Hummingbird 1.0: AirVPN client based on OpenVPN 3 AirVPN

[pjnsmb 13]

Using AirVPN OpenVPN 3 client version 1.0 alpha 2

I am still experiencing a loss of internet connection after using Ctrl +C to end it.
The use of  '--recover-network' still does not work 

The only way I can use this beta programme is to use the option --network-lock off which destroys my need for a secure vpn connection and makes it a waste of time using it in beta . 

It is making it hard work to have to use a 'screen' utility  to get around the problem as suggested previously.
  Edited ... by pjnsmb
oops sorry alpha programme

[Staff 9972]

@pjnsmb

Hello!

We're not yet in beta testing (EDIT: since Nov 29 we are  ), thanks for the trust, but we count to release a beta version soon (for Mac too). Can you tell us your exact Linux distribution name and version and send us the client log taken just after the problem has occurred?

Using the screen utility was a suggestion pertaining to a different case, or maybe are you connecting remotely via ssh or telnet to the machine that will connect to the VPN? If so using screen is absolutely not a hard work, it's piece of cake don't worry.

Kind regards
 

[OpenSourcerer 1435]

Hmm, I'm sorry, but it's still mixing up v4 and v6...

$ sudo ./airvpn -N off -i -6 yes IPv6.ovpn
AirVPN OpenVPN 3 Client 1.0 alpha 2 - 7 November 2019

CONNECTING...
Starting thread
Thu Nov  7 18:28:12.805 2019 OpenVPN core 3.3.2 AirVPN linux x86_64 64-bit
Thu Nov  7 18:28:12.809 2019 Frame=512/2048/512 mssfix-ctrl=1250
Thu Nov  7 18:28:12.812 2019 UNUSED OPTIONS
3 [resolv-retry] [infinite]
4 [nobind]
5 [persist-key]
6 [persist-tun]
7 [auth-nocache]
8 [route-delay] [5]
9 [verb] [3]
10 [explicit-exit-notify] [5]
18 [pull-filter] [ignore] [dhcp-option DNS]
Thu Nov  7 18:28:12.812 2019 EVENT: RESOLVE
Thu Nov  7 18:28:12.813 2019 WARNING: Network filter and lock is disabled
Thu Nov  7 18:28:12.813 2019 Contacting [2001:ac8:20:2b:fbca:14fa:873e:4051]:443 via UDP
Thu Nov  7 18:28:12.813 2019 EVENT: WAIT
Thu Nov  7 18:28:12.813 2019 net_route_best_gw query IPv6: 2001:ac8:20:2b:fbca:14fa:873e:4051/128
Thu Nov  7 18:28:12.813 2019 sitnl_route_best_gw result: via fe80::9a9b:cbff:fe6d:a378 dev enp35s0
Thu Nov  7 18:28:12.813 2019 Thu Nov  7 18:28:12.813 2019 EVENT: DISCONNECTED
connect error: ipv4_exception: error parsing IPv4 address '2001:ac8:20:2b:fbca:14fa:873e:4051' : Invalid argument
Thread finished
STATS:

Profile is the same.

[Staff 9972]

@giganerd

Hello!

We might be in presence of a conflict when you try an IPv6 connection and at the same time you also want IPv6 over IPv4 (which actually may appear contradictory). The error pertaining to address parsing comes from OpenVPN 3 library. Can you tell us whether the problem is resolved or not when you don't force IPv6 over IPv4 for an IPv6 connection (i.e. do not include -6 option)?

Kind regards


 

[OpenSourcerer 1435]

$ sudo ./airvpn -N off -i IPv6.ovpn
AirVPN OpenVPN 3 Client 1.0 alpha 2 - 7 November 2019

