Guides ·
Mullvad split tunneling on Android
The Mullvad app for Android has split tunneling that excludes apps. In settings, open Split tunneling, turn it on and tap the apps that shouldn’t use the VPN (Mullvad). Every other app goes through one Mullvad server.
What it doesn’t do
- Exclude only. Mullvad says it doesn’t plan to add a mode where only chosen apps use the VPN.
- Not with Android’s blocking. “The excluded apps will not work if you have enabled Block connections without VPN in the Android settings,” Mullvad’s help page says.
- DNS stays with Mullvad. Excluded apps still use the DNS server on the Mullvad server you’re connected to.
- No different country per app. Apps on the VPN share one Mullvad server.
- One VPN app. While Mullvad is connected, Android won’t run Tailscale or another VPN app next to it.
Mullvad in unbraid
unbraid signs in with your Mullvad account number and keeps several Mullvad exits open at once, next to other providers and Tailscale.
- Add Mullvad. Go to Settings, Providers & servers, Add connection, Sign in to a provider, choose Mullvad and enter your 16-digit account number. On a fresh install, the first run asks for a connection: choose Mullvad there and tap Continue.
- Choose the default location. In Routes, open the default route, tap Change location and pick Mullvad under Provider, then a country or city.
- Add routes with +, then Route, for other Mullvad locations, or for another provider.
- Block ads and trackers per route if you like: open the route in Routes, tap Change location, then Route options, and turn on Block ads, trackers & malware. A custom DNS server under Settings, DNS & filtering replaces Mullvad’s DNS and its blocking.
- Assign apps in Apps: a route, or Direct. Then connect from Routes.
How it differs
| Mullvad app | unbraid with Mullvad | |
|---|---|---|
| Apps off the VPN | Yes, exclude list | Yes, Direct |
| Only some apps on the VPN | No | Make Direct the default route |
| DNS of apps off the VPN | Mullvad’s DNS | Your network’s DNS, unless Android’s Private DNS or the app’s own encrypted DNS changes it |
| A different country per app | No | Yes |
| Other providers or Tailscale alongside | No | Yes |
| Excluded apps with Block connections without VPN on | Don’t work | Direct apps still connect through unbraid, without a VPN exit, IPv4 only |
Apps that follow a Direct default route still pass through unbraid and are IPv4 only. With Block connections without VPN on, Direct apps can’t connect while unbraid is paused or off.
Device slots
A Mullvad account works on up to 5 devices. unbraid uses one of them for all its Mullvad routes, however many countries you add. Signing out of Mullvad in unbraid asks Mullvad to free the slot. If that fails, unbraid tells you to remove the device in your Mullvad account.
Limits
- WireGuard. unbraid connects to Mullvad over WireGuard, without Mullvad’s obfuscation options.
- IPv4 only for apps that go through unbraid.
- Android 13 or newer, on a 64-bit ARM phone.
For Mullvad next to your tailnet, see Mullvad and Tailscale at the same time.
Questions
Do I need the Mullvad app? No. unbraid connects to Mullvad itself. You can keep the app installed, but it can’t be connected while unbraid is on.
Does unbraid see my Mullvad account? It stores the account number encrypted on your phone, to sign in and register the device. unbraid has no servers of its own.
Can I use Mullvad’s DAITA or multihop? The built-in Mullvad connection has no DAITA or multihop settings. A Mullvad multihop WireGuard config can be imported as your own server, if it has one peer.