Environment Variables

Configure Mullvad VPN daemon and frontend behavior using environment variables

Daemon Environment Variables

These environment variables control the behavior of the Mullvad VPN daemon.

Firewall Configuration

TALPID_FIREWALL_DEBUG

Helps debug firewall rules. Behavior varies by platform:

Linux

Set to "1" to add packet counters to all firewall rules.

export TALPID_FIREWALL_DEBUG=1

macOS

Makes rules log packets to the pflog0 interface:

• "all" - Add logging to all rules
• "pass" - Add logging to rules allowing packets
• "drop" - Add logging to rules blocking packets

export TALPID_FIREWALL_DEBUG=all

Windows

Not applicable on Windows.

TALPID_FIREWALL_DONT_SET_SRC_VALID_MARK

Set to 1 to prevent the daemon from setting the net.ipv4.conf.all.src_valid_mark kernel parameter on Linux.

export TALPID_FIREWALL_DONT_SET_SRC_VALID_MARK=1

By default, the daemon sets this kernel parameter to 1 to prevent strict reverse path filtering from blocking relay traffic. Only disable if you understand the implications.

TALPID_FIREWALL_DONT_SET_ARP_IGNORE

Set to 1 to prevent the daemon from setting the net.ipv4.conf.all.arp_ignore kernel parameter on Linux.

export TALPID_FIREWALL_DONT_SET_ARP_IGNORE=1

By default, this parameter is set to 2 to prevent attackers from discovering the in-tunnel IP via ARP requests. Only disable for testing purposes.

DNS Configuration

TALPID_DNS_MODULE

Override the automatic DNS configuration method detection.

Linux

Available options:

• "static-file" - Modify /etc/resolv.conf directly
• "resolvconf" - Use the resolvconf program
• "systemd" - Use systemd’s resolved service via DBus
• "network-manager" - Use NetworkManager via DBus

export TALPID_DNS_MODULE=systemd

Windows

Available options:

• "iphlpapi" - Use the IP helper API
• "netsh" - Use the netsh program
• "tcpip" - Set TCP/IP parameters in the registry

$env:TALPID_DNS_MODULE = "iphlpapi"

macOS

DNS module configuration is automatic on macOS.

TALPID_DISABLE_LOCAL_DNS_RESOLVER

Set to 1 to disable the local DNS resolver (macOS only).

export TALPID_DISABLE_LOCAL_DNS_RESOLVER=1

TALPID_NEVER_FILTER_AAAA_QUERIES

Set to 1 to never ignore DNS AAAA queries (macOS only).

export TALPID_NEVER_FILTER_AAAA_QUERIES=1

WireGuard Configuration

TALPID_FORCE_USERSPACE_WIREGUARD

Forces the daemon to use the userspace implementation of WireGuard instead of the kernel module.

export TALPID_FORCE_USERSPACE_WIREGUARD=1

Network Monitoring

TALPID_DISABLE_OFFLINE_MONITOR

Forces the daemon to always assume the host is online, disabling network connectivity checks.

export TALPID_DISABLE_OFFLINE_MONITOR=1

Split Tunneling (Linux)

TALPID_CGROUP2_FS

Forces the daemon to look for the cgroup2 filesystem at a custom path instead of /sys/fs/cgroup.

export TALPID_CGROUP2_FS=/custom/cgroup/path

TALPID_NET_CLS_MOUNT_DIR

Forces the daemon to mount the net_cls controller in a specific directory (cgroup v1 systems only).

export TALPID_NET_CLS_MOUNT_DIR=/custom/mount/dir

Access Control

MULLVAD_MANAGEMENT_SOCKET_GROUP

Restricts access to the management interface socket to users in a specific group (Linux and macOS only).

export MULLVAD_MANAGEMENT_SOCKET_GROUP=mullvad-users

By default, everyone has access to the management socket. Use this variable to restrict CLI and GUI access.

Debugging

MULLVAD_BACKTRACE_ON_FAULT

Controls whether the daemon logs a backtrace when encountering a fault (e.g., SIGSEGV).

• 1 - Enable backtrace logging
• 0 - Disable backtrace logging
• Default: Enabled in debug builds, disabled in release builds

export MULLVAD_BACKTRACE_ON_FAULT=1

Backtrace logging causes heap allocation in the signal handler, which is technically undefined behavior. Enable at your own risk.

File Paths

These environment variables override default file and directory locations:

MULLVAD_SETTINGS_DIR

Customize the settings directory location.

export MULLVAD_SETTINGS_DIR=/custom/settings/path

MULLVAD_LOG_DIR

Customize the log directory location.

export MULLVAD_LOG_DIR=/custom/logs/path

MULLVAD_CACHE_DIR

Customize the cache directory location.

export MULLVAD_CACHE_DIR=/custom/cache/path

MULLVAD_RPC_SOCKET_PATH

Customize the full path to the RPC socket.

export MULLVAD_RPC_SOCKET_PATH=/custom/socket/path

See File Paths for default locations.

Development-Only Variables

These variables only work in development builds and are ignored in release builds.

MULLVAD_API_HOST

Set the hostname for API requests.

export MULLVAD_API_HOST=api.mullvad.net

MULLVAD_API_ADDR

Set the IP address and port for API requests.

export MULLVAD_API_ADDR=10.10.1.2:443

MULLVAD_API_DISABLE_TLS

Use plain HTTP for API requests instead of HTTPS.

export MULLVAD_API_DISABLE_TLS=1

MULLVAD_CONNCHECK_HOST

Set the hostname for connection check requests.

export MULLVAD_CONNCHECK_HOST=am.i.mullvad.net

MULLVAD_ENABLE_DEV_UPDATES

Enable version checks in development builds.

export MULLVAD_ENABLE_DEV_UPDATES=1

Desktop Frontend Variables

These variables control the Electron desktop application.

MULLVAD_PATH

Customize the path to the mullvad-problem-report tool when running in development mode.

export MULLVAD_PATH=/path/to/target/debug/

Defaults to <repo>/target/debug/.

MULLVAD_DISABLE_UPDATE_NOTIFICATION

Set to 1 to disable notifications when updates are available.

export MULLVAD_DISABLE_UPDATE_NOTIFICATION=1

Setting Environment Variables

The method for setting environment variables varies by platform:

Windows

Use setx from an elevated command prompt:

setx TALPID_DISABLE_OFFLINE_MONITOR 1 /m

Restart the daemon for changes to take effect:

sc.exe stop mullvadvpn
sc.exe start mullvadvpn

Linux

Edit the systemd unit file:

sudo systemctl edit mullvad-daemon.service

Add the environment variable:

[Service]
Environment="TALPID_DISABLE_OFFLINE_MONITOR=1"

Restart the daemon:

sudo systemctl restart mullvad-daemon

macOS

Use plutil to edit the launch daemon plist:

sudo plutil -replace EnvironmentVariables -json '{"TALPID_DISABLE_OFFLINE_MONITOR": "1"}' /Library/LaunchDaemons/net.mullvad.daemon.plist

Restart the daemon:

launchctl unload -w /Library/LaunchDaemons/net.mullvad.daemon.plist
launchctl load -w /Library/LaunchDaemons/net.mullvad.daemon.plist

Related Resources

• File Paths - Default and custom file locations
• Settings Management - Configure app settings