Mullvad Port Forwarding: Is It Still Available?
Mullvad removed port forwarding in July 2023. Learn why old setup guides no longer work, what the change affects, and which VPN port models fit torrents, games, or servers.
Quick Answer
No. Mullvad stopped issuing new forwarded ports on May 29, 2023 and removed every existing mapping on July 1, 2023. There is no legacy account setting, app option, WireGuard trick, or server country where Mullvad port forwarding still works. If an application needs an incoming VPN port, you must use another provider or a different networking method.
Current status and shutdown timeline
Mullvad Port Forwarding Status at a Glance
Mullvad once supported the feature, which is why many search results and setup screenshots still exist. Those instructions describe a product that was retired, not a hidden option in the current app.
| Question | Answer | What it means |
|---|---|---|
| Does Mullvad support inbound port forwarding now? | No | Mullvad does not publish a public incoming port and map it through the VPN tunnel to your device. |
| Can a new port be added in an account or app? | No | New assignments were disabled on May 29, 2023; the old account workflow is gone. |
| Will a home-router port rule restore it? | No, not through Mullvad | Your router cannot create an inbound mapping on a remote Mullvad exit server. |
| Can an old forwarded port still be renewed? | No | Mullvad deleted all remaining mappings on July 1, 2023; legacy account numbers receive no exception. |
This page was reviewed on July 28, 2026. Mullvad's current FAQ still answers “No” and repeats the 2023 removal dates. Recheck the official sources below if the company announces a future policy change.
Why Mullvad Removed Port Forwarding
Mullvad's May 2023 announcement said the forwarded-port service was frequently abused. The company reported that law enforcement contacted it, hosting providers canceled service, IP addresses were blacklisted, and other customers could not access some sites. It disabled new assignments immediately and scheduled removal of all existing ports for July 1, 2023.
That decision removed inbound VPN reachability but did not block every outbound peer-to-peer connection. A torrent client can still initiate connections to reachable peers. It simply cannot advertise a Mullvad-mapped port that allows otherwise unreachable peers to initiate back, which can reduce the available peer set and affect seeding in some swarms.
Bottom line: a current Mullvad subscription is not a port-forwarding product. Advice that tells you to add a port on Mullvad's account page is outdated, even if the screenshots and steps once worked.
Why Old Mullvad Port Forwarding Workarounds Fail
Port forwarding is created at the VPN provider's public server. Local settings can allow or route traffic only after the provider has supplied that inbound mapping—and Mullvad no longer does.
Forwarding the old number on your router
Traffic sent to a Mullvad exit IP reaches Mullvad before it could reach your home. A matching home-router rule cannot recreate a mapping that the Mullvad server no longer owns. Router forwarding only applies to your ISP-facing address.
Opening the port in a local firewall
A firewall exception is necessary after a real inbound path exists, but it cannot create that path. With no Mullvad-side assignment, the public packet never arrives at the device for the local rule to permit.
Changing the WireGuard or OpenVPN connection port
A VPN connection port is used by your device to establish the encrypted tunnel. It is not an external application port mapped through that tunnel, even when the same word “port” appears in both settings.
Using an old guide, WireGuard file, or SOCKS5 proxy
Old account mappings were removed centrally, so retaining a configuration file cannot preserve them. Mullvad's SOCKS5 proxy changes outbound routing inside its network; it is not an unsolicited inbound port-forwarding service.
Do You Need to Leave Mullvad?
Do not switch solely because an online checker reports a closed port. Decide whether the application needs strangers or peers to start a connection through the VPN address, then count its required ports and protocols.
| Use case | Forwarded port? | Practical effect |
|---|---|---|
| Torrent downloading and seeding | Helpful, not mandatory | Downloads can work through outbound peer connections. One matching TCP/UDP listening port improves connectability and may help seeding or small swarms. |
| Hosting a configurable game server | Usually yes | The game must accept the port number and protocol the VPN supplies. A one-port VPN cannot cover titles that demand several fixed ports or a broad range. |
| Plex, web apps, or another public service | Yes, for direct public access | A reliable service may also require a stable assignment, DNS, TLS, monitoring, authentication, and an app that accepts a non-default external port. |
| Private access to your own devices | Usually no | An authenticated private mesh VPN is generally safer and easier than exposing SSH, RDP, NAS administration, or a dashboard on a public port. |
For a torrent client, use the exact port assigned by the replacement VPN as the client's listening port. Follow the qBittorrent configuration guide.
