Your Mullvad. Your Proton.
Every device in your home.
Upload your provider's WireGuard config to one host at home, flip the toggle, and every device on your network inherits the upstream. Stop installing Mullvad on every phone.
Bring the VPN you already pay for
BYO Exit is for people who already trust a provider and want it everywhere without hand-installing the app on every device.
Home users
Privacy-conscious households already paying for Mullvad, Proton, or Azire. Upload once, cover every screen in the house.
Developers
You want your laptop to "look like" a specific city for geo-testing. Upload a config per region and switch exits from the dashboard.
Travelers
Want your traffic to come out of your home country while you're abroad. Run a host on a home box or a tiny VPS and egress through it.
Small businesses
Need jurisdiction-consistent egress for billing APIs, compliance portals, or regional tooling. One upstream, one source of truth.
What you get today
BYO Exit is live right now with real-time upstream health visibility. Upload a config, activate it on a host, and every route-all client on that host inherits the upstream automatically.
Upload any WireGuard config
Mullvad, Proton, Azire, or a custom self-hosted upstream — anything that gives you a plain wg0.conf. Paste it in, name it, save.
One-click activate per host
Pick the host, pick the exit, click Activate. The host brings up the upstream inside about 30 seconds — no SSH, no config files.
Every device inherits
Flip route-all on a client and by the next heartbeat (~30s) it's egressing through your exit. Add a new device, toggle it on, done.
Real-time health monitoring
Dashboard shows healthy / stale / down / never / unknown states updated every ~30 seconds. Know instantly when your upstream goes down.
Swap without reconfiguring
Upload "Mullvad SE" and "Mullvad DE", switch between them from the dashboard, and every route-all client inherits the change automatically.
Client-side warnings
If the host's upstream is unhealthy, every route-all client on that host shows a warning pill — so you don't have to remember which host routes where.
What BYO Exit is today
BYO Exit ships with real-time upstream health visibility — the dashboard tells you within about 30 seconds when your Mullvad / Proton / custom upstream is healthy, stale, or unreachable. Traffic-level kill-switch enforcement (automatic client traffic blocking when the upstream dies) is on the roadmap.
Today: you know instantly when something is wrong. Not yet: automatic traffic blocking. If you need strict "traffic MUST NOT leak if the VPN dies" guarantees right now, use your provider's native app and revisit wg0 when enforcement ships.
Setup in about five minutes
You need a host machine at home (a Mac mini, a NUC, or a Linux box), a wg0 account, and a WireGuard config from your VPN provider.
-
Sign in and open your home network
Open login.wg0.io and pick the network you want to add BYO Exit to — or create a fresh one in a few seconds.
-
Pick your host machine
Your Mac mini, NUC, or Linux box at home. It needs to be online most of the time — anything you'd comfortably leave running counts. macOS and Linux hosts are supported today.
-
Open Upstream exits on that host
In the host's row, click Upstream exits, then Upload exit. This is the per-host control for BYO Exit — each host can hold multiple uploaded configs.
-
Paste your provider's WireGuard config
Paste the
wg0.confyou downloaded from Mullvad, Proton, Azire, or your own upstream. Give it a friendly name likeMullvad Swedenso you can recognise it in the dashboard. -
Click Activate
Within about 30 seconds the host brings up the upstream tunnel and the dashboard shows a green exit ok badge. If something's wrong with the config, you'll see a clear error here instead of a silent fail.
-
Flip route-all on your devices
On each client you want to egress through the upstream, flip Route all traffic through host to on. One switch per device. No per-device config files, no re-enrollment.
-
Done — confirm on ipinfo.io
Next heartbeat (~30s), the client is egressing through your Mullvad / Proton endpoint. Visit ipinfo.io to confirm the IP and city match your upstream.
-
Swap exits whenever you want
Upload a second config (say,
Mullvad Germany), click activate, and every route-all client on that host inherits it automatically. No client-side changes, ever.
Honest answers about BYO Exit
Is this a kill-switch?
Today BYO Exit is health visibility — the dashboard tells you within about 30 seconds when your upstream is up, stale, or down, and every route-all client on that host shows a warning pill so you know immediately.
Traffic-level kill-switch enforcement — automatically blocking client packets when the upstream dies — is on the roadmap. The dashboard already surfaces upstream health in real time so you know instantly when something needs attention.
What providers work?
Any provider that gives you a plain WireGuard .conf file. We've verified the flow end-to-end on Mullvad. Proton and Azire both ship WireGuard configs too and should work identically. Self-hosted upstreams (your own WireGuard endpoint on a VPS) work fine as well.
Can I use OpenVPN or IKEv2?
No — BYO Exit is WireGuard-only. If your provider only offers OpenVPN or IKEv2, BYO Exit won't help you. Most major privacy VPNs ship WireGuard configs alongside their other protocols, so check your account dashboard.
What if my upstream goes down?
The host reports an unhealthy state within about 30 seconds. The dashboard shows a red exit down badge on the host and a warning pill on every route-all client attached to it.
You switch to a backup exit manually by clicking activate on a second uploaded config. Automatic failover between uploaded exits is on the roadmap.
Does my phone work with this?
Yes. Android now has a managed wg0 app with dashboard-controlled VPN mode and host-exit inheritance. iPhone and other manual mobile peers can still join via QR in the stock WireGuard app, but those provisioned peers do not receive pushed config changes.
Can I run the host on a VPS instead of at home?
Yes. The host just needs to be Linux or macOS — a cheap Hetzner, Hostinger, or DigitalOcean VPS works perfectly. This is a great setup for travelers, or for anyone whose home internet is too variable to trust as an always-on exit.
What about DNS leaks?
Route-all clients keep using their local DNS resolver today. For true provider-level DNS (so queries don't touch your ISP or local network), configure your client device to use your provider's DNS directly — Mullvad, Proton, and others publish the addresses.
Automatic DNS push from the upstream config is on the roadmap.
Stop installing Mullvad on every device
One config upload, one host, one toggle per client. BYO Exit is live today with real-time upstream health monitoring — included on Basic ($10/mo) and every higher tier. Sign up free, then click Upgrade plan to flip it on.