Using Mullvad WireGuard VPN on OpenBSD

Recently I bought a ThinkPad X230 from a friend to use as a lightweight but robust travel laptop. I looked for a simpler and especially more battery-pleasing operating system than Qubes OS (which I use on my main machine) - but without compromising security on the run. So I went with installing OpenBSD (I have been using it on dozens of other machines, especially servers), as it seems to fit my usecases pretty well.

To be suitable as a travel machine, a VPN is essential for my needs. The provider I am using at the moment is Mullvad¹. Easy I thought, download the WireGuard config files and go …

Nope, that just wasn’t it. OpenBSD uses ifconfig(8) to configure WireGuard interfaces and a different syntax from Linux’s wg-quick files. So, I translated the configs to the OpenBSD syntax, and… still no connection.

Turns out OpenBSD needs some deluxe routing rules to correctly tunnel the VPN traffic. So I found a forum thread², which proposed a fix and a blog post explaining a slightly different setup but still containing useful information³ - but still, it wasn’t working for me.

With a lot of route and WireGuard magic, and reading miles of OpenBSD man pages (which I love, btw), I got it to work finally. Here I want to show you my setup/configs so you won’t have to spend an evening worth of time for route fixing too.

# hostname.wg0
description "Mullvad WireGuard (xx-xxx-wg-001)"
inet <client ip>/32
wgkey foo wgpeer bar wgendpoint <endpoint ip> <port> wgaip 0.0.0.0/0 \
  wgpka 20 wgrtable 1
wgrtable 1
up
!route add default -net <client ip>

For each of your outgoing network interfaces (Wifi, Ethernet), add rdomain 1 to the hostname.if file.

# resolv.conf
nameserver 10.64.0.3 # mullvad
lookup file bind

To skip the VPN route temporarily, one can use the following command:

route -T 1 exec <command>

When something does not work as expected using following command, debugging messages can be enabled on the WireGuard interface using ifconfig wg0 debug and read in dmesg.

[!QUESTION] Edit Somehow, reconnection after suspend or network reconnect is slow, maybe anyone knows a fix?

published: 2023-03-02
last updated: 2025-07-29
tags: openbsd, mullvad, wireguard, setup
aliases: /2023-03-02_openbsd-mullvad-wireguard.html