mullvadvpn app
android/2024.8
Welcome to the Mullvad VPN client app source code repository. This is the VPN client software for the Mullvad VPN service. For more information about the service, please visit our website, mullvad.net (Also accessible via Tor on our onion service).
This repository contains all the source code for the
desktop and mobile versions of the app. For desktop this includes the system service/daemon
(mullvad-daemon), a graphical user interface (GUI) and a
command line interface (CLI). The Android app uses the same backing
system service for the tunnel and security but has a dedicated frontend in android/.
iOS consists of a completely standalone implementation that resides in ios/.
There are built and signed releases for macOS, Windows, Linux and Android available on our website and on Github. The Android app is also available on Google Play and F-Droid and the iOS version on App Store.
You can find our code signing keys as well as instructions for how to cryptographically verify your download on Mullvad's Open Source page.
These are the operating systems and their versions that the app officially supports. It might work on many more versions, but we don't test for those and can't guarantee the quality or security.
| OS/Platform | Supported versions |
|---|---|
| Windows | 10 and 11 |
| macOS | The three latest major releases |
| Linux (Ubuntu) | The two latest LTS releases and the latest non-LTS releases |
| Linux (Fedora) | The versions that are not yet EOL |
| Linux (Debian) | 11 and newer |
| Android | 8 and newer |
| iOS | 15.0 and newer |
On Linux we test using the Gnome desktop environment. The app should, and probably does work in other DEs, but we don't regularly test those.
Here is a table containing the features of the app across platforms. This is intended to reflect the current state of the latest code in git, not necessarily any existing release.
| Windows | Linux | macOS | Android | iOS | |
|---|---|---|---|---|---|
| OpenVPN | ✓ | ✓ | ✓ | ||
| WireGuard | ✓ | ✓ | ✓ | ✓ | ✓ |
| Quantum-resistant tunnels | ✓ | ✓ | ✓ | ✓ | ✓ |
| DAITA | ✓ | ✓ | ✓ | ✓ | ✓ |
| WireGuard multihop | ✓ | ✓ | ✓ | ✓ | |
| WireGuard over TCP | ✓ | ✓ | ✓ | ✓ | ✓ |
| WireGuard over Shadowsocks | ✓ | ✓ | ✓ | ✓ | |
| OpenVPN over Shadowsocks | ✓ | ✓ | ✓ | ||
| Split tunneling | ✓ | ✓ | ✓ | ✓ | |
| Custom DNS server | ✓ | ✓ | ✓ | ✓ | ✓ |
| Content blockers (Ads etc) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Optional local network access | ✓ | ✓ | ✓ | ✓ | ✓* |
| Externally audited | ✓ | ✓ | ✓ | ✓ | ✓ |
* The local network is always accessible on iOS with the current implementation
This app is a privacy preserving VPN client. As such it goes to great lengths to stop traffic leaks. And basically all settings default to the more secure/private option. The user has to explicitly allow more loose rules if desired. See the dedicated security document for details on what the app blocks and allows, as well as how it does it.
This repository contains submodules needed for building the app. However, some of those submodules also have further submodules that are quite large and not needed to build the app. So unless you want the source code for OpenSSL, OpenVPN and a few other projects you should avoid a recursive clone of the repository. Instead clone the repository normally and then get one level of submodules:
git clone https://github.com/mullvad/mullvadvpn-app.git
cd mullvadvpn-app
git submodule update --initOn Android, Linux and macOS you also want to checkout the wireguard-go submodule recursively:
git submodule update --init --recursive --depth=1 wireguard-go-rsFurther details on why this is necessary can be found in the wireguard-go-rs crate.
We sign every commit on the main branch as well as our release tags. If you would like to verify
your checkout, you can find our developer keys on Mullvad's Open Source page.
This repository has a git submodule at dist-assets/binaries. This submodule contains binaries and
build scripts for third party code we need to bundle with the app. Such as OpenVPN, Wintun
etc.
This submodule conforms to the same integrity/security standards as this repository. Every merge commit should be signed. And this main repository should only ever point to a signed merge commit of the binaries submodule.
See the binaries submodule's README for more details about that repository.
See the build instructions for help building the app on desktop platforms.
For building the Android app, see the instructions for Android.
For building the iOS app, see the instructions for iOS.
See this for instructions on how to make a new release.
TALPID_FIREWALL_DEBUG - Helps debugging the firewall. Does different things depending on
platform:
"1" to add packet counters to all firewall rules.pflog0 interface.
"all" to add logging to all rules."pass" to add logging to rules allowing packets."drop" to add logging to rules blocking packets.TALPID_FIREWALL_DONT_SET_SRC_VALID_MARK - Forces the daemon to not set src_valid_mark config
on Linux. The kernel config option is set because otherwise strict reverse path filtering may
prevent relay traffic from reaching the daemon. If rp_filter is set to 1 on the interface
that will be receiving relay traffic, and src_valid_mark is not set to 1, the daemon will
not be able to receive relay traffic.
TALPID_DNS_MODULE - Allows changing the method that will be used for DNS configuration.
By default this is automatically detected, but you can set it to one of the options below to
choose a specific method.
Linux
"static-file": change the /etc/resolv.conf file directly"resolvconf": use the resolvconf program"systemd": use systemd's resolved service through DBus"network-manager": use NetworkManager service through DBusWindows
iphlpapi: use the IP helper APInetsh: use the netsh programtcpip: set TCP/IP parameters in the registryTALPID_FORCE_USERSPACE_WIREGUARD - Forces the daemon to use the userspace implementation of
WireGuard on Linux.
TALPID_DISABLE_OFFLINE_MONITOR - Forces the daemon to always assume the host is online.
