Add private/multiple wireguard peer(s)

[cegfault]

Issue report

Operating system: Android
App version: (latest - feature request)

Issue description

I would like to be able to add a custom/private wireguard Peer to the android app (for example, for access to a certain corporate or private wireguard service). Currently, it is possible to create a wireguard configuration file and manually add a second Peer section, and then use the Wireguard app on Android. This would route all traffic through Mullvad's endpoint except the private Peer access.

However, this is not ideal. Every time I want to switch to another endpoint I would need to generate a new wireguard configuration file, manually add the [Peer] section, and then add it into the Wireguard app. Having a native way to handle this would be ideal.

For reference, my work has development resources behind a wireguard vpn. Android doesn't really allow for Wireguard and Mullvad to run simultaneously.

I think it would be quite beneficial to have a section where I could add a [Peer] endpoint with a specific AllowedIPs (say, 10.x.y.z/24). This way, the app could change wireguard endpoints seamlessly without requiring significant manual attention on my part.

[cegfault]

P.S. Split Tunneling is not sufficient, as it only allows a specific app to bypass the VPN. What's needed is a second endpoint - another [Peer] section. Again, this is operational with manually editing wireguard configuration files, but requires significant (manual) effort when changing to a new Mullvad server/endpoint.

[faern]

Thanks for the suggestion. This is a feature we are tracking internally on some kind of wish list. It's currently not a high priority, but something we agree would be cool to have at some point.

[alexl4321]

second that. would be great. its a huge headache to manage multiple wireguard networks in a corporate context. this would solve many problems.

[Dzjed]

This would be a great feature. I can't use the app and have to use wireguard config files right now for this use case.

[ufocia]

Any updates on this issue?

[Rawa]

I'm glad you found the branch. We did some work during a hackday, and made the basics work on Android with Gotatun. You can build that branch and have a connection to your home, which first will go through the VPN tunnel.

Now to the sad part:
This was never made as part of the plans for 2026. So no design work has been made, and there are yet many decisions to be decided if we were to add this into the app, e.g:

• How would it work with Local Network Sharing.
• What if IP's conflict, e.g users may have the same IP as we use for communicating with the relay.
• Should we do anything with DNS, people likely want to reach their self-hosted stuff by name. Alternative is to specify your own DNS but that may leak.
• How much of the Wireguard features should we support
• How do we show "connectivity"

There is of course people, internally & externally, that want this feature. It still might happen during 2026. But nothing is set in stone.

⚠️ and a caveat: development builds are not tested to the same extent as stable releases. There might be bugs, leaks etc.

[Flat]

Just some opinions from someone who would very much like this functionality. I am sure there are many far more familiar with Wireguard and networking that may have different opinions, and of course different needs.

* How would it work with Local Network Sharing.

If the IP ranges specified for the 2nd (custom) tunnel conflict with the current local subnet, do not allow LAN connectivity, otherwise if the option is enabled, continue as usual.

* What if IP's conflict, e.g users may have the same IP as we use for communicating with the relay.

Is this not already also a concern with local network sharing, or general connectivity with normal usage? I would assume that if I set my LAN subnet to the same IPs mullvad uses in the tunnel there would be routing conflicts. This should be up to the user to deal with, IMO.

* Should we do anything with DNS, people likely want to reach their self-hosted stuff by name. Alternative is to specify your own DNS but that may leak.

I think an option to set settings/features based on the currently connected (or not connected) WiFI AP may help with this, and some of the above as well. For example I may only want to use this custom 2nd tunnel if I am not connected to my home WiFi to access internal devices, but would probably like to connect directly if I am connected to my WiFi. DNS could work in a similar way, if you are hosting your own DNS, you could have it only set to use that DNS to reach internal services if you are connected to that 2nd tunnel, the user could then set their dns to forward to Mullvad DNS servers over their wireguard tunnel, or alternatively Mullvad could have an option to only forward requests for certain tlds, such as .internal or a custom domain to the DNS server chosen by the user, and all other requests would go to Mullvad's DNS.

[ufocia]

https://github.com/mullvad/mullvadvpn-app/releases/tag/android%2Ftest-personal-vpn

looks like it's being currently tested / developed on Android.

Is an apk available for testing? Binaries?

[Handrail9]

https://github.com/mullvad/mullvadvpn-app/releases/tag/android%2Ftest-personal-vpn
looks like it's being currently tested / developed on Android.

Is an apk available for testing? Binaries?

The Developer said that you have to build from source to try it

[Rawa]

I won't recommend anyone running or testing this unless you are a developer. Even though the feature works, there is probably foot guns if you configure your tunnel incorrectly and no code review has been performed, nor testing of any sort besides "feature works".