info ws://127.0.0.1:49683
[2018-07-30 23:14:57.325][info] Connecting to websocket ws://127.0.0.1:49683
[2018-07-30 23:15:02.028][info] The websocket connection closed with code: 1006
[2018-07-30 23:15:02.028][debug] Lost connection to daemon: Abnormal closure

This repeats itself every time I start the app even without trying to log in.
I am rocking an old 12 digit account but still I do not think the log in part itself is the problem.
Latest beta2 version is being used.

Mullvad 2018.4 gui window not visible on Ubuntu 14.04

Hello,

I just updated Mullvad from 2018.3 to 2018.4 and after that:

• i see red mullvad icon in top ubuntu bar
• when I click it and choose option to show Mullvad, nothing happens. No window visible.

I went back to blog post and saw infomation that before updating I should remove old version. Maybe this caused the problem.

So I tried to resolve it, this way:

• removed 2018.4 by:
  -- stoping in task manager everything with name related mullvad (mullvad-deamon, few instances with mullvad-vpn)
  -- removing mullvad by running sudo dpkg -r mullvad-vpn
• reinstalled 2018.3 by sudo dpkg -i {path to downloaded 2018.3}
• started mullvad - this time everything works ok, I see the window and it is connecting
• removed 2018.3 the same way I removed 2018.4 described above (stop everything, use dpkg to uninstall mullvad-vpn)
• installed mullvad 2018.4 again with sudo dpkg -i {path to downloaded 2018.4}

But I still have the same problem: red icon and no window

Now I am back on 2018.3 but would be great to find a way to have 2018.4 running on Ubuntu 14.04

Unable to use mullvad-cli

I'm using mullvad on Mac. I really wanted to make use of a cli interface.
I moved to /Applications/MullvadVPN.app/Contents/Resources and tried running:
./mullvad status.

Unfortunately it gives me an error:

Error: Unable to call backend over RPC
Caused by: Unable to call RPC method get_state
Caused by: Invalid reply, no 'result' field

Would appreciate any help.

Increase compatibility with different init systems, in particular sysvinit and runit

Do you have any plans to increase compatibility so that it could also be used on operating systems such as Devuan and MX Linux (both use sysvinit) or Void Linux (runit)?
See: https://mxlinux.org/wiki/system/systemd

MX Linux ships with systemd present but disabled by default. The MX Linux team strongly urges users to remain with this configuration which uses sysvinit instead.

No OpenVPN plugin found

I'm unable to actually connect to the VPN server after getting everything built and running. When I hit "Secure my connection", I get the following errors in mullvad-daemon's logs.

...
[2018-01-20 14:25:24.300][talpid_core::tunnel][WARN] Did not find a bundled version of OpenVPN, will rely on the PATH instead
[2018-01-20 14:25:24.300][mullvad_daemon][ERROR] Error: Failed to start tunnel
Caused by: Tunnel monitor error: Unable to start tunnel monitor
Caused by: No OpenVPN plugin found
...

It seems it can't find the OpenVPN plugin? It looks like OpenVPN is bundled with the mullvadvpn-app repo but maybe it's not getting built/linked properly? Maybe this just requires adding some undocumented step to the README?

Windows beta app permissions/security problem (2018.2-beta3)

Hello guys,

I just tried the latest beta. Great work :)

I have the following problem. When I try to install it I get an error:

"Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item."

I have tried installing it a few times and I couldn't. Basically I had to disable my antivirus in order for this message to disappear.

Additionally, Windows itself blocks the app as untrusted and asks me to allow it.

Is there a way for this to be fixed?

Cant connect Ubuntu 18.04

Checked connection its working. this is the New app With mullvad .
I think it has something do With deamon can someone help me i dont know whats wrong it just wont connect

[Feature Request] Option to not autoconnect on launch

I use the app on my MacBook Pro when I'm on public WiFi, but I don't use it at home because I have a DD-WRT router setup to connect Mullvad. It'd be great to have the option to disable autoconnect in the app so I can choose when to connect rather than it connecting as soon as I wake up my computer.

