# How to Vibe Code Your Own Mullvad (and Stop Paying for It) > Privacy is for the people - Site: https://mullvad.net - Category: Privacy & Security - Platforms: macOS app, Windows app, Linux app, iOS app, Android app - Verdict: **Impossible** (8/100 vibecodeable) - Estimated effort: 6+ months of full-time systems engineering ## Verdict Keep paying €5/mo. You cannot vibecode a global VPN provider because it requires bare-metal infrastructure in dozens of countries, complex low-level OS firewall manipulation, and strict RAM-only system transparency. While an AI coding agent can spin up a basic Tauri UI or a Next.js account dashboard in minutes, a personal clone of Mullvad fails instantly at the infrastructure and system driver layers. Replicating Mullvad requires writing low-level kernel and daemon code in Rust to interface with the Windows Filtering Platform (WFP) and macOS Network Extension framework for tamper-proof kill switches. More critically, a VPN is entirely defined by its server network—without bare-metal, RAM-only servers distributed globally across trusted hosting providers, you have an app that tunnels traffic nowhere. Paying €5/mo is infinitely cheaper and safer than trying to self-host a private global network. ### What you can't replicate - Global bare-metal RAM-only server fleet across 40+ countries - Tamper-proof OS-level kernel firewall integration for bulletproof kill switches - Anonymous cash-by-mail processing logistics - Battle-tested security audits by third-party firms ## What it does Privacy-focused security service offering an anonymous VPN with WireGuard and anti-censorship features, alongside a privacy-hardened browser. ### Core features - Anonymous account generation (no PII registration) - Cross-platform desktop & mobile client apps - WireGuard cryptographic tunnel handshakes and key management - System-level firewall integration & kill switch (WFP on Windows, Network Extension on macOS) - Anti-censorship bridge modes (Shadowsocks / UDP-over-TCP) - DNS leak protection and custom ad/tracker blocking DNS - Multi-hop routing configuration ## The business ### Pricing - Flat Monthly Rate: €5/mo — One flat rate for ultimate flexibility, whether paying for 1 month or 1 decade. Supports up to 5 devices. ### Funding €0 raised. Founded 2009. Team size: 55-60. ## The hard parts - Low-level OS network filtering and kernel/daemon integration to enforce absolute kill-switches without data leaks - Writing or maintaining cross-platform secure Rust VPN daemons and WireGuard implementations (like GotaTun) - Orchestrating global RAM-only bare-metal server infrastructure with stateless zero-logging architecture - Designing an anonymous billing system that supports physical cash-in-mail and cryptocurrency without customer accounts ## How to vibe code Mullvad ### Prerequisites - Rust Toolchain (free): Required for building low-level WireGuard daemons and system network modules. - GitHub (free): Version control for managing client app source code. ### Recommended AI tools - Claude Code: Handles complex multi-file Rust and system daemon code generation from the terminal. - Cursor: Useful for navigating and editing the Tauri desktop frontend codebase. ### Stack - Frontend: Tauri + React + Tailwind CSS - Backend: Rust (system daemon and WireGuard tunnel management) - Database: SQLite (local account token storage) - Auth: Custom token-based anonymous account generation (no passwords) - Payments: None (personal self-hosted setup) - Other: WireGuard protocol, BoringTun / GotaTun Rust library ### Hosting - Hetzner (Personal self-hosted single-node VPN server endpoint): €4/mo ### Build guide 1. **Scaffold Tauri and Rust Daemon Architecture** — Initialize a cross-platform desktop application shell using Tauri with a Rust backend daemon to manage local network configurations. ``` Create a new Tauri desktop project using React and TypeScript for the frontend, and configure a Rust backend module named 'mullvad_daemon'. Set up IPC bindings between the frontend UI and the Rust core for managing VPN connection state. Ensure the Rust daemon includes structured logging and cross-platform compilation targets for macOS and Windows. Write comprehensive unit tests for the state machine handling disconnected, connecting, and connected phases. ``` 2. **Implement WireGuard Tunnel Management in Rust** — Integrate a Rust WireGuard implementation (such as BoringTun) to handle cryptographic handshakes and virtual network interface creation. ``` Implement WireGuard tunnel initiation inside the Rust backend using the BoringTun crate. Create functions to generate public/private key pairs, establish UDP sockets, perform cryptographic handshakes with a remote VPN server endpoint, and configure a local TUN network interface. Handle network packet encapsulation and decapsulation securely, ensuring clean teardown and error handling when network connections drop. ``` 3. **Build OS Firewall Kill Switch Integration** — Write system-level firewall rules for macOS and Windows to block all unencrypted traffic when the VPN tunnel is inactive. ``` Implement a bulletproof kill-switch module in Rust that interacts with the operating system's native packet filter layer (Windows Filtering Platform / WFP on Windows and Network Extension / pf rules on macOS). When the VPN connection is activated, configure the firewall to drop all outbound traffic except traffic destined for the authorized VPN server IP over the physical gateway. Ensure that if the VPN tunnel drops unexpectedly, the kill switch locks down all internet connectivity until re-established or explicitly disabled. ``` 4. **Develop Anonymous Account & Settings UI** — Build a minimalist React frontend mimicking Mullvad's account management and server selection interface. ``` Build a clean, privacy-focused desktop UI in React using Tailwind CSS that matches Mullvad's dark theme aesthetic. Implement screens for generating a random 16-digit account number locally, checking account expiration status against a self-hosted API endpoint, viewing active device lists, and toggling advanced settings like DNS leak protection, quantum-resistant keys, and bridge modes. ``` ### Cost vs paying **Starting costs (one-time):** - Hetzner VPS (Personal VPN Node): €4/mo - Total: ~$24 one-time + monthly **Ongoing costs (monthly):** - Self-hosted VPS Server: €4/mo - Total: €4/mo - Paying for the SaaS instead: €5/mo - Build time: 120+ hours - AI tool credits: $20 - Break-even: Never (commercial VPN is cheaper and globally distributed) ## Sources - [Mullvad Net Home Page](https://mullvad.net) - [Mullvad Pricing](https://mullvad.net/pricing) - [Mullvad About](https://mullvad.net/about) - [Mullvad Help & FAQ Center](https://mullvad.net/help)