Softpedia >Linux >Security >Mullvad VPN >  Changelog

Mullvad VPN Changelog

What's new in Mullvad VPN 2024.2

Apr 30, 2024
  • Added:
  • Add automatic MTU detection for desktop platforms. This currently only uses information about
  • dropped packets and does not take fragmentation into account.
  • Add ability to import server IP overrides in GUI.
  • Changed:
  • Change default obfuscation setting to auto.
  • Migrate obfuscation settings for existing users from off to auto.
  • Change default retry connection attempts.
  • Fixed:
  • Continual excessive attempts to update the API IP were made after testing access methods.
  • Fix pointless API access method rotations for concurrent requests.
  • Fix daemon rotating logs on startup even if another daemon is already running.
  • Fix missing redirect to out of time-view when running out of time.
  • Fix incorrectly showing "App lost contact with system service" notification on suspend.
  • Fix bug where the app would fail to select an existing relay in some scenarios, causing the user to wrongly end up in a blocked state.
  • macOS:
  • DNS was not properly restored in some cases when using custom DNS.
  • SECURITY:
  • macOS:
  • Flush states on tunnel state changes. Previously, pre-existing connections could leak when internet sharing was enabled on a device.
  • Windows:
  • Update electron-builder to 24.13.3 to fix CVE-2024-27303, which enabled privilege escelation when running the installer.

New in Mullvad VPN 2024.2 Beta 1 (Apr 16, 2024)

  • Added:
  • Add automatic MTU detection for desktop platforms. This currently only uses information about
  • dropped packets and does not take fragmentation into account.
  • Add ability to import server IP overrides in GUI.
  • Changed:
  • Change default obfuscation setting to auto.
  • Migrate obfuscation settings for existing users from off to auto.
  • Change default retry connection attempts.
  • Fixed:
  • Continual excessive attempts to update the API IP were made after testing access methods.
  • Fix pointless API access method rotations for concurrent requests.
  • Fix daemon rotating logs on startup even if another daemon is already running.
  • Fix missing redirect to out of time-view when running out of time.
  • Fix incorrectly showing "App lost contact with system service" notification on suspend.

New in Mullvad VPN 2024.1 (Mar 25, 2024)

  • ADDED:
  • Add CLI support for applying patches to the settings with mullvad import-settings.
  • Add account UUID to verbose 'mullvad account get -v' output.
  • Respect OS prefer-reduced-motion setting.
  • Add CLI command for exporting settings patches: mullvad export-settings. Currently, it generates
  • a patch containing all patchable settings, which only includes relay IP overrides.
  • Make mullvad status prints if lockdown mode is enabled when disconnected.
  • Add option to configure custom API access methods. Custom API access methods allows the user to
  • circumvent censorship by proxying API traffic.
  • Add confirmation dialog when deleting a custom list.
  • Add support for custom SOCKS5 OpenVPN bridges running locally.
  • CHANGED:
  • CLI command mullvad relay set tunnel wireguard entry-location changed to
  • mullvad relay set tunnel wireguard entry location, as the location subcommand can now be
  • swapped for custom-list to select entry relays using a custom list.
  • Remove --location flag from mullvad status CLI. Location and IP will now always
  • be printed (if available). mullvad status listen no longer prints location info.
  • Change CLI interface for custom SOCKS5 bridges as part of supporting bridges running locally.
  • Upgrade the background map to a new WebGL 3D map. This should both look better and be more
  • performant.
  • Update Electron from 26.3.0 to 28.1.3.
  • Improve the "Connecting to system service"-view with information about the situation and
  • troubleshooting tips.
  • Update support email address to new email address, [email protected].
  • LINUX:
  • Rename interface name from wg-mullvad to wg0-mullvad.
  • Enable quantum resistant tunnels by default (when set to auto). On other platforms, auto still
  • always means the same thing as off.
  • WINDOWS:
  • Add information to error notification about an error that is often caused by an incompatibility
  • with VMWare.
  • FIXED:
  • Validate that hostname matches correct server type for CLI commands mullvad relay set location,
  • mullvad bridge set location, and mullvad relay set tunnel wireguard entry location.
  • Fix connectivity issues that would occur when using quantum-resistant tunnels with an incorrectly
  • configured MTU.
  • Fix custom list name validation by not allowing empty names.
  • Fix map scaling issues when changing display scale settings and when running under Wayland on
  • Linux.
  • LINUX:
  • Prevent fragmentation when multihop is enabled by setting a default route MTU.
  • Fix Bash shell completions for subcommands in the CLI.
  • Fix out IP missing forever when am.i.mullvad.net returns error.
  • MACOS:
  • Fix default route not being restored when disconnecting when the gateway was a link-local IPv6
  • address.
  • Fix app sometimes getting stuck in error state when the connection is unstable. This occurred
  • when the default route was removed while connecting.
  • Improve multihop performance by preventing fragmentation in the tunnel. This is done by setting
  • an MTU on the default route.
  • Fix bug that caused high CPU usage.
  • Fix bugs that caused the log to be filled with socket errors, by handling closed sockets
  • gracefully.

