📡Mullvad VPN on SSH Safe Setup

📌 Overview

By installing Mullvad VPN on your Linux server, you can route all traffic through a secure VPN tunnel. However, if you enable the VPN while connected via SSH, your connection may drop. To prevent this, simply exclude your own IP address from the VPN tunnel.

---

⚙️ Supported Systems

• Ubuntu
• Debian-based distributions

---

🚀 Installation

1️⃣ Install and setup Mullvad VPN

sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc https://repository.mullvad.net/deb/mullvad-keyring.asc &&
echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable stable main" | sudo tee /etc/apt/sources.list.d/mullvad.list &&
sudo apt update && sudo apt install mullvad-vpn -y

---

2️⃣ Mullvad Login

Then log in to your Mullvad account using the command below. Replace ACCOUNT_NUMBER with your Mullvad account number.

mullvad account login ACCOUNT_NUMBER

---

3️⃣ Exclude SSH port from VPN traffic

Then copy and paste the following command directly into your terminal to exclude port 22 from VPN traffic.

GW=$(ip route show | awk '/^default via/ && /eth0/ {print $3}'); [ -z "$GW" ] && GW=$(ip route show | awk '/^default via/ {print $3}'); ip route replace default via "$GW" table 200 && ip rule add fwmark 0x1 lookup 200 2>/dev/null || true && nft list table inet mullvad_safe >/dev/null 2>&1 || nft add table inet mullvad_safe; nft 'add chain inet mullvad_safe output { type route hook output priority -100; policy accept; }' 2>/dev/null; nft 'add chain inet mullvad_safe input { type filter hook input priority -100; policy accept; }' 2>/dev/null; nft 'add chain inet mullvad_safe forward { type filter hook forward priority -100; policy accept; }' 2>/dev/null; nft add rule inet mullvad_safe output tcp sport 22 ct state established,related ct mark set 0x00000f41 meta mark set 0x6d6f6c65 2>/dev/null; nft add rule inet mullvad_safe input tcp dport 22 ct state new,established,related ct mark set 0x00000f41 meta mark set 0x6d6f6c65 2>/dev/null;

If you only want to exclude your own IP address from VPN traffic, use the command below. Do not forget to replace HOME_IP with your public IP address.

HOME_IP="88.234.225.18"; GW=$(ip route show | awk '/^default via/ && /eth0/ {print $3}'); [ -z "$GW" ] && GW=$(ip route show | awk '/^default via/ {print $3}'); [ -z "$GW" ] && echo "Gateway bulunamadı!" && exit 1; ip route add "$HOME_IP/32" via "$GW" dev eth0 2>/dev/null || true; cat <<EOF | sed "s|__HOME_IP__|$HOME_IP|g" | nft -f - 
table inet excludeTraffic {
  chain excludeOutgoing {
    type route hook output priority 0; policy accept;
    ip daddr __HOME_IP__ ct mark set 0x00000f41 meta mark set 0x6d6f6c65
  }
  chain allowIncoming {
    type filter hook input priority -100; policy accept;
    ip saddr __HOME_IP__ tcp dport 22 ct mark set 0x00000f41 meta mark set 0x6d6f6c65
    ct state established,related accept
  }
  chain allowOutgoing {
    type route hook output priority -100; policy accept;
    tcp sport 22 ct mark set 0x00000f41 meta mark set 0x6d6c6c65
  }
}
EOF

---

4️⃣ Connect to Mullvad

Then connect to Mullvad VPN using the command below.

mullvad connect

Verify your connection

curl ipinfo.io

---

📚 Official Documentation

https://mullvad.net/en/download/vpn/linux

---

🧪 Example Use Cases

• Secure outbound traffic on VPS
• Hide origin IP
• Add lightweight privacy layer
• Combine with reverse proxies

---

📬 Contact

Email: glitchbey@proton.me

---

✨ Credits

TKU (The Keyboard Users)
© 2026