this post was submitted on 27 Sep 2025
37 points (97.4% liked)

Selfhosted

51782 readers
1240 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

I set up Wireguard on my phone, server, and computer to let my phone access my home network when I'm outside of it.

It works for the most part, but the inconvenient thing is that on Android you can only have 1 VPN running at a time. I want to use Mullvad VPN for the rest of my network connections for privacy.

I could make a single Wireguard config that defines 2 peers to connect to mullvad and my home VPN at the same time, but by doing this, I lock myself to a single server without the benefits of being able to swap servers at the same time.

Locking myself to a single mullvad server results in:

  • less privacy, since my IP is more static
  • inability to switch to bypass a VPN block

On desktop, I can have multiple wireguard VPNs at once, but if I have both running at the same time, then my LAN is accessed over the home VPN which is routed through Mullvad VPN. It goes

Computer -> Mullvad server -> Home VPN -> Home server

which is pretty wasteful.

Additionally, I'd prefer not to not do something like: Phone -> Home VPN -> Mullvad server -> destination, as my upload speed is pretty bad and this would throttle every non-local connection

What options do I have?

top 14 comments
sorted by: hot top controversial new old
[–] masterofn001@lemmy.ca 2 points 38 minutes ago* (last edited 37 minutes ago)

You would maybe need to configure separate virtual interfaces for each VPN. And do some routing or a local redirecting proxy (tinyproxy is easy) to ensure things go where you want.

On android there are things that allow you to send traffic to different vpns or proxies by setting listening ports. Something like sagernet or proxychainNG or nekobox.

[–] ohshit604@sh.itjust.works 1 points 2 hours ago* (last edited 1 hour ago)

I’m a bit confused on this comment here:

Additionally, I'd prefer not to not do something like: Computer -> Home VPN -> Mullvad server -> destination, as my upload speed is pretty bad and this would throttle every non-local connection

Because you also mention this:

Computer -> Mullvad server -> Home VPN -> Home server

Which would be the same thing, no? You’re just making a connection to the Mullvad server first then your home network?


I’ll share my experience but it looks like it’s not the solution you’re looking for, I opted to use my Asus WRT Router w/ Merlin Firmware to host my VPN server, the Merlin Firmware lets me connect to 5 different VPN clients at a time, in my case 4 different Proton clients and a buddies server, I use the “VPN Director” feature to route my VPN Server through one of the 5 different clients effectively creating the multi-hop.

I personally haven’t noticed much degradation in regard to connection speeds but at the same time I don’t constantly hop VPN clients or have the same internet speeds as you, I typically stick with the server closest to me.

Edit: To help visualize what i mean:

[–] artiman@piefed.social 3 points 6 hours ago

tailscale has Mullvad add-on, but it's a paid add-on, you can self-host tailscale with headscale

[–] Vanilla_PuddinFudge@infosec.pub 6 points 8 hours ago* (last edited 8 hours ago) (2 children)

"WG Tunnel" on f-droid lets you define a config/native for either mobile or wifi, whichever you want.

two configs on both? It does that. A config on one and nothing on the other? It does that. It swaps whenever your phone moves from mobile to wifi or vice versa.

if neither is selected, it considers it "both".

[–] non_burglar@lemmy.world 1 points 4 hours ago

I use WG tunnel, but the "turn on under X condition" doesn't work for me.

[–] Xylight@lemdro.id 4 points 8 hours ago (1 children)

If it turns on with mobile data automatically, that turns off my Mullvad VPN.

[–] Vanilla_PuddinFudge@infosec.pub 1 points 2 hours ago* (last edited 1 hour ago)

The tailscale method, bake it yourself. It's all routing-based.

If you have a remote VPS and a home wireguard server and both are connected, then you have a remote connection outside of your home network. Make it a transit router. Then you'll have your mesh and your VPN all in one, even if it's still just all you.

Go a step further and connect mullvad to the vps and do a little routing work.

As for what routing work specifically, I couldn't begin to tell you. Ai and some search-engine-fu might be necessary.

Here's a (similar) example, even if he's doing it backwards to my suggestion:

https://superuser.com/questions/1776851/routing-wireguard-peers-traffic-via-another-peer

[–] portnull@lemmy.dbzer0.com 1 points 6 hours ago

I have something like this with tail scale. My homeserver has a tail scale docker as well as a docker tail scale. The docker tailscale advertises itself as an exit node. The tailscale docker is gluetunned to an extern wireguard server (your mullvad for example) Now I can connect to my home net with tailscale and toggle the exit node on and off. By adding a different tailscale container with a different wire guard exit you could just toggle the exit node like that.

Seeing as you are using mullvad you could also just pay the monthly sub to tailscale and they connect your tailnet directly to mullvad

[–] kyle@europe.pub 1 points 6 hours ago

I’m pretty sure Tailscale would be a perfect solution here.

[–] LodeMike@lemmy.today 1 points 7 hours ago

You could use the Mullvad given configuration and then also make a peer to your home network, but you're given a specific LAN IP address from Mullvad.

[–] AbsolutelyNotAVelociraptor@sh.itjust.works 2 points 7 hours ago (1 children)

Why don't you just use Shelter to create a work profile on your phone? The work profile can have a second vpn connection. I do this with my homeserver. The apps that connect to the home server are installed in the work profile so they have permanent access to the homeseraer while the normal profile is on my external vpn.

[–] acid_falcon@lemmy.world 1 points 7 hours ago (1 children)

This is so close to what I need. Unfortunately I have a self hosted bitwarden, and when the app is installed it doesn't auto fill passwords in apps to the other account

[–] AtariDump@lemmy.world 0 points 3 hours ago (1 children)

Why not just pay for Bitwarden.

[–] acid_falcon@lemmy.world 1 points 2 minutes ago

Uh. You know you're responding in a self hosting community right? Should I explain why we're all here?