New in Mullvad VPN 2024.1 Beta 2 (Feb 20, 2024)

  • Added:
  • Add account UUID to verbose 'mullvad account get -v' output.
  • Respect OS prefer-reduced-motion setting.
  • Add CLI command for exporting settings patches: mullvad export-settings. Currently, it generates a patch containing all patchable settings, which only includes relay IP overrides.
  • Make mullvad status prints if lockdown mode is enabled when disconnected.
  • Add option to configure custom API access methods. Custom API access methods allows the user to circumvent censorship by proxying API traffic.
  • Add confirmation dialog when deleting a custom list.
  • Add support for custom SOCKS5 OpenVPN bridges running locally.
  • Fixed:
  • Fix connectivity issues that would occur when using quantum-resistant tunnels with an incorrectly
  • configured MTU.
  • Fix custom list name validation by not allowing empty names.
  • Linux:
  • Fix Bash shell completions for subcommands in the CLI.
  • Fix out IP missing forever when am.i.mullvad.net returns error.
  • Changed:
  • Remove --location flag from mullvad status CLI. Location and IP will now always be printed (if available). mullvad status listen no longer prints location info.
  • Change CLI interface for custom SOCKS5 bridges as part of supporting bridges running locally.
  • Upgrade the background map to a new WebGL 3D map. This should both look better and be more performant.
  • Update Electron from 26.3.0 to 28.1.3.
  • Improve the "Connecting to system service"-view with information about the situation and
  • troubleshooting tips.
  • Update support email address to new email address, [email protected].
  • Linux:
  • Enable quantum resistant tunnels by default (when set to auto). On other platforms, auto still always means the same thing as off.

New in Mullvad VPN 2024.1 Beta 1 (Dec 15, 2023)

  • ADDED:
  • Add CLI support for applying patches to the settings with mullvad import-settings.
  • CHANGED:
  • CLI command mullvad relay set tunnel wireguard entry-location changed to
  • mullvad relay set tunnel wireguard entry location, as the location subcommand can now be
  • swapped for custom-list to select entry relays using a custom list.
  • LINUX:
  • Rename interface name from wg-mullvad to wg0-mullvad.
  • FIXED:
  • Validate that hostname matches correct server type for CLI commands mullvad relay set location,
  • mullvad bridge set location, and mullvad relay set tunnel wireguard entry location.
  • LINUX:
  • Prevent fragmentation when multihop is enabled by setting a default route MTU.

New in Mullvad VPN 2023.6 (Dec 9, 2023)

  • ADDED:
  • Add customizable relay lists to the CLI on desktop. Custom lists can be managed through
  • mullvad custom-lists and can be selected through mullvad relay set and mullvad bridge set.
  • Add custom lists to location selector in desktop app.
  • Add custom API access methods to the CLI on desktop. Custom API access methods allow the user to
  • proxy API traffic through a peer before connecting to a tunnel. They are managed through
  • mullvad api-access, and the initially supported network protocols are Shadowsocks and
  • SOCKS5.
  • Add social media content blocker.
  • Add ability to override server IPs to the CLI.
  • CHANGED:
  • Update Electron from 25.2.0 to 26.3.0.
  • Update OpenVPN to 2.6.8 from 2.6.0.
  • LINUX:
  • Don't block forwarding of traffic when the split tunnel mark (ct mark) is set.
  • REMOVED:
  • Remove wireguard-go (userspace WireGuard) support.
  • FIXED:
  • Show correct endpoint in CLI for custom relays.
  • Lower risk of being rate limited.
  • Fix error dialog when failing to write to console by handling the thrown error.
  • Fix error dialog displayed when the daemon was killed.
  • Fix desktop app freezing when navigations occur in very quick succession.
  • WINDOWS:
  • Correctly detect whether OS is Windows Server (primarily for logging in daemon.log).
  • SECURITY:
  • Update OpenVPN to 2.6.8 to fix CVE-2023-46850, which could cause freed memory to be sent to the peer.
  • WINDOWS:
  • Fix possible privilege escalation by setting stricter permissions on mullvad directories such as
  • the directory in ProgramData.

