Stopping app and daemon does not stop local network restrictions + strange port requirements + account number is shown

[AgsItllsdbDhh7SvK7vo]

Is it a bug?

• I know this is an issue with the app, and contacting Mullvad support is not relevant.

I have checked if others have reported this already

• I have checked the issue tracker to see if others have reported similar issues.

Current Behavior

There are 3 major issues with Mullvad App for Windows that I can detect:

1. By default local network sharing is disabled within Mullvad's app for Windows and if I don't enable it, quit the app, and stop the daemon service/process, then local network sharing disablement remains active, which (aside from preventing to use local network) prevents me from launching other VPN interfaces from other apps. Why? Is there no way to force-shut-down Mullvad App for Windows manually? I assume this happens because Mullvad App for Windows comes with its own firewall module. Is there a way to disable that module or not use it for those who manually create rules within Windows firewall?

2. There is a strange port requirement for Windows. Even I don't use SOCKS proxy and/or bridges to reach out to Mullvad API, Mullvad App for Windows refuses to create VPN connections unless outbound TCP ports 1082 and 1337 are left open. That prevents me from connecting in restrictive networks, where only UDP port 53, TCP port 80, and TCP port 443 are allowed. Such is the case for Windows, but not Mullvad's Android app, which works just fine in mentioned restrictive networks.

3. Mullvad's App for Windows shows account number in clear-text instead of using "*" like it does on Android (for first 12 digits anyway). Why? Android app seems to get the attention and get audited, but why so little love for Windows App?

Expected Behavior

1. Shutting down Mullvad App for Windows + Mullvad-Daemon.exe should disable whichever leak protections and custom firewall module from functioning.

2. TCP ports 1082 and 1337 should not be mandatory for neither logging in nor creation of VPN interface if SOCKS and/or bridges are not used to connect to Mullvad API.

3. Hide the account number (at least the first 12 digits like on Android, but preferably the whole thing).

Steps to Reproduce

1. Keep Local Network Sharing disabled within Mullvad's App for Windows, quit the app itself + manually shut-down Mullvad-Daemon.exe. See if your local network connections work.
2. Disable outbound TCP ports 1082 and 1337 and see if you can still establish a VPN connection on Windows using Mullvad's App for Windows.
3. Utilize eyes when logging in to your account on Windows via Mullvad's App for Windows to witness your account number in clear-text.

Failure Logs

Operating system version

Windows 11 25H2

Mullvad VPN app version

2026.3

Additional Information

Please ask and I'll try to provide.

[dlon]

By default local network sharing is disabled within Mullvad's app for Windows and if I don't enable it, quit the app, and stop the daemon service/process, then local network sharing disablement remains active, which (aside from preventing to use local network) prevents me from launching other VPN interfaces from other apps. Why? Is there no way to force-shut-down Mullvad App for Windows manually? I assume this happens because Mullvad App for Windows comes with its own firewall module. Is there a way to disable that module or not use it for those who manually create rules within Windows firewall?

Do you have lockdown mode enabled? If you disable that, then you should be able to stop the service without blocking anything.

There's no way to override the app firewall, unfortunately. We are not necessarily entirely opposed to adding that option, but we'd have to consider the implications carefully.

There is a strange port requirement for Windows. Even I don't use SOCKS proxy and/or bridges to reach out to Mullvad API, Mullvad App for Windows refuses to create VPN connections unless outbound TCP ports 1082 and 1337 are left open. That prevents me from connecting in restrictive networks, where only UDP port 53, TCP port 80, and TCP port 443 are allowed. Such is the case for Windows, but not Mullvad's Android app, which works just fine in mentioned restrictive networks.

Port 1337 does need to be allowed on the tunnel interface if DAITA or quantum-resistant tunnel is enabled. This is only inside the tunnel, though. It should not be a problem if the network you are on blocks it, but it cannot be blocked in Windows Firewall if either of those features is enabled.

Port 1082 is used by one of the API access methods (encrypted DNS proxy). When I tried this myself, it did break that specific API access method, but not connecting or the app in general. Does blocking only that port prevent connecting for you? If so, could you please send us a problem report?

Mullvad's App for Windows shows account number in clear-text instead of using "*" like it does on Android (for first 12 digits anyway). Why? Android app seems to get the attention and get audited, but why so little love for Windows App?

This is fair. The desktop app should do this as well.

[linear-code]

DES-3143