Suggestions to have a home server VPN and and Mullvad at the same time?

Submitted ⁨⁨1⁩ ⁨month⁩ ago⁩ by ⁨Xylight@lemdro.id⁩ to ⁨selfhosted@lemmy.world⁩

I set up Wireguard on my phone, server, and computer to let my phone access my home network when I’m outside of it.

It works for the most part, but the inconvenient thing is that on Android you can only have 1 VPN running at a time. I want to use Mullvad VPN for the rest of my network connections for privacy.

I could make a single Wireguard config that defines 2 peers to connect to mullvad and my home VPN at the same time, but by doing this, I lock myself to a single server without the benefits of being able to swap servers at the same time.

On desktop, I can have multiple wireguard VPNs at once, but if I have both running at the same time, then my LAN is accessed over the home VPN which is routed through Mullvad VPN. It goes Computer -> Mullvad server -> Home VPN -> Home server, which is pretty wasteful.

What options do I have?

source

Comments

Sort:hotnew top

galacticwaffle@lemmings.world ⁨4⁩ ⁨days⁩ ago
Ugh, Android VPN single-process nonsense strikes again. Trying to run Mullvad and a full home WireGuard at the same time on the phone is basically fighting the OS. Don’t waste time trying to shoehorn two concurrent VPNs or a multi-peer WireGuard profile that locks you to one Mullvad server. That defeats the whole point.

Practical choices that actually work:

Best for simplicity: keep Mullvad as your phone VPN, and expose a small, app-level access path to your home (SSH with dynamic SOCKS, an HTTPS reverse proxy, or a tiny web app). That way Mullvad stays flexible and your home access is an app-level exception, not a second system VPN.

If you want full IP-level access to your LAN from anywhere, use a cheap VPS as a relay or run Tailscale/headscale. Have your home server maintain a persistent tunnel to the VPS/Tailscale node, then connect to that node from your phone. Mullvad stays on your phone and you avoid double-hopping through Mullvad -> home VPN -> home.

Alternative: put Mullvad on your home router/gateway (or an exit node) so devices behind it already use Mullvad. Then your remote WireGuard can be set to only route LAN subnets, preventing the Mullvad double-hop.

Pick the VPS/tailscale relay if you want reliability and don’t want to expose ports on your home. Pick app-level proxies if you want the easiest, lowest-maintenance setup. Anything else is fiddly and will either leak convenience or privacy.
source
Vanilla_PuddinFudge@infosec.pub ⁨1⁩ ⁨month⁩ ago
“WG Tunnel” on f-droid lets you define a config/native for either mobile or wifi, whichever you want.

two configs on both? It does that. A config on one and nothing on the other? It does that.

source
- Xylight@lemdro.id ⁨1⁩ ⁨month⁩ ago
  If it turns on with mobile data automatically, that turns off my Mullvad VPN.
  
  source
  - Vanilla_PuddinFudge@infosec.pub ⁨1⁩ ⁨month⁩ ago
    …then fuck the rules and connect a local home VLAN to Mullvad, then setup a local wireguard server do a little routing. This may be way easier on something like OpenWRT.
    
    source
- non_burglar@lemmy.world ⁨1⁩ ⁨month⁩ ago
  I use WG tunnel, but the “turn on under X condition” doesn’t work for me.
  
  source
- NarrativeBear@lemmy.world ⁨1⁩ ⁨month⁩ ago
  Thank you! I have been wanting this and had no clue it already existed!
  
  source
artiman@piefed.social ⁨1⁩ ⁨month⁩ ago
tailscale has Mullvad add-on, but it’s a paid add-on, you can self-host tailscale with headscale

source
- Xylight@lemdro.id ⁨1⁩ ⁨month⁩ ago
  I tried self-hosting tailscale with headscale, but you cannot have a wireguard only exit node with headscale–and so I can’t have mullvad as my exit node.
  
  source
  - Wispy2891@lemmy.world ⁨1⁩ ⁨month⁩ ago
    Don’t need to self host headscale, the mullvad addon has the exact same price of mullvad standalone, so just stop paying mullvad and pay It via tailscale, choosing the servers via exit nodes. This is the solution you want. Access to your local network + choosing any mullvad server as exit node
    
    source
    -> View More Comments
rumba@lemmy.zip ⁨1⁩ ⁨month⁩ ago
Privoxy on your always on VPN.