CONNECTING...
Starting thread
Thu Nov  7 22:22:27.392 2019 OpenVPN core 3.3.2 AirVPN linux x86_64 64-bit
Thu Nov  7 22:22:27.395 2019 Frame=512/2048/512 mssfix-ctrl=1250
Thu Nov  7 22:22:27.398 2019 UNUSED OPTIONS
3 [resolv-retry] [infinite]
4 [nobind]
5 [persist-key]
6 [persist-tun]
7 [auth-nocache]
8 [route-delay] [5]
9 [verb] [3]
10 [explicit-exit-notify] [5]
18 [pull-filter] [ignore] [dhcp-option DNS]
Thu Nov  7 22:22:27.399 2019 EVENT: RESOLVE
Thu Nov  7 22:22:27.399 2019 WARNING: Network filter and lock is disabled
Thu Nov  7 22:22:27.399 2019 Contacting [2a02:c205:0:1031:79f8:734d:afb7:43c]:443 via UDP
Thu Nov  7 22:22:27.399 2019 EVENT: WAIT
Thu Nov  7 22:22:27.399 2019 net_route_best_gw query IPv6: 2a02:c205:0:1031:79f8:734d:afb7:43c/128
Thu Nov  7 22:22:27.399 2019 sitnl_route_best_gw result: via fe80::9a9b:cbff:fe6d:a378 dev enp35s0
Thu Nov  7 22:22:27.399 2019 Thu Nov  7 22:22:27.399 2019 EVENT: DISCONNECTED
connect error: ipv4_exception: error parsing IPv4 address '2a02:c205:0:1031:79f8:734d:afb7:43c' : Invalid argument
Thread finished
STATS:

 

1 hour ago, Staff said:

We might be in presence of a conflict when you try an IPv6 connection and at the same time you also want IPv6 over IPv4 (which actually may appear contradictory)

I don't want to do v6 over v4, all my networks and devices support and use native v6.
 

1 hour ago, Staff said:

(i.e. do not include -6 option)

It might have escaped my notice, but where do you document that this option causes a v6 over v4 connection as opposed to explicitly enable and use IPv6 as I understood it (also with "help" from --help)?

And how ironic is it that, if the source code was published, I could simply look at it and help you find the problem? If you need me to give you more info on my setup or try something out, say the word.

[pjnsmb 13]

13 hours ago, Staff said:

@pjnsmb

Hello!

We're not yet in beta testing, thanks for the trust, but we count to release a beta version soon (for Mac too). Can you tell us your exact Linux distribution name and version and send us the client log taken just after the problem has occurred?

Using the screen utility was a suggestion pertaining to a different case, or maybe are you connecting remotely via ssh or telnet to the machine that will connect to the VPN? If so using screen is absolutely not a hard work, it's piece of cake don't worry.

Kind regards


@Staff

attached is a full log showing my commands used.

A new  backup resolv.conf file is made showing my initial nameserver 127.0.0.1 (this is set by network manager settings as I do use dnscrypt-proxy)airvpn log

The generated resolv.conf file shows my correct address.

After CTRL+C the log shows :
Fri Nov  8 06:17:09.202 2019 Successfully restored DNS settings
Fri Nov  8 06:17:09.222 2019 Network filter successfully restored

BUT the backup resolv.conf disappears so use of :
sudo ./airvpn --recover-network

shows :
ERROR: Cannot restore DNS settings. Backup copy of resolv.conf not found.
ERROR: Cannot restore network filter

and there is no internet connection.

regards

[Staff 9972]

22 hours ago, giganerd said:

I don't want to do v6 over v4, all my networks and devices support and use native v6.
 
It might have escaped my notice, but where do you document that this option causes a v6 over v4 connection as opposed to explicitly enable and use IPv6 as I understood it (also with "help" from --help)?

And how ironic is it that, if the source code was published, I could simply look at it and help you find the problem? If you need me to give you more info on my setup or try something out, say the word.

Hello!

-6 is an undocumented option in OpenVPN 3 library, it has nothing to do with the frontend. OpenVPN 3 is mostly undocumented by OpenVPN developers and we are doing our best to fill the gap. In the next version we will clarify usage of -6 option to leave no doubts on the matter.

You can infer that -6 pertains to IPv6 over IPv4 from the comments in the source code, which contrarily to what your misleading irony suggests has been published in GitHub a long ago. https://github.com/AirVPN/openvpn3-airvpn

Anyway that part is identical to the main branch and has not been touched by us, so you can see that part both in our fork and in the main branch, it exists since years ago and has remained undocumented since years ago.

At this stage we are focused on bug fixing because, for Linux, we found a dramatic situation to say the least. just consider, as a mere, shameful example, that data structures were systematically not initialized, an error that you can't expect or imagine, not even from C novice children students during their first C course. Lack of initialization in C/C++ causes apparently random crashes and/or unexpected behavior in different conditions, systems and system states, according to how "dirty" the data RAM area is or is not. Situation is now under control (while OpenVPN 3 main branch remains mainly unusable in Linux for practical purposes) but only after a very hard, time consuming work.

