Get started
Login
© 2024

Mullvad exit nodes

This feature is currently in beta. To try it, follow the steps below to enable it for your network using Tailscale v1.48.2 or later.

Mullvad exit nodes let you use Mullvad VPN endpoints as exit nodes for your Tailscale network (called a tailnet). For more information on Mullvad's network infrastructure, refer to the Mullvad server documentation.

Mullvad exit nodes support suggested exit nodes and auto exit nodes.

Enable Mullvad exit nodes

Only an Owner, Admin, or Network admin of a tailnet can enable Mullvad exit nodes.

  1. In the General settings page of the admin console, scroll down to Mullvad VPN.
  2. Select Configure.
  3. Continue with the checkout flow to purchase Mullvad licenses.

Configure devices for Mullvad access

You must explicitly configure devices for Mullvad access.

  1. From the configuration page, select Add devices.
  2. Select the devices to grant access to Mullvad's infrastructure as exit nodes. Each device uses a slot in a Mullvad license. Each Mullvad license allows up to five devices. Your monthly bill automatically updates as you add or remove devices.
A screenshot displaying configuration of devices with Mullvad access.

Use Mullvad exit nodes

After you enable Mullvad exit nodes and configure a device for Mullvad access, you can use the exit nodes from devices in your tailnet. Each device must enable an exit node separately.

You can also:

There might be a slight delay before Mullvad exit nodes appear in your Tailscale client.

Instructions differ depending on the client operating system:

You can select an exit node using the tailscale set or the tailscale up command.

With either command, pass the --exit-node= flag with the IP address of the Mullvad exit node. If MagicDNS is enabled, you can instead pass in the name of the Mullvad exit node.

sudo tailscale set --exit-node=<exit-node-name-or-ip>

You can find the exit node's IP address (and name if MagicDNS is enabled) by running tailscale exit-node list.

Set --exit-node-allow-lan-access to true to allow direct access to your local network when routing traffic through an exit node. If you do not configure this option, you might need to configure DNS.

sudo tailscale set --exit-node=<exit-node-name-or-ip> --exit-node-allow-lan-access=true

Disable Mullvad on a device

You must be an Owner, Admin, or Network admin of a tailnet to disable Mullvad Exit Nodes on a device.

  1. Open the General page of the admin console.
  2. Go to the Mullvad VPN section and select Configure.
  3. Select Remove next to the device you want to remove, then select Save.

Important DNS considerations

This section currently applies to Tailscale clients v1.48.1 and v1.48.2. Future versions of Tailscale might not require additional configuration.

Mullvad exit nodes with Tailscale 1.48.1 or 1.48.2 use your current DNS configuration. If you do not have one of the following settings configured, you might lose access to DNS (effectively losing internet access).

Selecting Override local DNS causes Tailscale to configure all clients to use the selected DNS server for all DNS queries while Tailscale is connected, even if you are not using an exit node. When used with the Mullvad Public DNS nameservers, this ensures all DNS routes through Mullvad and provides a green check for DNS leaks on mullvad.net/check.

Using the Allow Local Network Access option in your client settings allows DNS leaks to occur but also ensures that local DNS names, such as a local printer name or a local NAS server name, continue to work.

Enable MagicDNS in your tailnet when using Mullvad exit nodes to access their friendly-names and leverage other MagicDNS features.

Remove the Mullvad add-on

You must be an Owner, Admin, or Billing admin of a tailnet to remove the Mullvad add-on.

  1. Open the Settings page of the admin console, and go to the Billing section.

  2. Select Manage add-ons.

  3. Select Mullvad VPN > Remove add-on.

    A screenshot displaying configuration of devices with Mullvad access.

Configuration for teams

Using Mullvad for teams can become cumbersome when configuring access through the admin console. Tailscale provides an option to configure Mullvad access using access control lists for greater control.

You can use access control lists (ACLs) directly to configure device access to Mullvad exit nodes adding a mullvad node attribute in your tailnet policy file to the devices you plan to use with Mullvad exit nodes.

The following example grants access to all devices owned by joe@example.com:

"nodeAttrs": [
    {
        "target": ["joe@example.com"],
        "attr": [
            "mullvad",
        ],
    },
],

This method allows you to assign access to Mullvad for more devices than your current plan allows. When doing so, devices use available paid device slots on a first-come, first-served basis. If all paid slots are in use, devices outside the selected quota will not have Mullvad exit nodes as an option. When using ACLs to configure Mullvad access, ensure you have purchased enough Mullvad licenses to cover the needs of your environment.

Available regions

Mullvad is available for Tailscale customers in the following countries:

  • Austria
  • Belgium
  • Bulgaria
  • Canada
  • Croatia
  • Cyprus
  • Czech Republic
  • Denmark
  • Estonia
  • Finland
  • France
  • Germany
  • Slovakia
  • Slovenia
  • Hungary
  • Ireland
  • Italy
  • Latvia
  • Lithuania
  • Luxembourg
  • Malta
  • The Netherlands
  • New Zealand
  • Poland
  • Portugal
  • Romania
  • Singapore
  • Spain
  • Sweden
  • Switzerland
  • UK
  • US

We're working on expanding the service to other regions. If your region is not listed, use our issues repository to submit a request.

Data privacy and anonymity

When you use Mullvad with Tailscale, you allow Tailscale to generate, manage, renew, and remove Mullvad accounts on your behalf. As a result, there are some important privacy and anonymity considerations:

  • Tailscale generates and manages account information on users' behalf.
  • Tailscale is identity-aware (Tailscale doesn't support anonymous tailnets). All Tailscale users are connected to an email address or GitHub account.
  • Tailscale knows which Mullvad accounts belong to which Tailscale users.
  • Users establish encrypted WireGuard connections with Mullvad servers. Tailscale can identify which users are connecting to which Mullvad servers via logs. As with any traffic on your tailnet, Tailscale cannot access any user traffic sent to Mullvad servers. All user traffic is encrypted in WireGuard tunnels, and Tailscale cannot decrypt this information.
  • Mullvad does not receive user identity information from Tailscale. Mullvad explicitly does not want to track this information.

Mullvad FAQ

What should I consider before migrating from Mullvad to Tailscale?

  • When migrating to Tailscale's Mullvad Exit Nodes, go to your Mullvad VPN application, disable the Mullvad VPN, and disable the setting Block connections without VPN.
  • Devices that are registering with Mullvad for the first time might experience a delay in synchronizing with all the Mullvad exit nodes. Users should expect this to take up to two minutes the first time they attempt to use Mullvad on a particular device or if they have not used it for several weeks. With regular usage, activating Mullvad will be instantaneous.
  • IPv6 is not currently supported. Tailscale will be removing this restriction in the future.

What should I know about using the Tailscale client?

  • Windows: The list of Mullvad exit nodes is too large to list all nodes in the Windows client. We are aware of this and plan to address this in a future release. To access a complete list, use the Tailscale CLI.

What should I know about purchasing Mullvad for use with Tailscale?

What should I know about using Mullvad with GitOps-managed ACLs?

  • When using GitOps or externally managed ACLs, the Mullvad add-on checkout flow might be locked. To purchase additional licenses, go to the Billing page of the admin console and select Manage add-ons.

What should I know about using Mullvad with tailnet lock?