Tailscale home, proxy out VPN.

source
acid_falcon@lemmy.world ⁨1⁩ ⁨month⁩ ago
Check out RethinkDNS. It lets you setup multiple wireguard tunnels, and assign what apps are affected by what tunnel

source
AbsolutelyNotAVelociraptor@sh.itjust.works ⁨1⁩ ⁨month⁩ ago
Why don’t you just use Shelter to create a work profile on your phone? The work profile can have a second vpn connection. I do this with my homeserver. The apps that connect to the home server are installed in the work profile so they have permanent access to the homeseraer while the normal profile is on my external vpn.

source
- acid_falcon@lemmy.world ⁨1⁩ ⁨month⁩ ago
  This is so close to what I need. Unfortunately I have a self hosted bitwarden, and when the app is installed it doesn’t auto fill passwords in apps to the other account
  
  source
  - AbsolutelyNotAVelociraptor@sh.itjust.works ⁨1⁩ ⁨month⁩ ago
    Okay so… what about using tailscale? You set as exit node your server, which is configured with gluetun to connect to a VPN (or ideally, it’s online through a router that has itself a VPN for all the connections). Then you connect through tailscale to your homeserver and exit the internet through it (which is already under a VPN).
    
    source
  - AtariDump@lemmy.world ⁨1⁩ ⁨month⁩ ago
    Why not just pay for Bitwarden.
    
    source
    -> View More Comments
masterofn001@lemmy.ca ⁨1⁩ ⁨month⁩ ago
You would maybe need to configure separate virtual interfaces for each VPN. And do some routing or a local redirecting proxy to ensure things go where you want.

On android there are things that allow you to send traffic to different vpns or proxies by setting listening ports. Something like sagernet or proxychainNG or nekobox.

source

ohshit604@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

I’m a bit confused on this comment here:

Additionally, I’d prefer not to not do something like: Computer -> Home VPN -> Mullvad server -> destination, as my upload speed is pretty bad and this would throttle every non-local connection

Because you also mention this:


Which is would be the same thing, no? You’re just making a connection to the Mullvad server first then your home network? 

___

I’ll share my experience but it looks like it’s not the solution you’re looking for, I opted to use my Asus WRT Router w/ [Merlin Firmware](https://www.asuswrt-merlin.net/) to host my VPN server, the Merlin Firmware lets me connect to 5 different VPN clients at a time, I use the “VPN Director” feature to route my VPN Server through one of the 5 different clients effectively creating the multi-hop.

I personally haven’t noticed much degradation in regard to connection speeds but at the same time I don’t constantly hop VPN clients, I typically stick with the server closest to me.

source

tal@olio.cafe ⁨1⁩ ⁨month⁩ ago
Mulvad apparently uses Wireguard. Is there an Android Wireguard client that supports multiple VPNs?

source
- RhondaSandTits@lemmy.sdf.org ⁨1⁩ ⁨month⁩ ago
  Rethink DNS does this.
  
  Despite the name, it is a wireguard client that allows you to have multiple wireguard connections simultaneously.
  You can set the wireguard tunnel for each app individually.
  
  source
portnull@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago
I have something like this with tail scale. My homeserver has a tail scale docker as well as a docker tail scale. The docker tailscale advertises itself as an exit node. The tailscale docker is gluetunned to an extern wireguard server (your mullvad for example) Now I can connect to my home net with tailscale and toggle the exit node on and off. By adding a different tailscale container with a different wire guard exit you could just toggle the exit node like that.

Seeing as you are using mullvad you could also just pay the monthly sub to tailscale and they connect your tailnet directly to mullvad

source
kyle@europe.pub ⁨1⁩ ⁨month⁩ ago
I’m pretty sure Tailscale would be a perfect solution here.

source
LodeMike@lemmy.today ⁨1⁩ ⁨month⁩ ago
You could use the Mullvad given configuration and then also make a peer to your home network, but you’re given a specific LAN IP address from Mullvad.

source