New in Mullvad VPN 2023.6 Beta 1 (Nov 23, 2023)

  • ADDED:
  • Add customizable relay lists to the CLI on desktop. Custom lists can be managed through
  • mullvad custom-lists and can be selected through mullvad relay set and mullvad bridge set.
  • Add custom lists to location selector in desktop app.
  • Add custom API access methods to the CLI on desktop. Custom API access methods allow the user to
  • proxy API traffic through a peer before connecting to a tunnel. They are managed through
  • mullvad api-access, and the initially supported network protocols are Shadowsocks and
  • SOCKS5.
  • Add social media content blocker.
  • Add ability to override server IPs to the CLI.
  • CHANGED:
  • Update Electron from 25.2.0 to 26.3.0.
  • LINUX:
  • Don't block forwarding of traffic when the split tunnel mark (ct mark) is set.
  • REMOVED:
  • Remove wireguard-go (userspace WireGuard) support.
  • FIXED:
  • Show correct endpoint in CLI for custom relays.
  • Lower risk of being rate limited.
  • Fix error dialog when failing to write to console by handling the thrown error.
  • Fix error dialog displayed when the daemon was killed.
  • Fix desktop app freezing when navigations occur in very quick succession.
  • WINDOWS:
  • Correctly detect whether OS is Windows Server (primarily for logging in daemon.log).
  • SECURITY:
  • Fix possible privilege escalation by setting stricter permissions on mullvad directories such as
  • the directory in ProgramData.

New in Mullvad VPN 2023.5 (Oct 11, 2023)

  • Changes since 2023.5-beta2:
  • Fix connectivity issues when switching between networks or disconnecting on macOS.
  • Here is a list of all changes since last stable release 2023.4.
  • ADDED:
  • Add --help and --version options to the desktop GUI application.
  • Add creation date below device name in the device list screen.
  • Add account view button in main view in the desktop app.
  • Add time left and device name in the header bar in the desktop app.
  • CHANGED:
  • In the CLI, update the tunnel subcommand to resemble relay more. For example, by adding a
  • unified mullvad tunnel get command and removing individual get subcommands like
  • mullvad tunnel ipv6 get.
  • Update the CLI multihop settings to make it possible to set the entry location without toggling
  • multihop on or off.
  • In the CLI, the mullvad account get command will now print the account number (if there is one)
  • after the device has been revoked.
  • Update the CLI relay, multihop & bridge selection interface to accept a hostname as sole argument,
  • inheriting the behavior of mullvad relay set hostname. This is in addition to accepting a
  • geographical location as basis for filtering relays.
  • Silence OpenVPN "replay attack" warnings.
  • Update Electron from 23.2.0 to 25.2.0.
  • WINDOWS:
  • In the CLI, add a unified mullvad split-tunnel get command to replace the old commands
  • mullvad split-tunnel pid list and mullvad split-tunnel get.
  • FIXED:
  • Update relay list after logging in. Previously, if the user wasn't logged in when the daemon
  • started, the relay list would only be updated after attempting to connect to the VPN.
  • MACOS:
  • Fix inability to sync iCloud and Safari bookmarks while connected to the VPN.
  • Ensure that the default tunnel route is added back after waking from hibernation. Previously, the
  • tunnel became unusable despite the app appearing to be connected.
  • Work around issue where the default route was lost after disconnecting after switching between
  • networks.
  • Fix slow offline detection.
  • Fix inability to switch from a network to a higher-priority network without the tunnel timing out.
  • Fix connectivity issues when switching between networks or disconnecting.
  • REMOVED:
  • Remove the CLI subcommand mullvad relay set hostname.