That said, omitting -6 might not solve the issue. We suspect now that it's another OpenVPN 3 bug; as such we will investigate with the purpose to fix it. Please test anyway without -6 option and let us know the outcome at your convenience. (DONE)

Kind regards
 

[Staff 9972]

@pjnsmb

After you press CTRL-C resolv.conf backup is correctly deleted so the reply you get after you ordered "--recover-network" is expected. Up to this point everything sounds fine. Then you notice lack of Internet connectivity, which might or might not be expected.

Please check firewall rules as well as chain policies before and after the VPN connection: if they match your lack of Internet connectivity is expected; if not something wrong is going on, please notify us including rules (first and after you have run the client) and exact distribution name and version.

Kind regards
 

[OpenSourcerer 1435]

8 hours ago, Staff said:

You can infer that -6 pertains to IPv6 over IPv4 from the comments in the source code, which contrarily to what your misleading irony suggests has been published in GitHub a long ago. https://github.com/AirVPN/openvpn3-airvpn

I was referring to this client, not the library. But if it's indeed a problem with the library itself, I take back the things you refer to and hereby apologize. I was merely mocking the closed nature of the CLI client.

It it helps in anyway, I see if I can find some time to dig in the library code. Currently, I can be lucky to have one free day in the weekends at least.

[Staff 9972]

@giganerd
 

Quote

I was referring to this client, not the library. But if it's indeed a problem with the library itself, I take back the things you refer to and hereby apologize. I was merely mocking the closed nature of the CLI client.

Hello!

Well, it's not uncommon that any source code is not released at alpha stage. In several environments it is common practice. It is all in all a wise decision because any part can be even rebuilt from scratch, even from alpha n to alpha n+1. However, as you noticed, the library source code is published and of course it's not alpha.
 

Quote

It it helps in anyway, I see if I can find some time to dig in the library code. Currently, I can be lucky to have one free day in the weekends at least.


That would be great!

Kind regards
 

[pjnsmb 13]

On 11/8/2019 at 1:23 PM, Staff said:

@pjnsmb

After you press CTRL-C resolv.conf backup is correctly deleted so the reply you get after you ordered "--recover-network" is expected. Up to this point everything sounds fine. Then you notice lack of Internet connectivity, which might or might not be expected.

Please check firewall rules as well as chain policies before and after the VPN connection: if they match your lack of Internet connectivity is expected; if not something wrong is going on, please notify us including rules (first and after you have run the client) and exact distribution name and version.

Kind regards

@staff

As I said at the top of my log I sent :

System:    Host: peter-mate Kernel: 5.4.0-rc6-siduction-amd64 x86_64 bits: 64 Desktop: MATE 1.22.2 
           Distro: siduction 18.3.0 Patience - mate - Sid unstable.

 As I used Eddie-ui  from apt without any problem at all with firewall rules and chain policies prior to testing this I am not familiar with the terminal  commands to get the  information you are asking for.

Please help and tell me the terminal commands I  need to use.

To be clear my NETWORK and  INTERNET  connection work fine prior to, and during use of, this programme, but both stop working as soon as I use CTRL+C . 

regards

[ezd 2]

It's working very well for me. Always used the cli version and this one is stunningly fast. I would love to have the 'n' command too to reconnect to a new server. 

[colorman 26]

Today this error on openSUSE 15.1
 

error

[blaHbluBB 6]

quick question, will there be a release of this for windows(10)?
or do i have to build/compile it myself?

[pjnsmb 13]

8 minutes ago, blaHbluBB said:

quick question, will there be a release of this for windows(10)?
or do i have to build/compile it myself?

The answer is in the first post by @Staff 😀

[blaHbluBB 6]

the question was more like, will this AirVPN OpenVPN 3(with all the airvpn fixes and added stuff) come to windows with eddie or will that stay on the 2.x branch of openvpn.

anyways, there is no mentioning of Windows as a platform at all in the first post by @Staff only Linux, Mac, Raspbian, OpenBSD and FreeBSD.
that's why i asked, but i guess my question wasn't clear enough.

