Thanks @Mapybara, my firewall was blocking ports mullvad tried to use.
However, I’m surprised that it if mullvad is enabled as a service (services.mullvad-vpn.enable = true; it doesn’t get ports open automatically. Also it is strange that mullavad status reports connection even if it is actually blocked.