Mullvad and Tailscale at the same time on Android

The Mullvad app and the Tailscale app can’t be connected together on Android. Android allows one VPN app per profile, so connecting one normally disconnects the other. Tailscale’s own help page says the same: Android and iOS run only one VPN at a time.

unbraid signs in to Mullvad with your account number and has Tailscale built in. Your apps use a Mullvad exit for the internet and reach your tailnet devices at the same time.

Set it up

Add Mullvad. In unbraid, go to Settings, Providers & servers, Add connection, Sign in to a provider, and choose Mullvad. Enter your 16-digit account number. On a fresh install, the first run asks for a connection.
Choose your exit. In Routes, open the default route and tap Change location. Select Mullvad under Provider, then a country or city. If Direct is your default, tap +, then Route instead, pick the location, then open the new route and tap Make default.
Join your tailnet. Open Settings, Tailscale, and turn on Reach your tailnet. If you use Headscale, open Control server, enter its https:// address and tap Save. Saving it stops unbraid and resets its Tailscale sign-in.
Connect from Routes. If Tailscale asks you to sign in, tap Sign in to Tailscale.

If Mullvad or Tailscale is set as Android’s Always-on VPN, turn that off first, or choose unbraid instead.

What goes where

Internet traffic from routed apps leaves through Mullvad, over WireGuard.
Tailnet addresses go through Tailscale, not through Mullvad. Your NAS or Home Assistant stays reachable.
Names in your tailnet’s domain, such as nas.tail1234.ts.net, resolve through Tailscale.
Other lookups on Mullvad routes normally use Mullvad’s DNS. Local names use your network’s DNS while Local network bypasses the VPN is on, and Android’s Private DNS can override unbraid’s DNS. To block ads, trackers and malware with Mullvad’s lists, open Route options in the location picker for that route. A custom DNS server under Settings, DNS & filtering replaces Mullvad’s DNS for all VPN routes.
Apps you set to Direct, with Mullvad as the default route, bypass unbraid and its Tailscale connection unless Android’s Block connections without VPN is on. Put an app on a Mullvad route if it needs your tailnet.

To reach devices behind a Tailscale subnet router, like your whole home network, add their private IPv4 ranges under Settings, Local & home access, Home subnets through Tailscale.

Several Mullvad countries

Mullvad split tunneling on Android compares this with the Mullvad app’s own split tunneling.

Add a route with another Mullvad location and assign apps to it. Mullvad counts unbraid as one device on your account, however many Mullvad routes you add. An account has 5 device slots, so your other devices keep theirs.

A Tailscale exit node can be a route’s exit too, for apps that should leave from home. See a Tailscale exit node for some apps.

Other ways to combine them

Mullvad exit nodes inside Tailscale. Tailscale sells Mullvad exit nodes as an add-on. You buy it through Tailscale, not with your own Mullvad account, and your internet traffic leaves through the exit node you pick in the Tailscale app.
A second profile. Install Mullvad in a work profile or Private Space and Tailscale in your main profile. Each profile has its own VPN slot, but apps must be installed in the profile whose VPN they should use.
A VPN on your router. Run Mullvad on the router at home and use a Tailscale exit node there.

unbraid uses the Mullvad account you already have, and lets each app choose Mullvad, another provider, your home, or your normal connection.

What you need

Android 13 or newer on a 64-bit ARM phone, your Mullvad account, and a Tailscale or Headscale tailnet. Traffic that goes through unbraid is IPv4 only.

Questions

Do I need the Mullvad or Tailscale app? No. unbraid connects to both itself. Android would disconnect one of them anyway.

Does Mullvad see my tailnet traffic? No. Tailnet addresses go through Tailscale.

Does it cost anything? unbraid is free and open source. Your Mullvad time and Tailscale plan are separate.