Proton's Linux CLI Arrives, Still Behind Mullvad (and why)

Proton VPN announced their Linux CLI in beta this week. The feature list reads like something from 2020: WireGuard support, server selection by country, and the ability to connect and disconnect. If you want to change settings, you edit config files manually like it's 1998, and the entire feature set stops there missing kill switches, split tunneling, port forwarding, and every other feature that makes a VPN actually useful.

The announcement positions this as innovation, but Mullvad shipped a mature Linux CLI years ago with every feature Proton's roadmap promises to maybe deliver someday. Mullvad includes automatic kill switches, split tunneling since 2020, and multihop configurations through their CLI, while Proton's beta gives you WireGuard connectivity and a prayer that nothing leaks.

The timing makes this funnier. In September 2025, Mullvad launched QUIC obfuscation for WireGuard on desktop platforms, followed by mobile support in October 2025. QUIC tunnels WireGuard traffic through the QUIC transport layer using the MASQUE protocol (RFC 9298), making VPN connections look like standard HTTPS traffic. Firewalls and censors can't distinguish it from regular web browsing, which matters in countries with aggressive VPN blocking, and it works right now in Mullvad's production clients. Meanwhile, Proton just implemented WireGuard support, congratulations on adopting the protocol everyone else standardized on four years ago.

The privacy model difference cuts deeper than features. Mullvad's signup process generates a random 16-digit account number, which serves as your only identifier. Their system doesn't ask for email addresses, usernames, passwords, phone numbers, or any personal information because their architecture makes it impossible to connect your payment to your traffic even if they wanted to cooperate with authorities. Their no-logs policy survived actual police raids where authorities left empty-handed because there was nothing to findif you lose your 16-digit number, your account is gone forever because there's no recovery mechanism tied to your identity.

Proton requires email addresses for account creation unless you're on Android and use their guest mode, which they've limited to one platform for reasons they don't explain convincingly. Their human verification system triggers email or SMS verification, and while they claim to only store cryptographic hashes, you're still providing identifying information to a VPN provider. Their privacy policy explicitly states they may keep IP logs temporarily for "abuse prevention" at the account level and will retain those logs permanently if they decide you violated their Terms of Servicethis refers to account access logging, not VPN connection traffic which their audits verify as no-logs. Mullvad's approach differs fundamentally they don't know who you are, so they can't log you even when governments show up with warrants demanding user data.

The payment methods illustrate this philosophy gap. Mullvad accepted Monero in May 2022, and Monero transactions are completely private with no public blockchain, no wallet balance visibility, and no transaction tracing.

You can also mail them cash without a return address, creating zero financial trail connecting you to your VPN usage. Proton accepts credit cards, PayPal, and Bitcoin, but Bitcoin's public ledger makes every transaction traceable unless you're running it through mixers, which adds complexity most users won't bother with.

The technical implementation matters too. Mullvad's CLI integrates with Linux system firewalls using nftables for proper leak protection. Their kill switch activates automatically when connecting and includes a Lockdown mode that blocks all internet traffic until you establish a VPN connection, while Proton's beta lacks any of these protections and leaves you manually ensuring nothing leaks.

Mullvad's split tunneling launched on Linux in 2020, five years before Proton's beta appeared. It works through their CLI and lets you exclude specific applications from the VPN tunnel. Proton's beta doesn't support this, and their roadmap suggests it's a "future feature" alongside all the other standard functionality their competitors shipped before the pandemic.

The pricing model reflects these priorities. Mullvad charges €5 per month (roughly $5.30) for everything with no tiers, no upsells, and no premium features locked behind higher prices. Every subscriber gets the same service whether they pay in Monero, mail cash, or use a credit card. Proton offers a free tier (admirable) but their Plus plan costs $9.99 monthly, and you need it for features like country selection and higher speedsyou're paying nearly double for a service that requires more personal information and delivers fewer privacy guarantees.

Proton's independent audits verify their no-logs claims, which beats services that refuse third-party verification. But there's a difference between passing an audit and being unable to log users because your architecture makes identification impossible. When police raided Mullvad's offices, they found nothing because there was nothing to find. When you design anonymity from the start instead of bolting it onto an email-based account system, you get different results.

The beta status excuse doesn't hold up either. Proton's been running VPN services for years, so releasing a CLI tool without kill switches or leak protection means shipping incomplete software and calling it innovation. Mullvad's CLI documentation covers quantum-resistant key exchange, DNS leak protection, IPv6 support, and bridge configurations, while Proton's beta connects you to a server and leaves you hoping they'll add protection mechanisms later, assuming they get feedback that users want their VPN to actually protect them.

The Android-only guest mode is particularly telling. If anonymous usage without accounts is technically possible on one platform, why limit it?

Encrypted email and messaging systems like Protonmail, Signal, etc provide privacy??

HahahahahahHa .....

Wake the fuck up people! pic.twitter.com/RNU5hZnAgu

— John McAfee (@officialmcafee) January 18, 2020

The obvious answer is that Proton's business model ties services together through email-based accounts, making genuine anonymity architecturally incompatible with how they operate. Mullvad built around anonymity from day one, while Proton built an email service, then added VPN, and now they're trying to retrofit privacy into a system designed for user identification.

The QUIC obfuscation gap will matter more as VPN blocking becomes sophisticated. China's Great Firewall and similar systems actively detect and block VPN protocols. Mullvad's QUIC implementation tunnels WireGuard through what looks like standard HTTPS connections, making detection dramatically harder though China began blocking QUIC traffic in April 2024, it still helps bypass less sophisticated censorship systems.

Proton's CLI offers no obfuscation, or protocol flexibility beyond WireGuard, and no roadmap item suggesting they're working on it. When your government decides to block VPNs, Mullvad users at least have QUIC as an option while Proton users have nothing.

The competitive landscape makes Proton's announcement even stranger. They're catching up to a competitor who's already moved on to solving harder problems. Mullvad's working on post-quantum cryptography and improved multihop routing while Proton's announcing they can now select servers from a terminal.

Proton VPN's free tier provides value, and their integration with Proton Mail and other services appeals to users who want a unified ecosystem. But positioning a bare-bones beta CLI as noteworthy when a cheaper competitor has been delivering superior privacy and features for years is absurd. The privacy community doesn't need another VPN provider promising to add important features later we have one that shipped them years ago and kept improving.

If your threat model requires actual anonymity where even the VPN provider can't identify you if they're compromised or compelled, Mullvad's architecture delivers what Proton's fundamentally cannot. If you want modern anti-censorship tools like QUIC obfuscation, Mullvad shipped that in 2025 while Proton's still figuring out config files. If you want a mature Linux experience with proper leak protection and split tunneling, Mullvad's CLI has offered that since before COVID.

Proton's beta announcement essentially says "we built a basic version of what our competitor perfected years ago, it lacks critical features, and we need your email address"marketing all sold as progress.

Some of us don't have email addresses in VPN databases. We have 16-digit numbers we paid for with Monero, running QUIC obfuscation through kill-switched connections that split-tunnel specific applications while blocking all traffic if the VPN drops. Mullvad's had split tunneling and kill switches since 2020, with QUIC arriving in 2025 the future of privacy VPNs already exists, and they built it years ago.

Fuck Proton.