Security · checked 2026-10-20

Can I vibecode Mullvad VPN?

NOT REALLY· don't bother

The tunnel is an evening's work: WireGuard on a rented server, a script that adds peers, and the official apps as clients. What Mullvad rents out is a pool of 542 servers across 50 countries and 91 cities on 14 hosting providers, shared by many customers so an address blends in, plus an account that needs no email and a no-logging policy that has been through published outside audits. A server of your own gives you one fixed address tied to your hosting account, which is the opposite of what most people buy Mullvad for. It covers café Wi-Fi and a stable IP, not country-hopping or blending into a crowd.

$5.61/moprice

$67it costs you a year

one sittingbuild time

—people replaced it

Before you start

What you need on hand.

DifficultyIntermediate · Some system setup or keys.

TimeAbout an hour; most of it is the server and the firewall

Claude Code, Codex or CursorAny of them can run the prompt.
A Debian 12 VPSAny small server with a public IPv4 address and root SSH works.
Go 1.23Only needed to build the single binary; copy it to the server afterwards.
The WireGuard app on each deviceOfficial and free for phones and laptops.

Before you buildMullvad has no free plan or trial, but the 14-day money-back guarantee makes a one-month test cheap if you want to compare it with a server of your own.

1. Install one agent: Claude Code, Codex, Cursor.
2. Make an empty folder and open it in the agent.
3. Paste the prompt below, press enter, and answer its questions as it builds.

The prompt

Build me a small WireGuard control panel to replace Mullvad's tunnel for my own devices. Requirements:

- Go 1.23: one static binary `wgpanel` that runs as root on a Debian 12 VPS I already own and
  manages the wg0 interface through `golang.zx2c4.com/wireguard/wgctrl`. Settings are read from
  /etc/wgpanel/config.toml.
- `wgpanel init` creates the server keys and wg0 on UDP 51820, turns on IPv4 and IPv6 forwarding,
  and installs nftables rules for NAT on the public interface. Running it twice changes nothing.
- Storage: SQLite (`modernc.org/sqlite`) at /var/lib/wgpanel/panel.db with devices: name, public
  key, tunnel addresses, creation date and a note. Private keys are never stored on the server.
- `wgpanel add <name>` generates the device key pair, saves only the public key, takes the next
  free /32 and /128, and prints the client config once with a terminal QR code (`skip2/go-qrcode`).
  AllowedIPs are 0.0.0.0/0 and ::/0, DNS is the server's tunnel address, keepalive 25 seconds.
- DNS: install unbound listening on the tunnel address only, forwarding over TLS to the resolver
  named in config.toml.
- Status page on 127.0.0.1:4910 (embedded HTML, htmx), reached through an SSH tunnel and guarded by
  one password hash from config.toml: each device's last handshake and bytes in and out from
  wgctrl, with disable, enable and delete buttons.
- `wgpanel check --server <ip>` runs on a client with the tunnel up and exits 1 when the address
  reported by an echo endpoint in config.toml is not the server's, or when a DNS lookup fails.
- No accounts, no telemetry, local-first: outbound traffic is the DNS-over-TLS upstream and the
  echo request.
- Out of scope: several servers or countries, multihop, obfuscation, payments, Windows or macOS
  clients (use the official WireGuard apps), traffic logging beyond the counters.
- README: install, the firewall (22 and 51820/udp only), and warnings that sites see the server's
  address, the host can see traffic metadata, and this is not an anonymity tool.

Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.

Share on X

Max MiskowSponsoredAI agents, automations and MVPs, built for your company.Visit site ›

Then keep going

Next prompts, same folder.

The first prompt builds the core. Run these one at a time in the same folder to grow it into your own Mullvad VPN.

Extend the WireGuard panel in this folder. Requirements:

- Add a --killswitch option to `wgpanel add` for Linux clients that writes PostUp and PreDown
  lines using nftables to drop all traffic not going through the tunnel or to the server's UDP port.
- Extend `wgpanel check` to test three cases: the echo address, DNS answered by the server's
  resolver, and IPv6 either routed through the tunnel or blocked.
- Add `wgpanel check --drop` that brings the tunnel down for five seconds and fails if any
  request reaches the internet during that time.
- In the README, say that phones need the WireGuard app's "block connections without VPN"
  setting, since the config file can't do it there.

Add multi-server support to the WireGuard panel in this folder. Requirements:

- `wgpanel servers add <name> <ssh host>` registers a second VPS and runs `wgpanel init` on it
  over SSH, storing only its public key and endpoint locally.
- `wgpanel add <device> --server <name>` creates a profile per server, so each phone holds
  one tunnel per country and I switch by turning the profiles on and off.
- The status page lists each server, its devices, last handshakes, and the monthly cost I enter.
- Keep the servers independent: no traffic is routed between them, and removing one leaves the others alone.
- Update the README with the cost per added country and the DNS setup.

