cuckoo --run vivaldi

ERROR setnamespace: Cannot open directory '/etc/netns/aircuckoo': No such file or directory

cuckoo: error while loading shared libraries: libxml2.so.2: cannot open shared object file: No such file or directory

aircuckoologs bluetitlogs

log messages

ERROR: Reached end of AirVPN server list. No suitable server found.

ERROR setnamespace: Cannot open network namespace 'aircuckoo': No such file or directory

  GNU nano 8.7.1                                                                             /home/x/.config/goldcrest.rc                                                                                       
#
# goldcrest runcontrol file
#

#air-server            Kruger Praecipua Sneden Superba Meridiana Fang Sadalsuud
# air-vpn-type          <openvpn|wireguard>
# air-tls-mode          <auto|auth|crypt>
# air-ipv6              <on|off>
# air-6to4              <on|off>
air-user              myusername
air-password          mypassword
# air-key               <name>
air-white-server-list         Kruger Praecipua Sneden Superba Meridiana Fang Sadalsuud
# air-black-server-list         <server list>
# air-white-country-list        <country list>
# air-black-country-list        <country list>
# cipher                <cipher_name>
# proto                 <udp|tcp>
# server                <server_ip|server_url>
# port                  <port>
# tcp-queue-limit       <n>
# mtu                   <n>
# ncp-disable           <yes|no>
# network-lock          <on|iptables|nftables|pf|off>
# allow-private-network <yes|no>
# allow-ping            <yes|no|input|output>
# allow-ipv6ndp         <yes|no>
# ignore-dns-push       <yes|no>
# allowuaf              <yes|no|default>
# timeout               <seconds>
# compress              <yes|no|asym>
# proxy-host            <host_ip|host_url>
# proxy-port            <port>
# proxy-username        <proxy_username>
# proxy-password        <proxy_password>
# proxy-basic           <yes|no>
# alt-proxy             <yes|no>
# persist-tun           <on|off>
# async                 <on|off>
# conn-stat-interval    <seconds>

airconnectatboot                  quick
networklockpersist                on
airusername                       <redacted>
airpassword                       <redacted>
airkey                            Laptop
forbidquickhomecountry            on
country                           us
tunpersist                        on
networkcheck                      off
allowprivatenetwork               on
allowping                         off
ignorednspush                     off
allowtrafficsplitting             on
trafficsplitfirewall              on

1. When 'networkcheck' was 'on' (the default value), the bluetit.service got stuck waiting for the network ('systemctl status bluetit' printed something along the lines of "waiting for network" over and over again)
   Now that it's set to 'off' everything works as expected.
2. Traffic splitting doesn't work. I suspect this has to do with Fedora restricting user namespaces (or something like that). I'm not very familiar with that.
   When I run 'cuckoo -r bash' I get this output: 

   ERROR setnamespace: Cannot open directory '/etc/netns/aircuckoo': No such file or directory

   Or maybe it's something completely different, I really don't know.
3. When disconnecting the connection via 'goldcrest --disconnect' and after that reconnecting via 'goldcrest --reconnect', I get the following error:

   ERROR: Cannot start WireGuard connection. Client name and user name (system login name) not provided.

   When reconnecting while the connection is still active, everything works.

Bluetit daemon started with PID XXXXXX
Reading run control directives from file /etc/airvpn/bluetit.rc
Network check mode is gateway
getGatewayFromRouteTable(): Received invalid packet from socket
Bluetit successfully terminated

Setting

networkcheck off

in bluetit.rc does not resolve the issue — the error still occurs.

Root cause (suspected):
The machine has 15 Docker bridge interfaces, each with its own route entry in the kernel routing table. The netlink socket dump of all routes is significantly larger than a typical system. Bluetit appears to fail parsing this response in `getGatewayFromRouteTable()`, possibly due to a fixed buffer size or unexpected iteration behavior over virtual interfaces.

Confirmed by comparison:
On a second machine running kernel 6.12.73+deb13-amd64 with a clean routing table (no Docker bridges), Bluetit starts without issue.

Stopping the Docker service does not resolve the issue, as the bridge interfaces and their routes persist in the routing table until reboot.