2018.2 client does not connect under LMDE2

I am using Linux Mint Debian Edition version 2 (based on Debian 8/Jessie), and the 2018.2 client fails to install; package installer reports that all dependencies are met, but then "Failed to install package 'MullvadVPN-2018.2_amd64.deb'" and the following:

Unpacking mullvad-vpn (2018.2.0) ...
Setting up mullvad-vpn (2018.2.0) ...
Created symlink from /etc/systemd/system/multi-user.target.wants/mullvad-daemon.service to /etc/systemd/system/mullvad-daemon.service.
Failed to get D-Bus connection: Unknown error -1
dpkg: error processing package mullvad-vpn (--install):
 subprocess installed post-installation script returned error exit status 1
Processing triggers for gnome-menus (3.13.3-6) ...
Processing triggers for desktop-file-utils (0.22-1) ...
Processing triggers for mime-support (3.58) ...
Processing triggers for hicolor-icon-theme (0.13-1) ...

However, the Mullvad VPN application shows up in the Menu after the above. If I launch it, it reports "Connecting to daemon..." and doesn't do anything else. The old version (67) connects properly.

Reconnect loop on wake of Mac laptop

Issue: When connected to VPN, close lid of laptop. When waking up, Mullvad client will go in a loop trying to reconnect, but won't ever connect. Internet traffic is blocked until the client is quit. In the client UI, the connecting screen flaps from connecting to disconnected, but the button to disconnect is non-responsive. Quitting or force quitting the app is the only way to resolve.

Restore DNS Settings on Disconnect (Windows) (Feature request)

Instead of setting your DNS to the default setting on disconnect, use the previous configuration. I'd love if your settings were restored after being disconnected. So the primary DNS server after disconnect should be 192.168.0.202.

Here are a few screenshots showing that the DNS settings are different before and after being connected
Before connecting:

Connected:

Disconnected:

OS: Windows 10 1803

Always on kill switch.

I've been trying out Mullvad, and I noticed the client doesn't have a reliable always on kill switch. By always on, I mean should the mullvad service be stopped or the client crashes my connection should get disconnected but it doesn't.

The role of the always on kill switch is to essentially prevent all communication unless connected to a VPN regardless if the client is open or not. Some of the other VPN clients provide this function and it would be nice to see it implemented. The current kill switch implementation basically only prevents leaks during momentary disruptions. I'm not sure I can confidently rely on this type of implementation for regular use.

Linux: Support for systemd-resolved is absent

I have several systems running Ubuntu or Ubuntu derivatives on which the Mullvad app fails to function. All of the systems use systemd-resolved for DNS resolution (the new default resolver which replaces resolvconf in 18.04 Bionic Beaver and beyond) and the underlying issue appears to be a failure to recognize when /usr/bin/resolvconf is merely a symlink to /usr/bin/resolvectl (the multi-call binary which provides CLI access to systemd-resolved and a compatibility mode when called as resolvconf). The error shown in the logs is:

[talpid_core::security][INFO] Applying security policy: Connected to [REDACTED]:1301:UDP over "tun0" (ip: [REDACTED], gw: [REDACTED]), Allowing LAN
[talpid_core::tunnel_state_machine::connected_state][ERROR] Error: Failed to apply security policy for connected state
Caused by: Failed to execute 'resolvconf' program
Caused by: command ["/usr/bin/resolvconf", "-a", "tun0.mullvad"] exited with code 1

It would seem that either the app needs to recognize when systemd-resolved is acting in place of resolvconf and adjust its syntax to satisfy the compatibility mode, or as advised by systemd documentation, instead use DBus to signal the desired changes to the DNS resolution configuration. I use this script, update-systemd-resolved in my OpenVPN config files to accomplish that rather painlessly. The end of each config file ends up looking like so:

dhcp-option DOMAIN-ROUTE .

script-security 2
setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
up /etc/openvpn/scripts/update-systemd-resolved
down /etc/openvpn/scripts/update-systemd-resolved
down-pre

The new app is really impressive and I have nothing but good experiences to report with it on my Windows boxes. I can't wait to start using it on my Linux machines as well.

What Mullvad doesn't want you to know. Github censors complaints about how their customers are treated.