New in Mullvad VPN 2023.5 Beta 2 (Sep 23, 2023)

  • This release is for desktop only.
  • FIXED:
  • Ensure that the default tunnel route is added back after waking from hibernation. Previously, the
  • tunnel became unusable despite the app appearing to be connected.
  • Work around issue where the default route was lost after disconnecting after switching between
  • networks.
  • Fix slow offline detection.
  • Fix inability to switch from a network to a higher-priority network without the tunnel timing out.

New in Mullvad VPN 2023.5 Beta 1 (Jul 13, 2023)

  • Added:
  • Add --help and --version options to the desktop GUI application.
  • Add creation date below device name in the device list screen.
  • Add account view button in main view in the desktop app.
  • Add time left and device name in the header bar in the desktop app.
  • Changed:
  • In the CLI, update the tunnel subcommand to resemble relay more. For example, by adding a
  • unified mullvad tunnel get command and removing individual get subcommands like
  • mullvad tunnel ipv6 get.
  • Update the CLI multihop settings to make it possible to set the entry location without toggling
  • multihop on or off.
  • In the CLI, the mullvad account get command will now print the account number (if there is one)
  • after the device has been revoked.
  • Update the CLI relay, multihop & bridge selection interface to accept a hostname as sole argument,
  • inheriting the behavior of mullvad relay set hostname. This is in addition to accepting a
  • geographical location as basis for filtering relays.
  • Silence OpenVPN "replay attack" warnings.
  • Update Electron from 23.2.0 to 25.2.0.
  • Windows:
  • In the CLI, add a unified mullvad split-tunnel get command to replace the old commands
  • mullvad split-tunnel pid list and mullvad split-tunnel get.
  • Fixed:
  • Update relay list after logging in. Previously, if the user wasn't logged in when the daemon
  • started, the relay list would only be updated after attempting to connect to the VPN.
  • macOS:
  • Fix inability to sync iCloud and Safari bookmarks while connected to the VPN.
  • Removed:
  • Remove the CLI subcommand mullvad relay set hostname.

New in Mullvad VPN 2023.4 (Jun 28, 2023)

  • ADDED:
  • Log select settings on each connection attempt.
  • CHANGED:
  • Update Electron from 21.1.1 to 23.2.0.
  • macOS:
  • Change macOS app signing key and certificates. Replace those issued to Amagicom AB (the parent
  • company of Mullvad VPN AB) with new certificates issued directly to Mullvad VPN AB.
  • DEPRECATED:
  • Linux:
  • Deprecated support for Debian 10. This also means dropping support for glibc older
  • than 2.31 and Linux kernels older than 5.10.
  • FIXED:
  • Fix location search in desktop app only searching for English location names.
  • Fix automatic WireGuard key rotation not being initialized correctly when not running the GUI.
  • Fix duplicated notifications in some situations.
  • Fix notification setting being inverted. When non-important notifications were disabled it instead
  • disabled important ones and showed non-important ones.
  • Work around issues with PQ and multihop caused by fragmentation in the tunnel. The workaround
  • doesn't fix fragmentation issues in general but prevents the PSK exchange packets from being
  • fragmented by setting an explicit maximum segment size.
  • Fix misaligned read in shadowsocks leading to a panic on some platforms.
  • macOS:
  • Fix tray window behaviour when opening mission control and switching between full-screen
  • workspaces.
  • Fix issue where app stopped responding on ARM Macs.
  • Linux:
  • Fix RPM package containing unecessary files causing conflicts with other electron-builder based
  • packages.

