This is the procedure for how to install WireGuard tools and Mullvad VPN on FreeBSD. Tested with WireGuard tools 1.0 on FreeBSD 14.3 on 2025-10-23.
Install WireGuard tools for FreeBSD.
If not installed, then install the WireGuard kernel module and utilities. It comes with the port wireguard-tools.
# pkg install wireguard-tools
Load WireGuard kernel module.
Load the WireGuard kernel module. Configure FreeBSD to load it at boot.
# kldload if_wg
# sysrc kld_list+="if_wg"
Install Mullvad VPN WireGuard configuration for Linux and FreeBSD.
FreeBSD is now ready to create the WireGuard tunnel and just needs a configuration file from Mullvad VPN. Go to the account page, generate a WireGuard key and generate a configuration file for Linux and FreeBSD. The result is a compressed archive, that contain one or more configuration files. In this example, the Danish exit servers are installed into the local WireGuard directory. The file names will be used later.
# unzip -d /usr/local/etc/wireguard mullvad_wireguard_linux_dk_cph.zip
Archive: tmp/mullvad-wireguard/mullvad_wireguard_linux_dk_cph.zip
extracting: /usr/local/etc/wireguard/dk-cph-wg-001.conf
extracting: /usr/local/etc/wireguard/dk-cph-wg-002.conf
extracting: /usr/local/etc/wireguard/dk-cph-wg-401.conf
extracting: /usr/local/etc/wireguard/dk-cph-wg-402.conf
Bring WireGuard network interface up on FreeBSD.
The WireGuard utility can now create and bring up the WireGuard network interface for FreeBSD. It will also load the private key and configuration into the interface. It will assign an internal Mullvad VPN tunnel IP address. It will adjust MTP for UDP encapsulation to avoid fragmentation. It will change the local DNS resolver to avoid DNS leaks. It will add routes, which consist of a clever routing split. In this example, the dk-cph-wg-401 is tested.
# wg-quick up dk-cph-wg-401
[#] ifconfig wg create name dk-cph-wg-401
[#] wg setconf dk-cph-wg-401 /dev/stdin
[#] ifconfig dk-cph-wg-401 inet 10.73.13.37/32 alias
[#] ifconfig dk-cph-wg-401 mtu 1420
[#] ifconfig dk-cph-wg-401 up
[#] resolvconf -a dk-cph-wg-401 -x
[#] route -q -n add -inet 0.0.0.0/1 -interface dk-cph-wg-401
[#] route -q -n add -inet 128.0.0.0/1 -interface dk-cph-wg-401
[#] route -q -n delete -inet 146.70.13.37
[#] route -q -n add -inet 146.70.13.37 -gateway 192.168.1.1
[+] Backgrounding route monitor
If the WireGuard interface should load automatically at boot, then configure it.
# sysrc wireguard_enable="YES"
# sysrc wireguard_interfaces="dk-cph-wg-401"
Confirm created WireGuard network interface.
Confirm, that the WireGuard interface has been created.
# ifconfig
dk-cph-wg-401: flags=10080c1<UP,RUNNING,NOARP,MULTICAST,LOWER_UP> metric 0 mtu >
options=80000<LINKSTATE>
inet 10.73.13.37 netmask 0xffffffff
groups: wg
nd6 options=109<PERFORMNUD,IFDISABLED,NO_DAD>
Confirm local DNS resolver.
# cat /etc/resolv.conf
Confirm Internet IP address from Mullvad VPN.
Confirm, that the Internet IP address has changed to the Mullvad VPN exit server.
# curl -s https://www.micski.dk/what-is-my-ip-address/ | grep -oE '([0-9]{1,3}\>
146.70.13.37
Bring down WireGuard network interface.
If needed, the WireGuard network interface can be brought down. The WireGuard utility will also restore the routes and local DNS resolver.
# wg-quick down dk-cph-wg-401
[#] ifconfig dk-cph-wg-401 destroy
[#] resolvconf -d dk-cph-wg-401
[#] route -q -n delete -inet 146.70.13.37