Add monitoring to the WireGuard panel in this folder. Requirements:

- Every minute read the wg0 peers; alert when a known device's last handshake is older than a
  threshold I set per device, and when any peer appears that is not in the database.
- Send alerts to an ntfy topic from config.toml, at most one per device per six hours.
- Add `wgpanel rotate <name>`, which prints a new client config, swaps the public key on the
  server only after the new key has connected once, and removes the old key after 24 hours.
- Record every change in an append-only audit table and show the last 50 entries on the status page.
- Update the README with the ntfy setup.

What you lose

Servers in 50 countries and hundreds of shared addresses
An account with no email, name or password, and cash or crypto payment
Published audits and a no-logging policy you can hold the company to
A kill switch, multihop and DAITA traffic-analysis defence in the app
A service that moves its servers and fixes blocks without your help

Why people still pay

People pay for the crowd and for the promise. Many customers share each server address, the company says it keeps no traffic or connection logs, and the price has been 5 euros since 2009. A server you rent yourself swaps trust in Mullvad for trust in the host, and it points back to your account.

Moatinfrastructure scale brand & trust

Do the math

Mullvad VPN or your own copy?

Over

Your usage

Count my time3h ×$/h

Mullvad VPN, 1 yr$67

Your own copy, 1 yr$77running + build session

Paying is cheaper by$10never pays for itself

Estimate · A small VPS costs a few dollars a month and includes a lot of traffic; each extra country is another server. The build is token usage on your agent plan.

Leaving Mullvad VPN

Take your data, then cancel.

1 · Take your data out of Mullvad VPN

1Mullvad holds little about you: per its no-logging page, only the account number, its expiry date and, for WireGuard, your device public keys and tunnel addresses. There is no email or profile to export.
2The pages we read describe no export of app settings, so note your server, custom DNS and split-tunnelling choices by hand.
3If you used Mullvad on a router or in the stock WireGuard app, keep the .conf files you generated: they stop working when the account's time runs out.

2 · Cancel Mullvad VPN

1There is no subscription to cancel in what we read: you add time to a numbered account, and the pricing page and FAQ don't describe automatic renewal.
2The account's Status page shows the remaining time; when it ends, the app reports the account as expired.
3To have the account deleted, email support@mullvadvpn.net; the FAQ names that as the way to ask.
4A 14-day money-back guarantee applies. Cash payments are excluded, and the FAQ also lists crypto payments as an exception.

If you paid by card or PayPal, check your payment provider for any recurring payment, since Mullvad's pages don't describe renewals.
Keep the account number until you are sure you are done: it is the only credential, with no email or password reset.
Mullvad removed OpenVPN support on 15 January 2026, so routers and third-party apps that still use OpenVPN need WireGuard configs before you compare it with other options.
Bank wires and cryptocurrency can take time to show up, so an expired account right after a payment is usually the payment still processing.

Checked 2026-10-20 against Mullvad VPN's docs: 1, 2, 3, 4, 5, 6

The escape hatch

Don't feel like building it? These are already free.

wg-easyOpen sourceAGPL-3.0 web panel in a Docker container for running your own WireGuard server and adding devices with a QR code.★ 27k · active Oct 2026 · docker to self-host
Web, LinuxVisit ↗AmneziaVPNOpen sourceGPL-3.0 client that installs and manages a VPN server on a VPS you own, with protocols built to get past censorship.★ 15k · active Oct 2026 · one-click install
Windows, macOS, Linux, iOS, AndroidVisit ↗PiVPNOpen sourceMIT installer script that sets up WireGuard or OpenVPN on a Raspberry Pi or Debian server and gives you commands to add clients.★ 8.1k · active Aug 2026 · one-click install
LinuxVisit ↗

All 4 free alternatives to Mullvad VPN ›

The numbers

Mullvad VPN pricing

Plan	Monthly	Annual, per month	What you get
Mullvad VPN	$5.61	$5.61	Up to 5 devices, WireGuard servers in 50 countries, no port forwarding. One flat rate for a month, a year or a decade of time.

Billing: A flat 5 euros a month with no discount for longer terms; the page offers 1 month, 1 year or 1 decade of time at the same monthly rate. There is no free plan, no trial and no sales. A 14-day money-back guarantee applies, except for cash. The pages we read don't describe automatic renewal.
Hidden costs: None found. The price includes VAT and is the same for everyone; resellers may charge differently.
Source: mullvad.net

Also on the list

NordVPN$14.99/mo · SecurityNOT REALLY

Tailscale$8/mo · SecurityKINDA

Proton Unlimited$12.99/mo · SecurityNOT REALLY

Questions

Mullvad VPN, briefly

Not answered here? Tell us and we'll add it.

Ask a question ›

Not really. People pay for the crowd and for the promise. Many customers share each server address, the company says it keeps no traffic or connection logs, and the price has been 5 euros since 2009. A server you rent yourself swaps trust in Mullvad for trust in the host, and it points back to your account. The prompt on this page builds the closest honest substitute.

About $5.61 a month on the Mullvad VPN plan, $67.32 a year (checked 2026-10-20).

Servers in 50 countries and hundreds of shared addresses; An account with no email, name or password, and cash or crypto payment; Published audits and a no-logging policy you can hold the company to; A kill switch, multihop and DAITA traffic-analysis defence in the app; A service that moves its servers and fixes blocks without your help. If any of those matter to you, keep paying.