New in Mullvad VPN 2023.4 Beta 1 (May 4, 2023)

  • Added:
  • Log select settings on each connection attempt.
  • Changed:
  • Update Electron from 21.1.1 to 23.2.0.
  • macOS:
  • Change macOS app signing key and certificates. Replace those issued to Amagicom AB (the parent
  • company of Mullvad VPN AB) with new certificates issued directly to Mullvad VPN AB.
  • DEPRECATED:
  • Linux:
  • Deprecated support for Debian 10. This also means dropping support for glibc older
  • than 2.31 and Linux kernels older than 5.10.
  • Fixed:
  • Fix location search in desktop app only searching for English location names.
  • Fix automatic WireGuard key rotation not being initialized correctly when not running the GUI.
  • Fix duplicated notifications in some situations.
  • Fix notification setting being inverted. When non-important notifications were disabled it instead
  • disabled important ones and showed non-important ones.
  • Work around issues with PQ and multihop caused by fragmentation in the tunnel. The workaround
  • doesn't fix fragmentation issues in general but prevents the PSK exchange packets from being
  • fragmented by setting an explicit maximum segment size.
  • macOS:
  • Fix tray window behaviour when opening mission control and switching between full-screen
  • workspaces.
  • Linux:
  • Fix RPM package containing unecessary files causing conflicts with other electron-builder based
  • packages.

New in Mullvad VPN 2023.3 (Apr 6, 2023)

  • ADDED:
  • Add Kyber1024 KEM algorithm into the Post-Quantum secure key exchange algorithm. This means the
  • Quantum-resistant-tunnels feature now mixes both Classic McEliece and Kyber for added protection.
  • Add notification dot to tray icon and system notification throttling.
  • Add troubleshooting information to some in-app notifications.
  • Add setting for quantum resistant tunnels to the desktop GUI.
  • Enable TCP_NODELAY for the socket used by WireGuard over TCP. Improves latency and performance.
  • CHANGED:
  • Update the Post-Quantum secure key exchange gRPC client to use the stabilized
  • PskExchangeV1 endpoint
  • Add "auto" setting for the quantum-resistant tunnel feature, and make it the default. If it was previously set to off, it will now be set to auto instead. That currently means the same thing as"off", but this might change in the future.
  • Update OpenVPN to 2.6.0 from 2.5.3.
  • Update OpenSSL to 1.1.1t from 1.1.1j.
  • Post-Quantum secure tunnels and multihop can now be used at the same time.
  • Change WireGuard key rotation interval to 14 days. It was 7 days.
  • WINDOWS:
  • Remove automatic fallback to wireguard-go. This is done as a first step before fully
  • deprecating it on Windows.
  • REMOVED:
  • Remove port 443 as valid port for WireGuard over TCP. Keep only port 80 and 5001. The reason is to free up port 443 for other TCP based obfuscation later.
  • FIXED:
  • Fix close to expiry notification not showing unless app is opened once within the last three days in the desktop app.
  • Retry if PQ PSK negotiation fails for any reason.
  • Fix accumulated tunnel state notifications sometimes displayed after suspend.

New in Mullvad VPN 2023.3 Beta 1 (Mar 24, 2023)

  • Added:
  • Add Kyber1024 KEM algorithm into the Post-Quantum secure key exchange algorithm. This means the
  • Quantum-resistant-tunnels feature now mixes both Classic McEliece and Kyber for added protection.
  • Add notification dot to tray icon and system notification throttling.
  • Add troubleshooting information to some in-app notifications.
  • Add setting for quantum resistant tunnels to the desktop GUI.
  • Enable TCP_NODELAY for the socket used by WireGuard over TCP. Improves latency and performance.
  • Changed:
  • Update the Post-Quantum secure key exchange gRPC client to use the stabilized
  • PskExchangeV1 endpoint
  • Add "auto" setting for the quantum-resistant tunnel feature, and make it the default. If it was
  • previously set to off, it will now be set to auto instead. That currently means the same thing as
  • "off", but this might change in the future.
  • Update OpenVPN to 2.6.0 from 2.5.3.
  • Update OpenSSL to 1.1.1t from 1.1.1j.
  • Post-Quantum secure tunnels and multihop can now be used at the same time.
  • Windows:
  • Remove automatic fallback to wireguard-go. This is done as a first step before fully
  • deprecating it on Windows.
  • Removed:
  • Remove port 443 as valid port for WireGuard over TCP. Keep only port 80 and 5001. The reason is
  • to free up port 443 for other TCP based obfuscation later.
  • Fixed:
  • Fix close to expiry notification not showing unless app is opened once within the last three days
  • in the desktop app.
  • Retry if PQ PSK negotiation fails for any reason.
  • Fix accumulated tunnel state notifications sometimes displayed after suspend.