[OpenSourcerer 1435]

4 hours ago, blaHbluBB said:

will this AirVPN OpenVPN 3(with all the airvpn fixes and added stuff) come to windows with eddie or will that stay on the 2.x branch of openvpn.

This is AirVPN library stuff. I expect the PC client versions to be rebased on it, if it isn't already, at least in small parts. This way all PC platforms will get it. But since deveopment just started, expect new versions of Eddie 2.x for now.

[blaHbluBB 6]

i thought as much, but wanted to ask to be sure.
thanks for clarifying.

[macster 0]

Has anyone had any luck getting this going on a Synology Router (linux based)?

If I use a standard config file and the native openVPN client, I unfortunately drop from ~300Mbps to ~40Mbps. Assume the issue is processing speed on the router and not the software implementation, so maybe chacha would help...

[QueenSasha 1]

@Staff

Still waiting for a dev reply!

@giganerd

I don't see any easy way to integrate an OpenVPN library in Eddie for Linux, look into 2.16 source code. To begin with I am sure important security holes must be fixed first and they require, I guess, massive massive work and extensive code re-organization and re-deployment. I imagine / suspect that's why Eddie Linux/Mac development is sluggish if not almost frozen. Even versioning went nuts, makes no sense, as if development chief had a brainfart. I mean you leave a 2.17 beta version for one year and then you start from scratch a new 2.18 beta version? WTF?!?

New Linux software seems good in comparison albeit no source code is available in alpha, but look into OpenVPN 3 fork, WOW! We see when the source code is published BTW. Also awaiting devs answers to my questions, first laziness jerkiness check 

Edited ... by QueenSasha

[Staff 9972]

On 11/3/2019 at 3:30 PM, QueenSasha said:

Can we expect an OpenBSD version b4 xxxMas? Will u support pf and ipfw for NLock? Is this something you'll build a new g interface on top? If you build a g interface, will you make the whole forked library available in a daemon/service? Will you add user control on socket buffer or ovpn3 can manage it just fine through asio or whatever?

Will report bugs if I drive em out.

Keep it up my privacy paladins!

-- qs

Hello!

Thank you for your public and private bug reports and for you ongoing support.

About your questions:

1. We confirm: OpenBSD and FreeBSD versions are planned. However, they will probably not be available before Christmas, we're terribly sorry. Currently, OpenVPN 3 can not be compiled in *BSD, therefore some additional work is required.
2. Yes, pf for Network Lock will be supported in Mac, FreeBSD and OpenBSD. ipfw support is under evaluation.
3. More on plans about a GUI will be released in the future.
4. A study about asio and socket buffers is not yet complete. At this early stage it seems that OpenVPN 3 does not need fixed buffer sizes and asio seems capable to fine tune buffers properly, according to various speed tests and comparisons. Please keep in mind once again that the issue you raised is still in early  stage investigation.

Kind regards
 

[Fezenari 1]

On 11/7/2019 at 8:30 PM, giganerd said:

Hmm, I'm sorry, but it's still mixing up v4 and v6... 

$ sudo ./airvpn -N off -i -6 yes IPv6.ovpn
AirVPN OpenVPN 3 Client 1.0 alpha 2 - 7 November 2019

CONNECTING...
Starting thread
Thu Nov 7 18:28:12.805 2019 OpenVPN core 3.3.2 AirVPN linux x86_64 64-bit
Thu Nov 7 18:28:12.809 2019 Frame=512/2048/512 mssfix-ctrl=1250
Thu Nov 7 18:28:12.812 2019 UNUSED OPTIONS
3 [resolv-retry] [infinite]
4 [nobind]
5 [persist-key]
6 [persist-tun]
7 [auth-nocache]
8 [route-delay] [5]
9 [verb] [3]
10 [explicit-exit-notify] [5]
18 [pull-filter] [ignore] [dhcp-option DNS]
Thu Nov 7 18:28:12.812 2019 EVENT: RESOLVE
Thu Nov 7 18:28:12.813 2019 WARNING: Network filter and lock is disabled
Thu Nov 7 18:28:12.813 2019 Contacting [2001:ac8:20:2b:fbca:14fa:873e:4051]:443 via UDP
Thu Nov 7 18:28:12.813 2019 EVENT: WAIT
Thu Nov 7 18:28:12.813 2019 net_route_best_gw query IPv6: 2001:ac8:20:2b:fbca:14fa:873e:4051/128
Thu Nov 7 18:28:12.813 2019 sitnl_route_best_gw result: via fe80::9a9b:cbff:fe6d:a378 dev enp35s0
Thu Nov 7 18:28:12.813 2019 Thu Nov 7 18:28:12.813 2019 EVENT: DISCONNECTED
connect error: ipv4_exception: error parsing IPv4 address '2001:ac8:20:2b:fbca:14fa:873e:4051' : Invalid argument
Thread finished
STATS:

Profile is the same.