Request
Please investigate

getGatewayFromRouteTable() 

for robustness when the routing table contains a large number of entries or virtual/bridge interfaces.

goldcrest --air-connect --air-vpn-type wireguard --network-lock on

Above command ends with an error: ↓ 

xxx Bluetit - AirVPN WireGuard/OpenVPN3 Service 2.0.0 - 22 July 2025
xxx OpenVPN core 3.12 AirVPN (20250606) linux x86_64 64-bit
xxx Copyright (C) 2012- OpenVPN Inc. All rights reserved.
xxx OpenSSL 3.0.13 30 Jan 2024
xxx AirVPN WireGuard Client 2.0.0 Linux x86_64 64-bit
xxx Bluetit options successfully reset
xxx ERROR: --air-vpn-type can be openvpn or wireguard

Why? Can anybody help, please!

BTW, I can connect with wg-quick. Its only 4 commands:

	sudo wg-quick up /home/xxxx/wg0.conf
	sudo ./wg-killswitch-nft.sh up wg0
	sudo wg-quick down /home/xxxx/wg0.conf
	./wg-killswitch-nft.sh down wg0

I downloaded killswitch from: https://github.com/xtarlit/wg-killswitch-nft

• Bluetit: lightweight D-Bus controlled system daemon providing full connectivity to AirVPN servers and generic OpenVPN and WireGuard servers with the ability to connect the system to AirVPN during the bootstrap.
• Goldcrest: Bluetit client, allowing full integration with AirVPN servers, users, keys, profiles as well as generic OpenVPN and WireGuard servers
• Hummingbird: lightweight and standalone client for generic OpenVPN and WireGuard connection. 
• Cuckoo: traffic split manager, granting full access and functionality to AirVPN's traffic split infrastructure
• Airsu: a "run and forget" tool to automatically set and enable the user environment for the X.Org or Wayland based ecosystem without any user input

• Suite download page: https://airvpn.org/linux/suite/
• Hummingbird macOS edition download page: https://airvpn.org/macos/hummingbird/
• Suite User's Manual: https://gitlab.com/AirVPN/AirVPN-Suite/-/blob/master/README.md
• Hummingbird User's Manual: https://gitlab.com/AirVPN/AirVPN-Suite/-/blob/master/README-hummingbird.md
• Bluetit Developer's Reference Manual: https://gitlab.com/AirVPN/AirVPN-Suite/-/blob/master/docs/Bluetit-Developers-Reference-Manual.pdf
• Source code repository: https://gitlab.com/AirVPN/AirVPN-Suite/
• Dedicated AirVPN community forum: https://airvpn.org/forums/forum/47-airvpn-suite

• Linux systems based either on SysV-Style init (chckconfig support implemented as well) or systemd
• Linux kernel 5.10 or higher version on x86-64, armv7l and aarch64 architectures
• GNU C library 2.38 or higher version
• D-Bus 1.12.20 or higher version
• Hummingbird for macOS: macOS 10.14 Mojave or higher version

• Binaries / resource files copied to the Nix Store and binaries somewhat working

❯ goldcrest --version

Used nix-ld for this:

programs.nix-ld = {
  enable = true;
  libraries = with pkgs; [
    dbus
    openssl
    libgcc
  ];
};

• airvpn group created (I don't need airvpn user)
• bluetit.service / bluetit-suspend.service / bluetit-resume.service units written with systemd.services Nix option
• Custom bluetit.rc with my own settings and sensitive values set as agenix secrets.
• Zsh completions (only added Zsh because that's my interactive shell, I don't use Bash)