Hey Andrei, I thought you were going to close the conversation. YOU'VE DELETED IT! Shame on you.

dosenfleisch commented 2 days ago
In all the world, there isn't a gui availabe for Linux VPN use that approaches the expert, reliable and simple approach Mullvad has brought to VPN users. Their "I don't want to know who you are" approach to satisfying a market for VPN users brings with it a big problem. Most users would need to use a credit card. The rest send cash, use bitcoin or whatever. The problem with this, Mullvad decides willy nilly whether they will accept a credit payment based on nothing whatsoever. Try the service out for a few hours for free. Decide to try it for a month, and pay them the five euros via credit card. Then try another six months worth and everything goes well, you try to pay for a year's service. At this point they suddenly flip out and throw your account into a "bad boy" category in which you don't know if you will have a VPN service or not at the end of the period you've already paid for.

A clear case of scientists and accountants running a company into the ground.

@pronebird
Member
pronebird commented 2 days ago •
Hi,

I am not sure what exactly went wrong but it would be the best if you could contact [email protected] if you had some billing issue. They’ll gladly help you, no need to build up a sentiment.

@dosenfleisch

dosenfleisch commented a day ago
The objective is not to build up a sentiment, but to warn, if not bring some Mullvad folks to their senses. What happened is exactly as I explained it. Without specifying any reservations as to amounts or frequency of transactions, Mullvad's folks decide as the spirit moves them, whether they will accept a transaction or not. Neither my credit card nor my VPN use was an issue. Their response to my objections, since I know how to run a business better than they do, was to refund my money. If you can't get them to accept a credit card transaction, why would anyone trust them with any other payment option? It's a shame. Their gui and the speed of their servers is truly exceptional. If their gui is truly open source and available to everyone, all these vpn outfits using a cli interface ought to take full advantage.

@pronebird
Member
pronebird commented 5 hours ago
I am afraid I have to close this issue because it has nothing to do with the software itself.

Add context menu for system tray icon & fix bug with system tray box

This has been annoying me for a while but currently the desktop (PC/Windows) version of the Mullvad client does not have a context menu on the system tray icon (right clicking on the icon does not show a menu). It would be very useful to add menu options like Connect/Disconnect, Settings window and Exit.

Also, when you open Mullvad, the system tray box does not automatically close and obscures buttons like this:

These are very simple things but causes quite the annoyance.

Client keeps "Connecting to daemon..."

Resinstalling the client will make it work again temporarily.

Closing the client and opening it again will make the client "Connecting to daemon..." again, indefinitely.

This is for version 2018.2

Additional README steps required to get backend running

Just following the instructions in the README, I was unable to get the backend running.

$ sudo target/debug/mullvad-daemon -vv
[2018-01-17 12:21:30.540][mullvad_daemon][INFO] Starting mullvad-daemon 2018.1-beta8-53-gb9fb88e-dirty 2018-01-16
[2018-01-17 12:21:30.582][mullvad_daemon::relays][DEBUG] Trying to read relays cache from /Users/jbowen/Library/Caches/mullvad-daemon/relays.json
[2018-01-17 12:21:30.598][mullvad_daemon::relays][DEBUG] Trying to read relays cache from /Users/jbowen/Code/mullvadvpn-app/target/debug/relays.json
Error: Unable to initialize daemon
Caused by: Unable to initialize relay list cache
Caused by: Error with relay cache on disk
Caused by: Error in serialization of relaylist
Caused by: missing field `latitude` at line 65 column 9

I had to

cp dist-assets/relays.json target/debug/

and then it worked. Not sure if that's the intended solution but figured something should be documented in the README so it works out of the box.

Cannot connect with Mullvad 2018.4 (Official Release)

This morning I upgraded my Windows 10 computer from the old client (version 67) to the latest official release (2018.4). However, after a successful installation, Mullvad 2018.4 will not connect to any servers. I've even tried other servers, but none will connect. It keeps retrying and then ultimately fails with a message that states:

BLOCKING INTERNET
Authentication failed: Check that the account is valid, has time left and not too many connections.

I have verified the first 2 conditions (and am still able to connect using that same account on my mobile device), so I don't think there's a problem with my account status. However I'm not sure what it means by "too many connections." How do I fix this issue?

