Bind Mullvad to a specific IP on Ubuntu

[bbergeron0]

Mullvad 2022.4 on Ubuntu 22

My problem is similar to this one, with a caveat. I understand that all traffic is transferred through the Wireguard tunnel when Mullvad is on. However, I must be certain that delicate services won’t leak should this tunnel goes down. I cannot enable the kill switch provided for this purpose, since some application must remain operational at all time—whether they’re exposed or not.

These delicate services in question (transmission and other relays) can be bound to a specific inet IP address, so what’s left to have is a constant static IP for Mullvad’s interface.

However, Mullvad’s inet IP is different each day I log back in.

So, how can I ensure my services and Mullvad meet on the same inet?

Thanks.

[faern]

The rotated IP provides better anonymity. We are working on a long term solution that will help you. But until then, can you check if your applications allow binding to an interface rather than an IP? That way you can bind them to the Mullvad tunnel network interface and have it forced through the tunnel.

I cannot enable the kill switch provided for this purpose, since some application must remain operational at all time

You are aware that no application has any internet access while the Mullvad app is reconnecting or anything like that, right? Unless the process is excluded from the tunnel (split tunneling). The opt in lockdown mode in the app is only controlling whether programs can use the internet when you explicitly disconnected Mullvad, it's not about what happens during automatic reconnects or intermittent failures etc.

[bbergeron0]

binding to an interface by name

Some can, others won’t.

some application must remain operational at all time

You are aware that no application has any internet access while the Mullvad app is reconnecting

I can accept a few seconds of downtime for these services. On average, with a great bandwidth, it shouldn’t take more than a minute to reconnect, right?

As I’m writing this I’ve reconsidered my needs, and I will stick to the vanilla Wireguard client for a while. However, I’d appreciate if you could provide a link to that “long-term solution,” if an issue exists for it yet.

Thank you.