• cuckoo binary ownership and permissions

chown root:airvpn $BIN_DIR/cuckoo
chmod u+s $BIN_DIR/cuckoo

• any VPN connection

❯ journalctl -b -u bluetit.service

systemd[1]: Starting AirVPN Bluetit Daemon...
bluetit[21208]: Starting Bluetit - AirVPN WireGuard/OpenVPN3 Service 2.0.0 - 22 July 2025
bluetit[21208]: OpenVPN core 3.12 AirVPN (20250606) linux x86_64 64-bit
bluetit[21208]: Copyright (C) 2012- OpenVPN Inc. All rights reserved.
bluetit[21208]: SSL Library: OpenSSL 3.4.2 1 Jul 2025
bluetit[21208]: AirVPN WireGuard Client 2.0.0 Linux x86_64 64-bit
bluetit[21242]: Bluetit daemon started with PID 21242
bluetit[21242]: Reading run control directives from file /etc/airvpn/bluetit.rc
bluetit[21242]: Network check mode is airvpn
bluetit[21242]: Creating AirVPN Boot server list
systemd[1]: Started AirVPN Bluetit Daemon.
bluetit[21242]: Added server http://63.33.78.166
bluetit[21242]: Added server http://54.93.175.114
bluetit[21242]: Added server http://82.196.3.205
bluetit[21242]: Added server http://63.33.116.50
bluetit[21242]: Added server http://[2a03:b0c0:0:1010::9b:c001]
bluetit[21242]: Added server http://bootme.org
bluetit[21242]: Boot server http://bootme.org resolved into IPv4 82.196.3.205/32 IPv6 2a03:b0c0:0:1010::9b:c001/128
bluetit[21242]: AirVPN Boot server list successfully created. Added 6 servers.
bluetit[21242]: AirVPN connectivity attempt 1 in progress
bluetit[21242]: Successfully connected to AirVPN server <redacted>
bluetit[21242]: External network is reachable via IPv4 gateway <redacted> through interface <redacted>
bluetit[21242]: Successfully connected to D-Bus
bluetit[21242]: DNSManagerException: systemctl: command not found
bluetit[21242]: Sending event 'event_end_of_session'
bluetit[21242]: Bluetit successfully terminated
systemd[1]: bluetit.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: bluetit.service: Failed with result 'exit-code'.
systemd[1]: bluetit.service: Consumed 37ms CPU time, 7.3M memory peak, 12.4M read from disk, 120K written to disk, 60B incoming IP traffic, 164B outgoing IP traffic.

Environment = "PATH=/run/current-system/sw/bin:$PATH";

❯ sudo ln -s /run/current-system/sw/bin/systemctl /bin/systemctl

• With networklockpersist on: "NetFilterException: No usable firewall found in this system"
• With networklockpersist iptables: "NetFilterException: iptables or iptables legacy is not available in this system"
• With networklockpersist nftables: "NetFilterException: nftables is not available in this system"

❯ sudo ln -s /run/current-system/sw/bin/iptables /bin/iptables
❯ sudo ln -s /run/current-system/sw/bin/iptables-save /bin/iptables-save
❯ sudo ln -s /run/current-system/sw/bin/iptables-restore /bin/iptables-restore

❯ sudo ln -s /run/current-system/sw/bin/ip6tables /bin/ip6tables
❯ sudo ln -s /run/current-system/sw/bin/ip6tables-restore /bin/ip6tables-restore
❯ sudo ln -s /run/current-system/sw/bin/ip6tables-save /bin/ip6tables-save

❯ sudo ln -s /run/current-system/sw/bin/nft /bin/nft

Goldcrest - AirVPN Bluetit Client 2.0.0 - 22 July 2025

Reading run control directives from file /root/.config/goldcrest.rc
Bluetit - AirVPN WireGuard/OpenVPN3 Service 2.0.0 - 22 July 2025
OpenVPN core 3.12 AirVPN (20250606) linux x86_64 64-bit
Copyright (C) 2012- OpenVPN Inc. All rights reserved.
OpenSSL 3.4.2 1 Jul 2025
AirVPN WireGuard Client 2.0.0 Linux x86_64 64-bit
Successfully restored DNS and network filter settings
WARNING: Backup copy of resolv.conf not found. DNS settings do not need to be restored.
Scanning for system DNS addresses
Found system IPv4 DNS <redacted>
Found 1 system DNS address
Command not found
Command not found
WARNING: Backup copy of network filter not found. Network settings do not need to be restored.
Network filter and lock are using /bin/iptables
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
ERROR: system 'modules.builtin' does not exist.
Network filter successfully initialized
Private network is allowed to pass the network filter
Ping output is allowed to pass the network filter
IPv6 NDP is allowed to pass the network filter
Network Lock Error: Unknown error 256 (stderr: iptables-restore: line 1 failed)
Bluetit session terminated

