The big Port Forwarding Airvpn Topic

[Oblivion 2013 8]

Would it be possible that people with port forwarding requirement gather here perhaps?


As you know every server has 65535 ports in theory, some of these ports are control ports used by AirVpn itself. So for now we say there are 50000 ports available for port forwarding for a user that connects to choose from.

However as you understand at this moment people can really choose which ports they want to be forwarded. That is great, and you have at this moment up to 5 ports for example.

Now imagine I like to have 5 ports. Then from the 50000 ports divided by 5 only 10000 clients could connect to a single server without conflicting each other. In reality 10000 clients do not connect to a single server, but the issue is that with a limited number of in reality 10000 ports that are to be reserved on every AirVpn server is something that will not work for ever.


Now imagine to how other VPN sellers do this! Other VPN sellers if even allowed port forwarding do every time you connect offer in this example 3 randomly chosen ports for the user. You update your client software at your side every time you connect. That is doable if you reboot every week or so. This is how most VPN sellers with port forwarding work, they randomly give you a new set of ports to be forwarded and you set the ports in your software every connect.


But AirVpn could be smarter. Instead of reserving port forwarded ports for every AirVpn Server, in the future AirVpn could show which server has all available ports that you have chosen to be forwarded and that has these ports available when you have connected.

Instead of AirVpn having all ports a single client required available at all servers, the servers that have your forwarded ports free to use are instead in the future for example clearly highlighted.

Since 10000 people with each 5 forwarded ports is very limited, and randomly chosen ports every connection setup is a tidy process at the user side too, something needs to be done.

Now my personal experience, at some servers port forwarding is very reliable, on some servers port forwarding is lost after for example 2 days. And I would like to address a solution for the future towards AirVpn.

What I assume that happens is that port forwarding is lost because for a short moment on a single server something happens that uses the forwarded port(s) and so I loose forwarding at that server.

You can do this yourself by connecting to a server with 1 device, connecting with another device at that same server next. You will see port forwarding will cease to work. Instead at this moment for now, AirVpn should say towards the latest device that connects: This server is already connected to another device!.

I hope AirVpn users are willing to share their port forwarding issues in this topic, my request simply is AirVpn should say why, or when port forwarding is lost. Not a user looking for a server having the ports at that moment free, but for example Eddie AirVpn client clearly explaining, as simple as 'This server is already connected to another device!.'

But I do not connect to the same server myself, because I understand it means loosing port forwarding, instead I do not know why some servers are so very reliable, and others give up port forwarding in 2 days or 1 day.

[SurprisedItWorks 49]

Static port forwarding is one of Air's best features.  My port-forwarding application would collapse completely if it were dynamic per connection.  Because so few providers offer static port forwarding, those who need it often end up on Air.

[OpenSourcerer 1435]

On 8/20/2021 at 3:24 PM, Obvious said:

As you know every server has 65535 ports in theory, some of these ports are control ports used by AirVpn itself. So for now we say there are 50000 ports available for port forwarding for a user that connects to choose from.

Fact: Exactly 1024 ports are inforwardable, 1-1023, that makes 64511 ports free to be forwarded by anyone.
 

On 8/20/2021 at 3:24 PM, Obvious said:

However as you understand at this moment people can really choose which ports they want to be forwarded. That is great, and you have at this moment up to 5 ports for example.

People can forward up to 5 ports.
 

On 8/20/2021 at 3:24 PM, Obvious said:

Now imagine I like to have 5 ports. Then from the 50000 ports divided by 5 only 10000 clients could connect to a single server without conflicting each other. In reality 10000 clients do not connect to a single server, but the issue is that with a limited number of in reality 10000 ports that are to be reserved on every AirVpn server is something that will not work for ever.

This applies only if you assume every user forwards five ports. I'd say the vast majority of people use 0-2 ports and a vast minority is above the 5 ports mark, simply because there are so little use cases for more than five ports. Most people want to torrent, that requires one port. All this renders the extrapolation somewhat difficult and needs some mathematical function to describe that is by no means linear, unlike the one you're trying to plot.
 

On 8/20/2021 at 3:24 PM, Obvious said:

But AirVpn could be smarter. Instead of reserving port forwarded ports for every AirVpn Server, in the future AirVpn could show which server has all available ports that you have chosen to be forwarded and that has these ports available when you have connected.

That would make the feature unnecessarily difficult to manage. Besides, OpenVPN does not come with a feature like this, and neither does Wireguard. So such a feature would be limited to AirVPN clients, robbing everyone of their freedom to choose the client software.
 

On 8/20/2021 at 3:24 PM, Obvious said:

You can do this yourself by connecting to a server with 1 device, connecting with another device at that same server next. You will see port forwarding will cease to work. Instead at this moment for now, AirVpn should say towards the latest device that connects: This server is already connected to another device!.

Warning: Two or more sessions are connected to the same server. The same IP+Port can't be mapped to multiple destination.

Client area. It is a limitation, yes, but I think it is impossible to deny an OpenVPN client the connection if such a situation is encountered. OpenVPN does not know AirVPN's infrastructure. So if you see that two connections of yours are pointing towards the same server, reconnect with one of them and port forwarding should work again.
 

On 8/20/2021 at 3:24 PM, Obvious said:

my request simply is AirVpn should say why, or when port forwarding is lost

It is never lost, it's always there. It just isn't possible to provide that feature in situations like above.
 

On 8/20/2021 at 3:24 PM, Obvious said:

But I do not connect to the same server myself, because I understand it means loosing port forwarding, instead I do not know why some servers are so very reliable, and others give up port forwarding in 2 days or 1 day.

I'd say, check your own setup first before pointing fingers at others. Likely there's something happening with your OS.