TALPID_NET_CLS_MOUNT_DIR - On Linux, forces the daemon to mount the net_cls controller in the
specified directory if it isn't mounted already.
MULLVAD_MANAGEMENT_SOCKET_GROUP - On Linux and macOS, this restricts access to the management
interface UDS socket to users in the specified group. This means that only users in that group can
use the CLI and GUI. By default, everyone has access to the socket.
MULLVAD_API_HOST - Set the hostname to use in API requests. E.g. api.mullvad.net.
MULLVAD_API_ADDR - Set the IP address and port to use in API requests. E.g. 10.10.1.2:443.
MULLVAD_API_DISABLE_TLS - Use plain HTTP for API requests.
MULLVAD_CONNCHECK_HOST - Set the hostname to use in connection check requests. E.g. am.i.mullvad.net.
Use setx from an elevated shell:
setx TALPID_DISABLE_OFFLINE 1 /mFor the change to take effect, restart the daemon:
sc.exe stop mullvadvpn
sc.exe start mullvadvpnEdit the systemd unit file via systemctl edit mullvad-daemon.service:
[Service]
Environment="TALPID_DISABLE_OFFLINE_MONITOR=1"For the change to take effect, restart the daemon:
sudo systemctl restart mullvad-daemonUse launchctl:
sudo launchctl setenv TALPID_DISABLE_OFFLINE_MONITOR 1For the change to take effect, restart the daemon:
launchctl unload -w /Library/LaunchDaemons/net.mullvad.daemon.plist
launchctl load -w /Library/LaunchDaemons/net.mullvad.daemon.plistMULLVAD_PATH - Allows changing the path to the folder with the mullvad-problem-report tool
when running in development mode. Defaults to: /target/debug/ MULLVAD_DISABLE_UPDATE_NOTIFICATION - If set to 1, GUI notification will be disabled when
an update is available.$ npm run develop - develop app with live-reload enabled$ npm run lint - lint code$ npm run pack: - prepare app for distribution for your platform. Where linux, mac or win$ npm test - run testsThe requirements for displaying a tray icon varies between different desktop environments. If the tray icon doesn't appear, try installing one of these packages:
libappindicator3-1libappindicator1libappindicatorIf you're using GNOME, try installing one of these GNOME Shell extensions:
TopIconsFixTopIcons Pluselectron-builderThe daemon is implemented in Rust and is implemented in several crates. The main, or top level,
crate that builds the final daemon binary is mullvad-daemon which then depend on the others.
In general one can look at the daemon as split into two parts, the crates starting with talpid
and the crates starting with mullvad. The talpid crates are supposed to be completely unrelated
to Mullvad specific things. A talpid crate is not allowed to know anything about the API through
which the daemon fetch Mullvad account details or download VPN server lists for example. The
talpid components should be viewed as a generic VPN client with extra privacy and anonymity
preserving features. The crates having mullvad in their name on the other hand make use of the
talpid components to build a secure and Mullvad specific VPN client.
Explanations for some common words used in the documentation and code in this repository.
mullvad-daemon Rust program. This headless program exposes a
management interface that can be used to control the daemonmullvad that is a terminal based frontend for the Mullvad
VPN app.A list of file paths written to and read from by the various components of the Mullvad VPN app
On Windows, when a process runs as a system service the variable %LOCALAPPDATA% expands to
C:Windowssystem32configsystemprofileAppDataLocal.
All directory paths are defined in, and fetched from, the mullvad-paths crate.
The settings directory can be changed by setting the MULLVAD_SETTINGS_DIR environment variable.
| Platform | Path |
|---|---|
| Linux | /etc/mullvad-vpn/ |
| macOS | /etc/mullvad-vpn/ |
| Windows | %LOCALAPPDATA%Mullvad VPN |
| Android | getFilesDir() |
The log directory can be changed by setting the MULLVAD_LOG_DIR environment variable.
| Platform | Path |
|---|---|
| Linux | /var/log/mullvad-vpn/ + systemd |
| macOS | /var/log/mullvad-vpn/ |
| Windows | C:ProgramDataMullvad VPN |
| Android | getFilesDir() |
The cache directory can be changed by setting the MULLVAD_CACHE_DIR environment variable.
| Platform | Path |
|---|---|
| Linux | /var/cache/mullvad-vpn/ |
| macOS | /Library/Caches/mullvad-vpn/ |
| Windows | C:ProgramDataMullvad VPNcache |
| Android | getCacheDir() |
The full path to the RPC address file can be changed by setting the MULLVAD_RPC_SOCKET_PATH
environment variable.
| Platform | Path |
|---|---|
| Linux | /var/run/mullvad-vpn |
| macOS | /var/run/mullvad-vpn |
| Windows | //./pipe/Mullvad VPN |
| Android | getNoBackupFilesDir() |
The GUI has a specific settings file that is configured for each user. The path is set in the
gui/packages/desktop/main/gui-settings.ts file.
| Platform | Path |
|---|---|
| Linux | $XDG_CONFIG_HOME/Mullvad VPN/gui_settings.json |
| macOS | ~/Library/Application Support/Mullvad VPN/gui_settings.json |
| Windows | %LOCALAPPDATA%Mullvad VPNgui_settings.json |
| Android | Present in Android's logcat |
See graphics README for information about icons.
Instructions for how to handle locales and translations are found here.
For instructions specific to the Android app, see here.
Mullvad has used external pentesting companies to carry out security audits of this VPN app. Read more about them in the audits readme.
Copyright (C) 2024 Mullvad VPN AB
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
For the full license agreement, see the LICENSE.md file
The source code for the iOS app is GPL-3 licensed like everything else in this repository. But the distributed app on the Apple App Store is not GPL licensed, it falls under the Apple App Store EULA.