Goldcrest - AirVPN Bluetit Client 2.0.0 - 22 July 2025

Reading run control directives from file /root/.config/goldcrest.rc
Bluetit - AirVPN WireGuard/OpenVPN3 Service 2.0.0 - 22 July 2025
OpenVPN core 3.12 AirVPN (20250606) linux x86_64 64-bit
Copyright (C) 2012- OpenVPN Inc. All rights reserved.
OpenSSL 3.4.2 1 Jul 2025
AirVPN WireGuard Client 2.0.0 Linux x86_64 64-bit
Successfully restored DNS and network filter settings
WARNING: Backup copy of resolv.conf not found. DNS settings do not need to be restored.
Scanning for system DNS addresses
Found system IPv4 DNS <redacted> 
Found 1 system DNS address
Network filter successfully restored
Network filter and lock are using nftables
ERROR: system 'modules.builtin' does not exist.
Network filter successfully initialized
Private network is allowed to pass the network filter
Ping output is allowed to pass the network filter
IPv6 NDP is allowed to pass the network filter
Persistent network filter and lock successfully enabled. Private network is allowed.
Bluetit session terminated

bluetit[8754]: Starting WireGuard boot connection
bluetit[8754]: ERROR: system 'modules.builtin' does not exist.
bluetit[8754]: ERROR: cannot load wireguard system module
bluetit[8754]: Cannot load wireguard system module
bluetit[8754]: Logging out AirVPN user 183aTr78f9o
bluetit[8754]: AirVPN Manifest successfully retrieved from server
bluetit[8754]: AirVPN Manifest update interval is now set to 30 minutes
bluetit[8754]: Session network filter and lock are now disabled
bluetit[8754]: Sending event 'event_end_of_session'

{
  config,
  lib,
  pkgs,
  ...
}:

let
  version = "2.0.0";
  airvpn-linux-suite = pkgs.stdenv.mkDerivation {
    pname = "airvpn-linux-suite";
    inherit version;

    src = pkgs.fetchurl {
      url = "https://eddie.website/repository/AirVPN-Suite/${version}/AirVPN-Suite-x86_64-${version}.tar.gz";
      # sha256 = lib.fakeSha256;
      sha256 = "Jt83PPHwBv/GraubQV4I7Shn+UwMvkVW2q9VIAbYDw0=";
    };

    installPhase = ''
      mkdir -p $out/sbin
      mkdir -p $out/bin
      mkdir -m=750 -p $out/etc/airvpn
      mkdir -p $out/etc/dbus-1/system.d
      mkdir -p $out/etc/systemd/system
      mkdir -p $out/share/zsh/site-functions

      cp --preserve=mode bin/bluetit $out/sbin/

      for f in "goldcrest" "hummingbird" "cuckoo" "airsu"; do
        cp --preserve=mode bin/$f $out/bin
      done

      for f in "airvpn-manifest.xml" "connection_priority.txt" "connection_sequence.csv" \
        "country_continent.csv" "country_names.csv" \
        "continent_names.csv" "nsswitch.conf"; do
        cp etc/airvpn/$f $out/etc/airvpn/
      done

      chmod 660 $out/etc/airvpn/*

      cp etc/dbus-1/system.d/* $out/etc/dbus-1/system.d/
      chmod 644 $out/etc/dbus-1/system.d/org.airvpn.*

      cp etc/site-functions/* $out/share/zsh/site-functions/
    '';

    meta = with lib; {
      description = "AirVPN free and open source suite based on AirVPN OpenVPN 3 library fork";
      homepage = "https://www.airvpn.org/";
      license = licenses.gpl3Plus;
      platforms = [ "x86_64-linux" ];
      maintainers = [ maintainers.183aTr78f9o ];
    };
  };

  customBluetitRC =
    # ini
    ''
    # full bluetit.rc here with custom settings
    '';
in
{
  environment.systemPackages = [ airvpn-linux-suite ];

  users.groups.airvpn = { };

  systemd.services = {
    bluetit = {
      description = "AirVPN Bluetit Daemon";
      unitConfig = {
        After = [
          "network-online.target"
          "firewalld.service"
          "ufw.service"
          "dbus-daemon.service"
          "dbus.socket"
        ];
        Wants = [
          "network-online.target"
          "firewalld.service"
          "ufw.service"
          "dbus-daemon.service"
          "dbus.socket"
        ];
      };
      serviceConfig = {
        Type = "forking";
        PIDFile = "/etc/airvpn/bluetit.lock";
        ExecStart = "${airvpn-linux-suite}/sbin/bluetit";
        Environment = "PATH=/run/current-system/sw/bin:$PATH";
        TimeoutStopSec = 90;
        KillSignal = "SIGTERM";
        KillMode = "mixed";
        SendSIGKILL = "no";
      };

      wantedBy = [ "multi-user.target" ];
    };

    bluetit-resume = {
      description = "AirVPN Bluetit Daemon Resume after Suspend, Sleep, Hibernate";
      unitConfig = {
        After = [
          "network-online.target"
          "firewalld.service"
          "ufw.service"
          "dbus-daemon.service"
          "dbus.socket"

