mullvad lan - Mullvad VPN

Overview

The mullvad lan command controls whether you can access devices on your local network (LAN) while connected to the VPN.

Syntax

mullvad lan <SUBCOMMAND>

Subcommands

get

Display the current local network sharing setting:

mullvad lan get

set

Change the local network access setting:

mullvad lan set <allow|block>

Arguments:

allow - Allow access to local network devices
block - Block access to local network devices

Behavior

Allow LAN Access

When set to allow:

✓ Can access local network devices (printers, NAS, etc.)
✓ Local traffic bypasses VPN tunnel
✓ Can access router admin interface
✓ Network shares and services accessible
✓ Local multiplayer gaming works
Internet traffic still routes through VPN

Block LAN Access

When set to block:

All traffic routes through VPN, including local
Cannot access local network devices
Maximum isolation from local network
Better security on untrusted networks

Examples

Check Current Setting

mullvad lan get

Output when allowed:

Local network sharing setting: allow

Output when blocked:

Local network sharing setting: block

Allow Local Network Access

mullvad lan set allow

Output:

Changed local network sharing setting

Block Local Network Access

mullvad lan set block

Output:

Changed local network sharing setting

Use Cases

Home Network Access

Allow LAN access to use home devices:

mullvad lan set allow

Access:

Network printers
Network-attached storage (NAS)
Smart home devices
Media servers (Plex, Jellyfin)
Local web services
Router configuration interface

Public WiFi Security

Block LAN access on untrusted networks:

mullvad lan set block

Use this on:

Coffee shop WiFi
Hotel networks
Airport WiFi
Public hotspots
Any untrusted network

Maximum Isolation

Block all local network access:

mullvad lan set block
mullvad lockdown-mode set on

Provides:

Complete network isolation
Maximum security
No local network exposure

Local Network Detection

Mullvad automatically detects local network ranges:

Private IP Ranges

10.0.0.0/8 - Class A private network
172.16.0.0/12 - Class B private network
192.168.0.0/16 - Class C private network
169.254.0.0/16 - Link-local addresses
fc00::/7 - IPv6 unique local addresses
fe80::/10 - IPv6 link-local addresses

What Counts as Local

Local network traffic includes:

Same subnet communication
Router/gateway access
Broadcast traffic
Multicast traffic
mDNS/Bonjour discovery

Common Local Services

Network Printers

Access network printers:

mullvad lan set allow

Then print normally to network printers like 192.168.1.100.

Network Storage (NAS)

Access NAS devices:

mullvad lan set allow

Mount SMB/CIFS shares:

# Linux/macOS
mount -t cifs //192.168.1.50/share /mnt/nas

# macOS Finder
smb://192.168.1.50/share

# Windows
\\192.168.1.50\share

Router Admin Interface

Access router configuration:

mullvad lan set allow

Then browse to http://192.168.1.1 (or your router’s IP).

Smart Home Devices

Control smart home devices:

mullvad lan set allow

Access:

Smart lights (Philips Hue, etc.)
Smart thermostats
Security cameras
Home automation hubs

Local Web Development

Access development servers:

mullvad lan set allow

Connect to:

localhost (always works)
Local machine: 192.168.1.X
Other development machines on LAN

Security Considerations

When to Allow LAN

✓ Safe to allow on:

Home network
Trusted work network
Private networks you control
When you need local device access

When to Block LAN

✓ Should block on:

Public WiFi
Hotel networks
Airport WiFi
Coffee shops
Any untrusted network
When maximum isolation is needed

Security Trade-offs

Allow LAN:

Pros: Access to local devices, convenience
Cons: Exposed to local network threats

Block LAN:

Pros: Maximum isolation, better security
Cons: Can’t access local devices

Interaction with Other Settings

Lockdown Mode

LAN setting works independently of lockdown mode:

# Block everything when disconnected, allow LAN when connected
mullvad lockdown-mode set on
mullvad lan set allow

Result:

When disconnected: All traffic blocked (lockdown)
When connected: Internet through VPN, LAN accessible

Split Tunneling

LAN setting is separate from split tunneling:

LAN setting: Controls local network access
Split tunneling: Controls which apps use VPN

Both can be configured independently.

Dynamic Configuration

You can change the setting while connected:

# Connected to VPN with blocked LAN
mullvad lan set allow

# Immediately allows local network access
# No reconnection needed

connect - Connect to VPN
lockdown - Configure traffic blocking when disconnected
split-tunnel - Configure app-level split tunneling
status - Check connection status

Exit Status

Code	Description
0	Setting updated successfully
1	Failed to update setting

Notes

LAN setting is persistent across restarts
Changes take effect immediately (no reconnection needed)
Setting is stored in Mullvad daemon configuration
Works on all platforms (Linux, macOS, Windows)
Only affects private IP ranges
Internet traffic always routes through VPN when connected

Troubleshooting

Can’t Access Local Devices

If you can’t access local network devices:

Check LAN setting:
```
mullvad lan get
```
Allow LAN access:
```
mullvad lan set allow
```

Verify you’re on the same network:

ip addr  # Linux
ifconfig # macOS
ipconfig # Windows

Check device IP is in private range

Localhost Still Works

Loopback traffic (127.0.0.1, ::1) always works regardless of LAN setting:

localhost is always accessible
Local development servers on 127.0.0.1 work
Docker containers on host network work

Recommended Configurations

Home Network

mullvad lan set allow
mullvad auto-connect set on

Result: Automatic VPN with local device access

Public WiFi

mullvad lan set block
mullvad connect

Result: Maximum isolation on untrusted networks

Balanced Security

mullvad lan set allow
mullvad lockdown-mode set on

Result: Local access when connected, blocked when disconnected

Source Reference

Implementation: mullvad-cli/src/cmds/lan.rs

Overview

Commands

Configuration

Documentation Index

​Overview

​Syntax

​Subcommands

​get

​set

​Behavior

​Allow LAN Access

​Block LAN Access

​Examples

​Check Current Setting

​Allow Local Network Access

​Block Local Network Access

​Use Cases

​Home Network Access

​Public WiFi Security

​Maximum Isolation

​Local Network Detection

​Private IP Ranges

​What Counts as Local

​Common Local Services

​Network Printers

​Network Storage (NAS)

​Router Admin Interface

​Smart Home Devices

​Local Web Development

​Security Considerations

​When to Allow LAN

​When to Block LAN

​Security Trade-offs

​Interaction with Other Settings

​Lockdown Mode

​Split Tunneling

​Dynamic Configuration

​Related Commands

​Exit Status

​Notes

​Troubleshooting

​Can’t Access Local Devices

​Localhost Still Works

​Recommended Configurations

​Home Network

​Public WiFi

​Balanced Security

​Source Reference

Build docs developers (and LLMs) love

Overview

Syntax

Subcommands

get

set

Behavior

Allow LAN Access

Block LAN Access

Examples

Check Current Setting

Allow Local Network Access

Block Local Network Access

Use Cases

Home Network Access

Public WiFi Security

Maximum Isolation

Local Network Detection

Private IP Ranges

What Counts as Local

Common Local Services

Network Printers

Network Storage (NAS)

Router Admin Interface

Smart Home Devices

Local Web Development

Security Considerations

When to Allow LAN

When to Block LAN

Security Trade-offs

Interaction with Other Settings

Lockdown Mode

Split Tunneling

Dynamic Configuration

Related Commands

Exit Status

Notes

Troubleshooting

Can’t Access Local Devices

Localhost Still Works

Recommended Configurations

Home Network

Public WiFi

Balanced Security

Source Reference