How to configure Mullvad VPN and WireGuard?

    I updated my Ubuntu laptop to use wireguard yesterday and it was easy, but despite trying hard to understand how to install wireguard on LibreELEC, I'm pretty lost how this relates to the Mullvad device generator. Do I need to generate a private key for LibreELEC and upload this to Mullvad to generate a new device? The LibreELEC wiki says "Most users will not need to generate WireGuard keys as they will be in the configuration file provided by a VPN service provider" but I can't see how this would work for Mullvad.

    If there are any Mullvad users, could you give me some help with this and explain the procedure in simple terms.

    Ultimately I want to boot into LibreELEC with wireguard turned off and toggle the VPN from Kodi via a script.

    Edited once, last by Mickeyluv (February 7, 2026 at 3:42 PM).

    Most providers simply generate all the keys needed for a client node to be configured to work with their server. This is technically less secure (as they generated and thus could know/store the private key of the remote device) but that doesn't seem to bother most users who only care about a connection that hides their presumably dodgy activity. I've never seen the Mullvad device generator tool but if they allow you to provide a public key and optional preshared key, which they store to authenticate your client node, this is more secure, but not really more complicated; the tool will still generate a conf with the content you require.

    Disclaimer I do not use libreelec myself (yet) but I think this may be what you're looking for: https://mullvad.net/account/wireguard-config/

    From:

    Quote

    We provide WireGuard configuration files for any device that supports them.

    Mullvad VPN | Privacy is a universal right
    Free the internet from mass surveillance and censorship. Fight for privacy with Mullvad VPN and Mullvad Browser.
    mullvad.net


    So you're close, but instead of generating they private key on LibreELEC and uploading it to Mullvad, it's more like you generate it via Mullvad's web portal and download/copy it (along with a whole Wireguard config file optionally) onto your LibreELEC. Where you can then use it to configure your Wireguard.

    As chewitt noted, this could be considered a security risk to let Mullvad create your private key this way, since it means their system (or at least their Javascript code running in your browser) sees/touches your private key. But all VPN providers seem to do it this way, for ease of use. Any risk is probably mitigated by the fact that presumably you trust Mullvad not to store/share your private key (just like you're already trusting them not to store/share your traffic logs or anything identifying about you), and you're not using this private key for anything else but the Mullvad VPN.

    I've done it on my laptop and it worked, but I switched over to using the Mullvad app at some point (to make switching hosts and "split tunneling" (a.k.a. app exclusions) easier), so I'm not an expert at configuring/running it this way, it's been a while.

    Not sure if this is what you needed, hope it helps though.

    Quote from chewitt

    This is technically less secure (as they generated and thus could know/store the private key of the remote device) but that doesn't seem to bother most users who only care about a connection that hides their presumably dodgy activity.

    I used to get a lot of buffering when watching TV in the evening without a VPN, made worse if there's a big sporting event. With a VPN there's no buffering at all, but a couple of channels refuse connection with the VPN anyhow even though I'm a registered user and can otherwise view them.

    I'll take another look tomorrow at the Mullvad key generator and try out the suggestions, as its getting late now.

    I got a lot further with this today, but at the moment the connection isn't working. I used the Mullvad generator to provide the keys and endpoint server credentials and transposed these into the required LibreELEC format.

    The wireguard connection now appears in my connections list and available for manual connect/disconnect but when connected no Kodi plugins will work and it appears that traffic stops altogether.

    However, all the command line connman checks as per the wiki show that the connection is up and running with no errors at a LibreELEC level. I'm pretty stumped what to try for the time being.

    It sounds like something in your config isn't quite right yet. In my experience wireguard isn't clear when the keys aren't right, it just hangs on the handshake and all traffic stalls. You'd think you'd get an error message or something, but no.

    Recheck the config! Test the config on a pc where it's easier to debug.