Mullvad unveils GotaTun, its own Rust-based WireGuard implementation

Mullvad VPN has introduced GotaTun, a new Rust-based WireGuard implementation designed to improve stability, efficiency, and cross-platform integration.

The tool replaces the legacy Go-based implementation, wireguard-go, and is part of Mullvad’s ongoing push toward a Rust-dominant codebase for improved performance and reliability.

Introducing GotaTun

GotaTun is a fork of BoringTun, Cloudflare’s original WireGuard implementation in Rust, but it has been customized by Mullvad to include support for advanced privacy features such as DAITA (Device-Aware IP Traffic Allocation) and Multihop. The name “GotaTun” pays homage both to its codebase origins and to the Götatunneln tunnel in Gothenburg, Sweden, where Mullvad is headquartered.

Mullvad VPN is a privacy-focused VPN provider known for its strict no-logs policy and strong emphasis on open-source software. Unlike most commercial VPN services, Mullvad does not require email addresses or personal information to create an account. Its software stack and client apps are largely open-source and independently audited. The company has long embraced WireGuard as a superior tunneling protocol, adopting it back in 2017 and now doubling down by fully transitioning away from OpenVPN.

The development of GotaTun began after years of friction with wireguard-go, which had been the default userspace WireGuard implementation in Mullvad’s mobile apps. Mullvad reported that over 85% of crash reports for their Android app originated from wireguard-go, often stemming from hard-to-trace issues due to the complexities of integrating Go and Rust. Because Go uses a managed runtime, cross-language debugging has been cumbersome, particularly in recovering stack traces or pinpointing memory issues via FFI (foreign function interface) boundaries.

The performance difference since migrating to GotaTun has been significant. According to internal telemetry, Mullvad saw the user-perceived crash rate on Android drop from 0.40% to 0.01% after introducing GotaTun in version 2025.10 of the app. This shift also brought improvements in connection speed and reduced battery usage.

GotaTun availability

The GotaTun codebase, hosted on GitHub, is available under a permissive 3-Clause BSD license. It supports a wide range of platforms and architectures, including Linux (x86_64, aarch64, armv7), macOS, Windows, iOS, and Android. Unlike wireguard-go, GotaTun is natively written in Rust, enabling safer memory handling through zero-copy strategies and multi-threading without compromising performance. Linux users should note that GotaTun drops privileges by default and requires elevated capabilities (via setcap) to manage tunnel interfaces.

For now, GotaTun is only integrated in the Android app, released in late November 2025. A full transition of all Mullvad platforms, including iOS and desktop clients, is planned for 2026. Additionally, a third-party security audit is scheduled for early next year.

For users currently on Android, no action is needed, as GotaTun is already integrated into the latest app releases. On desktop and iOS, users should expect updates in 2026 as GotaTun replaces wireguard-go. Mullvad users running self-hosted setups or routers are encouraged to test GotaTun via the GitHub repository.

The timing of GotaTun’s release also aligns with Mullvad’s broader deprecation of OpenVPN support. As of version 2025.14, OpenVPN has been removed from the Mullvad desktop client. The change follows a year-long notice period and reflects the maturity of WireGuard, which now supports multiple anti-censorship modes, including UDP-over-TCP and Shadowsocks, that were once exclusive to OpenVPN. Mullvad users relying on OpenVPN-based configurations in external routers or third-party apps will need to complete their migration by January 15, 2026, when remaining OpenVPN servers will be decommissioned.