Create option to allow connecting to one's own servers in addition to Mullvad's

I run several servers (OpenConnect, OpenVPN, Wireguard, etc.) on a VPS at a fixed location. It would be amazing to be able to connect to them via mullvadvpn-app and to be able to throw them into a server mix/double hop or to even use them as standalone solutions in case access to the Mullvad network is blocked in regions heavily affected by censorship.

[Feature Request] Minimize to tray hides taskbar icon

Currently it is not possible to hide the taskbar icon in Win10, meaning that tray icon and taskbar icon are always visible. It would be great if we could minimize to tray completely by hiding the taskbar icon when we minimize the app.

Mullvad VPN App version 2018.2.beta1

Latency with servers

It would be cool, to see latency with servers in the server list. So users would have the option to see which server better to pick, depending on their location.

Add instructions for Solus and NetworkManager Applet

Apologies for posting this here but as the Linux version is not available, I would have to configure Mullvad for my operating system of choice, Solus (https://distrowatch.org/table.php?distribution=solus). Could you please add instructions in the Guides section on your website how to use Mullvad on Solus? NetworkManager Applet, the notification area applet for managing network devices and connections, is already pre-installed and I would use this to connect to your servers. The instructions found on your website were for other operating systems and/or a bit too complicated to follow. Is there also any chance to post all Guides additionally here on GitHub? The reason is because your website is censored where I live and I have to use another VPN to access it.

Support flatpak

The best solution is obviously to have mullvadvpvn-app included in the repositories of an operating system. But as this will take lots of time and people use different operating systems, could you make an additional flatpak release for easier cross-platform installation? This would also allow to have it hosted on Flathub and attract more potential users. When making a Flatpak release, keep in mind that the security will depend on how well it is packaged by the vendor.

Fails to start on Kubuntu 18.04

mullvad   
Using GTK2
changing directory to /usr/lib/python2.7/dist-packages/mullvad
Setting logging directory to /home/x/.cache/mullvad/log

(mullvad:19845): GLib-GObject-WARNING **: 00:15:44.974: cannot register existing type 'GdkDisplayManager'

(mullvad:19845): GLib-CRITICAL **: 00:15:44.974: g_once_init_leave: assertion 'result != 0' failed

(mullvad:19845): GLib-GObject-CRITICAL **: 00:15:44.974: g_object_new_with_properties: assertion 'G_TYPE_IS_OBJECT (object_type)' failed

If its just some GTK lib missing that should be a dependency of the .deb. Otherwise it should be possible to run this on KDE and not require Gnome.

VPN App freezes when closing to tray if account time left is still fetching

Running the VPN app v67 on Linux Mint 18. Normal behaviour when clicking the 'x' to close the window on the VPN app is it will minimize to the system tray applet.

If the Account time left is 'fetching...', then clicking 'x' to close the window results in the application freezing:

Auto-connect setting not working

The app runs at startup and connects to the VPN service automatically even though I have auto-connect turned off. I want the app to run when I login but remain disconnected until i manually connect. Am I just misinterpreting what this setting actually does?
I'm running Windows 10 and Mullvad 2018.5

Unable to add custom OpenVPN arguments in Mac app

I'm testing Mullvad on Mac, and I wanted to be able to customize some of the options documented here, which are available in the Windows/Linux builds (more specifically, custom_ovpn_args).

The reason for this is that I wanted to use Mullvad on Mac under a Multihop config, however I could not find how to configure that with the Mac app.

I found the settings.json file under /Users/<user>/Library/Application Support/mullvad-daemon, but I'm not sure this is the correct way, and since it's different than the settings.ini file in Windows, I don't really know how to declare custom ovpn args that way.

[Feature Request] Automatic startup on login, without prompt for password.

It would heighten the UX of the already very smooth macOS client, with an in-app option to run the client on login, without prompting for the password. Or at least the password part, since it is fairly easy to start anything at login within macOS.
Apart from the UX perspective, the connection is also open until the Mullvad client blocks it, which only happens after entering administrator credentials.

Is such a change to the implementation at all possible? Are there security issues related to doing so?