This is the procedure for how to install WireGuard tools and Mullvad VPN on FreeBSD. Tested with WireGuard tools 1.0 on FreeBSD 14.3, 14.4 and 14.5.
What is Mullvad VPN?
Mullvad VPN is a privacy oriented VPN. It is not a VPN, that can be used for connecting your computers and infrastructure.
A privacy oriented VPN can be used for routing Internet traffic through one or more of their exit location servers. This provides some degree of protection against threats to a free society. Threats, such as personal data collection, censorship and mass surveillance by big tech business models and Internet service providers. You can read more about, why privacy matters, on their website.
Install WireGuard tools for FreeBSD.
If not installed, then install the WireGuard kernel module and utilities. It comes with the port wireguard-tools.
# pkg install wireguard-tools
Load WireGuard kernel module.
Load the WireGuard kernel module. Configure FreeBSD to load it at boot.
# kldload if_wg
# sysrc kld_list+="if_wg"
Install Mullvad VPN WireGuard configuration for Linux and FreeBSD.
FreeBSD is now ready to create the WireGuard tunnel and just needs a configuration file from Mullvad VPN. Go to the account page. Generate a WireGuard key or import one, if you have one. Select one or more exit locations by selecting all or a specific country, all or a specific city and all or a specific server. Configure content blocking. I recommend ads, trackers and malware. I have not tested the effeciency of these though. Generate and download the configuration as a Zip archive. The result is a compressed archive, that contain one or more WireGuard configuration files. You can download more countries, if necessary.
# for f in mullvad*.zip; do unzip -o $f -d /usr/local/etc/wireguard; done
Bring WireGuard network interface up on FreeBSD.
The WireGuard utility can now create and bring up the WireGuard network interface for FreeBSD. It will also load the private key and configuration into the interface. It will assign an internal Mullvad VPN tunnel IP address. It will adjust MTP for UDP encapsulation to avoid fragmentation. It will change the local DNS resolver to avoid DNS leaks. It will add routes, which consist of a routing split. In this example, a Germany exit location is used.
# wg-quick up /usr/local/etc/wireguard/de-fra-wg-001.conf
If the WireGuard interface should load automatically at boot, then configure it.
# sysrc wireguard_enable="YES"
# sysrc wireguard_interfaces="de-fra-wg-001"
Confirm created WireGuard network interface.
Confirm, that the WireGuard interface has been created.
# ifconfig de-fra-wg-001
Confirm local DNS resolver.
# cat /etc/resolv.conf
Confirm Internet IP address from Mullvad VPN.
Confirm, that the Internet IP address has changed to the Mullvad VPN exit server. You can do this by visiting the Mullvad connection check page or a similar IP address check page. If you in a plain text environment, you can use my IP address check page with CURL.
# curl -s https://www.micski.dk/what-is-my-ip-address/ | grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' | head -n 1
Bring down WireGuard network interface.
If needed, the WireGuard network interface can be brought down. The WireGuard utility will also restore the routes and local DNS resolver.
# wg-quick down /usr/local/etc/wireguard/de-fra-wg-001.conf