Earlier this year, Mullvad VPN announced that its client will no longer support port forwarding. Customers will also lose access to any existing ports on July 1st of 2023. This change will affect a large number of users, including gamers, people who torrent, and those who host a server or website behind a VPN.
Port forwarding is often a point of confusion for computer users. But the basic premise is pretty simple. By default, your router’s firewall prevents other people from remotely accessing your home network. When you need to facilitate a remote connection, you use port forwarding to create an exception in your firewall.
Let’s pretend you’re hosting a Minecraft server or Plex server in your home. If you want to share this server with people outside of your home (or if you want to access the server while traveling), you need to use port forwarding—this is true whether or not you use a VPN. And while port forwarding isn’t explicitly required for gaming or torrenting through a VPN, it’s the only way to ensure a speedy and reliable experience.
So, why is Mullvad abandoning port forwarding? The answer is a bit simpler than you’d expect—first, Mullvad VPN’s purpose is to protect user privacy and security. Port forwarding creates an exception in your firewall that other people can exploit, and it can make your VPN less effective at concealing your identity. By removing port forwarding from its client, Mullvad may protect some users. (On the other hand, those who use port forwarding should know and accept the risks. And it’s rarely a major security concern.)
Mullvad has taken some strange steps in the name of privacy and security. It stopped accepting subscriptions to reduce the paper trail of its users, for example. But this leads Mullvad to its second reason for ditching port forwarding—bad actors are taking advantage of the feature.
As explained in the Mullvad blog, “individuals have frequently used [port forwarding] to host undesirable content and malicious services.” Presumably, some customers are utilizing this feature to distribute CSAM or host private CSAM websites, though to be crystal clear, I’m just making an educated guess.
Because of the illicit activity of some users, Mullvad has come under the ire of law enforcement, and some of its IPs have been blacklisted, which reduces the VPN’s usability for customers who aren’t doing anything wrong.
So, there’s a legal element here. And that’s understandable. The majority of Mullvad VPN users just want to protect their privacy while browsing online and are not using the port forwarding feature. If Mullvad were to continue offering port forwarding, it would jeopardize its ability to serve any customers.
But many users will need to switch VPN providers if they want to continue using port forwarding. Unfortunately, some of the best VPN options, including NordVPN, do not offer this feature. For what it’s worth, you can contact support@mullvad.net for a partial refund on your credits.
Source: Mullvad VPN via TechRadar
