Mullvad VPN on Ubuntu Server

VPN Split Tunnel

Split Tunnel allows routing some application or device traffic through an encrypted VPN while letting other applications or devices have direct internet access. This is especially useful for services that don't work as expected with a VPN.

VPN Split Tunnel for NTP service systemd-timesyncd

systemd-timesyncd daemon is responsible for synchronizing the server's time with accurate world time based on the set time zone. Proper functioning of this daemon is crucial for all time-dependent services, including 2-factor authentication (2FA) to access the server.

• Check timedatectl Status

  timedatectl status - check systemd-timesyncd daemon status

  The output includes various time-related information. Key lines are NTP service with active status (you can activate it with timedatectl set-ntp true ) and then the line System clock synchronized with a value of yes. However, the yes status might be odd in the case of using a VPN - it could be from the time before VPN activation. The issue is that the VPN might block access to NTP servers, preventing time synchronization.

• Check systemd-timesyncd Service Status

  You can check the service status with systemctl status systemd-timesyncd. The key value of interest is Status. The "Initial synchronization to time server ..." status is normal and indicates functioning. The status also includes the IP address of the NTP server used for time synchronization. The Idle. status is problematic.

• Test Access to NTP Server IP

  You can also get the NTP server's IP from the timedatectl timesync-status command, which shows detailed time values related to accuracy on the server. The NTP server's IP used by the service is under the Server key. You can test access to the server's IP using the ping command, for example, ping 8.8.8.8. If you can successfully ping the NTP server's IP, everything is fine.

• Setting Up Split Tunnel for VPN When NTP Server Can't Be Pinged

  • Split tunnel needs to be addressed for NTP server if:
    • timedatectl status shows "System clock synchronized: no"
    • systemctl status systemd-timesyncd shows "Status: Idle."
    • you can't ping the NTP server

    You can activate Split Tunnel for any service on the server based on its pid. You can get the PID using the systemctl status systemd-timesyncd command, where the pid number is under the Main PID key.

  • Insert the service's pid into the Mullvad VPN client with:
    
    Ver 2023.6 +
    mullvad split-tunnel add <pid>
    Prior ver
    mullvad split-tunnel pid add <pid>

    Afterward, the service should be excluded from the VPN through Split Tunnel. Check the service status again with systemctl status systemd-timesyncd. The ping will still be unsuccessful as it's being done from your account, not the excluded service's account.

    • Setting the tunnel to start automatically on Ubuntu OS start

  • Additional Useful Commands:

    Ver 2023.6 +
    • mullvad split-tunnel list - Display all excluded services from VPN
    • mullvad split-tunnel delete <pid> - Revert a previously excluded process from VPN
    • mullvad split-tunnel clear - Restore all previously excluded processes
    Prior ver
    • mullvad split-tunnel pid list - Display all excluded services from VPN
    • mullvad split-tunnel pid delete <pid> - Revert a previously excluded process from VPN
    • mullvad split-tunnel pid clear - Restore all previously excluded processes
  • Other commands

Automatic Time Synchronization Check and Split Tunnel Setup for Mullvad VPN When Time is Not Synchronized

Below is the procedure for creating a mechanism where, upon system startup and subsequently at regular intervals, a check of the system time synchronization status occurs. If the time is not synchronized, the VPN tunnel splitting for the time server managing service is set.

The procedure below determines the PID of the systemd-timesyncd service and subsequently exempts this service from traffic going through the VPN.

1. Create a file set_mullvad_split_tunnel.sh

   sudo nano /usr/local/bin/mullvad_split_tunnel_setup.sh

   Copy the code below into the file

   #!/bin/bash
   # check sync status of timedatectl
   sync_status=$(timedatectl status | grep -oP 'System clock synchronized: \K\w+')
   
   if [[ $sync_status == "no" ]]; then
       # system time is not synchronized - set split tunnel for systemd-timesyncd service
   	
   	# Get PID of systemd-timesyncd
   	SERVICE_PID=$(pgrep -f systemd-timesyncd)
   
   	if [[ ! -z "$SERVICE_PID" ]]; then
   		# Add PID to Mullvad split tunnel configuration
   		mullvad split-tunnel add $SERVICE_PID
   		echo "New VPN Split tunnel was set for PID $SERVICE_PID"
   	else
   		echo "Failed to get PID of systemd-timesyncd."
   	fi
   else
       echo "System time is synchronized, no need of setting VPN split tunnel"
   fi

   Set file permissions to execute

   sudo chmod +x /usr/local/bin/mullvad_split_tunnel_setup.sh

2. Create a systemd service file servertime_sync_check.service, through which the script mullvad_split_tunnel_setup.sh will be executed

   sudo nano /etc/systemd/system/servertime_sync_check.service

   Copy the code below into the file

   [Unit]
   Description=Check time synchronization and setup Mullvad VPN split tunneling if needed
   
   [Service]
   Type=oneshot
   ExecStart=/usr/local/bin/mullvad_split_tunnel_setup.sh
   
   [Install]
   WantedBy=multi-user.target

3. Create a timer service servertime_sync_check

   sudo nano /etc/systemd/system/servertime_sync_check.timer

   Copy the code below into the file

   [Unit]
   Description=Timer to regularly check time synchronization
   
   [Timer]
   # Run it in 30 minutes interval
   OnCalendar=*:0/30
   Persistent=true
   
   [Install]
   WantedBy=timers.target

4. Reload the changes into the system

   sudo systemctl daemon-reload

5. Enable automatic start of services at computer startup

   sudo systemctl enable servertime_sync_check.service
   sudo systemctl enable servertime_sync_check.timer

6. Start the servertime_sync_check.timer service

   sudo systemctl start servertime_sync_check.timer

   The servertime_sync_check.service does not need to be started manually. It is triggered by the servertime_sync_check.timer. Since the directive Persistent=true is used, if any checks were missed (for instance, if the computer was turned off at the time), the check will be performed as soon as the computer starts.

7. Check the service logs

   journalctl -u servertime_sync_check.service