I've got the same problem, I can't connect via ipv6 if I choose "IPv4 & IPv6 (connect with IPv6)" in config generator. When I choose "IPv4 & IPv6 (connect with IPv4)", everything works great.
I really love that very fast connection time.
Also Eddie 2.17.3 for me has a bug, I must manually execute "sudo iptables -F" after every Eddie shutdown. This client doesn't have it. 😁

[Staff 9972]

Hello!

We're very glad to inform you that:

• a macOS beta version is now available
• Linux 64 bit and Raspbian beta versions are now available (we recommend that you upgrade from the previous alpha versions)
• OpenVPN library has been updated to version OpenVPN AirVPN 3.6.1

The initial message with download links and instructions has been updated accordingly.

Kind regards
 

[OpenSourcerer 1435]

I suppose I'm repeating myself, but the library version update does not fix the v4/v6 mixup. At this point only v4 works.
 

$ sudo ./airvpn -N off -i -6 no IPv6.ovpn
AirVPN OpenVPN 3 Client 1.0 beta 1 - 28 November 2019

Fri Nov 29 18:01:44.056 2019 Starting thread
Fri Nov 29 18:01:44.056 2019 OpenVPN core 3.6.1 AirVPN linux x86_64 64-bit
Fri Nov 29 18:01:44.058 2019 Frame=512/2048/512 mssfix-ctrl=1250
Fri Nov 29 18:01:44.060 2019 UNUSED OPTIONS
3 [resolv-retry] [infinite]
4 [nobind]
5 [persist-key]
6 [persist-tun]
7 [auth-nocache]
8 [route-delay] [5]
9 [verb] [3]
10 [explicit-exit-notify] [5]
18 [pull-filter] [ignore] [dhcp-option DNS]
Fri Nov 29 18:01:44.060 2019 EVENT: RESOLVE
Fri Nov 29 18:01:44.060 2019 WARNING: Network filter and lock is disabled
Fri Nov 29 18:01:44.060 2019 Contacting [2001:ac8:20:5:6000:4b07:7b1c:4c0]:443 via UDP
Fri Nov 29 18:01:44.060 2019 EVENT: WAIT
Fri Nov 29 18:01:44.060 2019 net_route_best_gw query IPv6: 2001:ac8:20:5:6000:4b07:7b1c:4c0/128
Fri Nov 29 18:01:44.060 2019 sitnl_route_best_gw result: via fe80::9a9b:cbff:fe6d:a378 dev enp35s0
Fri Nov 29 18:01:44.060 2019 Fri Nov 29 18:01:44.060 2019 EVENT: DISCONNECTED
Fri Nov 29 18:01:44.060 2019 OpenVPN3 CONNECT ERROR: ipv4_exception: error parsing IPv4 address '2001:ac8:20:5:6000:4b07:7b1c:4c0' : Invalid argument
Fri Nov 29 18:01:44.060 2019 Thread finished
STATS:

 

[Staff 9972]

@giganerd

Hello!

What happens if you don't specify "-6 no"? And with "-6 yes"? And with no "-6" at all?

Omitting "-6" is not equivalent to "-6 no" or "-6 yes" apparently ("apparently" because it is undocumented) so it's worth to test all 3 options. We have fixed several bugs from the main branch and if necessary we will start investigating this one too. So, first and foremost, let's ascertain that this is a bug for real. Here what you can infer from the source code comments:
 

// IPv6 preference
// no -- disable IPv6, so tunnel will be IPv4-only
// yes -- request combined IPv4/IPv6 tunnel
// default (or empty string) -- leave decision to server
std::string ipv6;

[You might ask why we don't do it ourselves, the problem now is that all developers lines and all testing servers have either IPv6 down or no IPv6 at all]

Kind regards