          "suspend.target"
          "suspend-then-hibernate.target"
          "hibernate.target"
          "hybrid-sleep.target"
          "sleep.target"
        ];
        Wants = [
          "network-online.target"
          "firewalld.service"
          "ufw.service"
          "dbus-daemon.service"
          "dbus.socket"
        ];
      };

      serviceConfig = {
        Type = "forking";
        ExecStart = "${pkgs.systemd}/bin/systemctl start bluetit.service";
      };

      wantedBy = [
        "suspend.target"
        "suspend-then-hibernate.target"
        "hibernate.target"
        "hybrid-sleep.target"
        "sleep.target"
      ];
    };

    bluetit-suspend = {
      description = "AirVPN Bluetit Daemon Suspend, Sleep, Hibernate";

      unitConfig = {
        Before = [
          "suspend.target"
          "suspend-then-hibernate.target"
          "hibernate.target"
          "hybrid-sleep.target"
          "sleep.target"
        ];
      };

      serviceConfig = {
        Type = "forking";
        ExecStart = "${pkgs.systemd}/bin/systemctl stop bluetit.service";
      };

      wantedBy = [
        "suspend.target"
        "suspend-then-hibernate.target"
        "hibernate.target"
        "hybrid-sleep.target"
        "sleep.target"
      ];
    };
  };

  environment.etc = {
    "airvpn/airvpn-manifest.xml" = {
      source = "${airvpn-linux-suite}/etc/airvpn/airvpn-manifest.xml";
      mode = "0660";
    };

    "airvpn/bluetit.rc" = {
      text = customBluetitRC;
      mode = "0660";
    };

    "airvpn/connection_priority.txt" = {
      source = "${airvpn-linux-suite}/etc/airvpn/connection_priority.txt";
      mode = "0660";
    };

    "airvpn/connection_sequence.csv" = {
      source = "${airvpn-linux-suite}/etc/airvpn/connection_sequence.csv";
      mode = "0660";
    };

    "airvpn/country_continent.csv" = {
      source = "${airvpn-linux-suite}/etc/airvpn/country_continent.csv";
      mode = "0660";
    };

    "airvpn/country_names.csv" = {
      source = "${airvpn-linux-suite}/etc/airvpn/country_names.csv";
      mode = " 0660";
    };

    "airvpn/continent_names.csv" = {
      source = "${airvpn-linux-suite}/etc/airvpn/continent_names.csv";
      mode = "0660";
    };

    "airvpn/nsswitch.conf" = {
      source = "${airvpn-linux-suite}/etc/airvpn/nsswitch.conf";
      mode = "0660";
    };
  };

  system.activationScripts."airvpn-dbus-conf" =
    # sh
    ''
      destPath="/usr/local/etc/dbus-1/system.d"

      mkdir -m=755 -p "$destPath"

      cp "${airvpn-linux-suite}/etc/dbus-1/system.d/org.airvpn.client.conf" "$destPath/"
      chmod 644 "$destPath/org.airvpn.client.conf"

      cp "${airvpn-linux-suite}/etc/dbus-1/system.d/org.airvpn.server.conf" "$destPath/"
      chmod 644 "$destPath/org.airvpn.server.conf"

      systemctl reload dbus 2>/dev/null || true
    '';
}

goldcrest --air-connect --air-country nl

goldcrest --air-connect --air-country gb

tun_prop_error: tun_builder_add_address IPv6 failed

ERROR: Country gb does not exist

2025-07-30 15:30:17 ** AirVPN Country List (1) **
2025-07-30 15:30:17 ISO Code Name                           Servers Users Bandwidth    Max BW    Load
2025-07-30 15:30:17 -------- ------------------------------ ------- ----- ------------ ---------- ----
2025-07-30 15:30:17 GB       United Kingdom                      15  1416 13.69 Gbit/s 30.00 Gbit/s  45%

TUN Error: tun_tx_queue_len_error: Operation not permitted
EVENT: TUN_SETUP_FAILED [FATAL ERROR] tun_tx_queue_len_error: Operation not permitted
ERROR: TUN_SETUP_FAILED

crw-rw-rw- 1 root root 10, 200 Oct 15 14:10 /dev/net/tun

bluetit.log