Current products with an inbound-port feature
Mullvad Alternatives for Port Forwarding
No single alternative reproduces every historical Mullvad behavior. Compare the current assignment model against your application: a random single port is enough for many torrent clients, while games and self-hosted services may need chosen numbers, several ports, or persistence.
PureVPN
Multiple selected portsOffers port forwarding as an add-on and documents selected-port controls in supported locations. Verify the present add-on terms, maximum mappings, operating system, protocol, and server country before paying.
Best fit: A small known set of ports when the application cannot follow one random assignment.
Check current offerProton VPN
Provides one active random forwarded port on eligible paid plans and P2P servers through supported Windows, macOS, and Linux apps. The number normally changes when the VPN reconnects.
Best fit: qBittorrent or another application that can accept one session-specific listening port.
Check current offerPrivate Internet Access
Provides an assigned port in supported server locations and documents both app and manual-script approaches. Region eligibility and assignment-lease behavior matter.
Best fit: One configurable incoming port for users willing to select an eligible region and maintain the assignment.
Check current offer| Your requirement | Likely fit | Why |
|---|---|---|
| Several selected or fixed port numbers | PureVPN add-on | This is the closer match among these options when one provider-assigned random number is insufficient. Verify the current port maximum and locations. |
| One configurable torrent listening port | Proton VPN or PIA | Both can assign an inbound port in supported setups. Copy the active value into the client and update it when the session changes. |
| A stable public production service | VPS or documented persistent endpoint | A session-specific VPN port is fragile for URLs, certificates, monitoring, and uptime. A VPS or reverse tunnel may be a better architecture. |
| Private access to your own devices | Private mesh VPN | Authenticated device-to-device networking avoids opening a public administrative service at all. |
Port-forwarding support can differ by plan, platform, protocol, app version, server region, and add-on. Policies also change—the Mullvad shutdown itself is proof. Verify the exact setup you need in current provider documentation before starting a long subscription.
How to Replace Mullvad Port Forwarding Correctly
Switching the VPN does not configure the application automatically. The assigned port, local listener, firewall, protocol, server session, and external test must all match.
- 1
Inventory the required ports and protocols
List the application's TCP and UDP requirements, how many simultaneous ports it needs, whether its listening number can change, and whether a persistent public endpoint is necessary.
- 2
Check the current provider support matrix
Confirm eligible plans, operating systems, apps, VPN protocols, regions, port counts, assignment lifetime, and add-on cost. Prefer the provider's live help center over screenshots from a review.
- 3
Connect to an eligible server and request a port
Enable the feature through the supported app or provider workflow, select a compatible location, and copy the exact current assignment. Do not reuse a former Mullvad port number.
- 4
Match the application's listening port
Set the destination application to the assigned value. Disable random-port-on-startup when it would break the mapping. A VPN-side forward does not require the same rule on your home router.
- 5
Permit the narrow local inbound path
Allow only the destination application or exact port on the active VPN interface. Avoid disabling the whole firewall or placing the computer in the router's DMZ.
- 6
Test from an external network
Keep the service running and target the replacement VPN's current exit address and assigned port. Use a real UDP client for UDP-only services and retest after changing server or reconnecting.
How to Confirm the New Port Is Reachable
A checker only reports the result of one attempt. Confirm the environment first so a closed result points to a real mismatch instead of an inactive service.
- The destination app is running and listening on the assigned number. An open mapping with no listener can still appear closed.
- The external test targets the current VPN exit IP—not your ISP address, old Mullvad address, or private LAN address.
- The assignment belongs to the active VPN session and eligible region. A reconnect or expired lease may require a new port.
- The validation matches TCP or UDP as the service actually uses it. A web-based TCP probe cannot validate a UDP-only game listener.
Opening a Port Also Opens an Attack Surface
The replacement VPN hides your home address but exposes the selected application through its own public endpoint. Keep the service patched, require strong authentication, restrict permissions, remove unused mappings, and bind traffic to the intended VPN interface when possible.
Never publish router administration, RDP, a database, or an unauthenticated control panel merely for convenience. For access limited to your own devices, use an authenticated private network instead of a public forward.
Mullvad Port Forwarding FAQ
Official Sources and Verification
The removal dates and product claims here are based on provider documentation. Recheck these primary sources because features, eligible regions, and plan terms can change.
The Honest Recommendation
Keep Mullvad if you do not require inbound VPN reachability and prefer its other characteristics. If one reachable port is a hard requirement, there is no setting left to unlock—switch to a provider whose current assignment model matches your application, or use a VPS/private-network architecture when stability or private access matters more.