[Staff 9972]

@OpenSourcerer

Hello!

Out of curiosity, the current ^{inbound forwarded ports}/_customers ratio is 1.1

Kind regards
 

[Oblivion 2013 8]

I tested it for several years now and I can say that the problem might be in OpenVPN and within Linux. However that does not explain why only some servers are affected by loosing port forwarding, in 1 or 2 or 3 days. Although I use EDDIE, for convience, I assume that EDDIE uses 'openvpn' in the background. Or since OpenVPN is open source has its own 'openvpn' inside EDDIE package. It happens at every Ubuntu distribution since 2018, so there is no luck to make it stable in all circumstances.

OpenVPN became to complex to really maintain and has much legacy. Hence WireGuard as I understood will become available in September 2021 as a pilot for those who want to try and if more robust I hopefully hope so.

When I use OpenVPN from the CLI and forwarding within iptables the ports the same happens as when I use EDDIE. ( Some servers are very stable for length of time, others consistently stop working within 1,2 or 3 days with port forwarding only, other things keep working. )

Since I also read about a firewall at servers which seems logical, I assumed also the server firewall might decide to many simultaneous incoming connections for a port from to very different IP addresses. But then again it would not explain why other servers work very robust.

I tried different hardware too, and different Network Adapters also. But the common thing is GNU/Linux with OpenVPN. Situation always the same. Port Forwarding lost at certain servers, then only reboot works, since OpenVPN (EDDIE inherent) in my opinion deeply affects the TCP/IP stack.

So the only thing that works is looking for a server which does not create this situation. As for now, there are enough servers which do not exhibit this and sometimes the favorite servers do exhibit it, like servers that don't change website languages despite having a browser having English only in headers for example.

Everything in common: OpenVPN, GNU/Linux Ubuntu Distributions
Everything different: Different hardware (different computer), different Network Adaptor/hardware
Everything in common: Software eMule
Everything that works: Find a server that works, this means loosing favorite but it mitigates and does work.

Since OpenVPN deeply affects all network stack, it is also possible to simply unplug, re plug. But it does not explain diffent hardware having the same problem.

What I did not try is a different Router, what I did try is a different Internet provider too! ( Asus routers are known to be good but since selecting a right server doesn't give the problem of port forwarding lost, I have no reason to assume it is the Asus router.)

What I cannot try is Microsoft Windows. I assume Linux has more market share at OpenVPN but in other circumstances Microsoft Windows is far more tested by many more users (assumption.)

Other things I tried is all kinds of protocols instead of automatic, like TCP or different entry but automatic using UDP is always more stable.

The question remains, why only some servers are affected, and why some servers are not affected. The only difference is here: Different Country.

At this time I am trying 10 Gigabit from which I can see they are very popular.

As a response to the math, I tried to have it very simple hence easy math instead of dynamic scenario I instead used a theoretical approach easy to understand.
 

[Staff 9972]

@Obvious

Hello!

Incoming packet forwarding is a server side matter. It makes no difference whether the VPN connection is handled by OpenVPN 2,. OpenVPN 3 or Wireguard.

In Linux and macOS, Eddie can run both OpenVPN and Hummingbird, which is an AirVPN software based on OpenVPN3-AirVPN library. You can tell Eddie to run Hummingbird and not OpenVPN by ticking "Use Hummingbird" item in Eddie's "Preferences" > "Advanced" window.

On a client settings equal footing, packet forwarding behavior discrepancy between VPN servers should be investigated server side too. From your description it is possible that you're just wasting time as it appears that you're investigating incorrectly: please open a ticket. The support team can, first and foremost, ascertain whether packets are actually pre-routed and forwarded to your node or not.

Kind regards
 

[Stalinium 44]

I'm actively using port-forwarding and without issues. Except today The Bt client doesn't show as many incoming connections as it would if the port-forwarding worked. I've used this port for weeks and it has worked fine yesterday on this same server. Other than this anomaly, (I just checked, it was just a fluke. The website tester was unreliable) I've been using port forwarding without any issues ever since I got AirVPN.
Adding a new port in the client area immediately enabled it for the current VPN connection (no noticable delay, no reconnect was required).

On the topic of port exhaustion: splitting up forwarded ports per server/country would confuse A LOT of people. On the other hand those who know to configure port forwarding probably will manage through that hoop too. The only other way is to have an additional exit IP for each VPN to 'double' the amount of available ports (max. 2 allocations per port but then it would need to be static, so each user must be statically assigned into either group for routing)

[Oblivion 2013 8]

Ok, installed hummingbird and it is exceptional faster in connecting compared to OpenVPN 2.4.7. And I use it with the EDDIE client software. The installation guide was clear but I first downloaded the wrong operating system version from which LDD told ' no dynamic executable '. Which required me to look clearly for x86_64 version, then it worked following the steps, but I needed to completely exit EDDIE and then start EDDIE again to make it work if anyone else needs to know. Also hummingbird must be availlable in the paths mentioned in the instructions.

Something I forgot to mention is also, that I run eMule on top of WINE since eMule is a Windows application and the operating system I use is GNU/LINUX Ubuntu x86-64 ( 64 bit ). Before opening this topic I already considered something wrong in WINE to run Windows applications. ( but I should rather say something not yet complete since WINE is a method to run Windows applications on other operating systems than Microsoft Windows.  )

Now I would like to get back on the idea of the topic, since this topic which I started and Ninja'd myself, is about
how in the future for example a hundreds of thousands of people can have port forwarding.

The only thing that comes up in my limited knowledge is IPv6 in which the last section of the IPv6 address can be anything a client desires. And it means there are far more IPv6 last section numbers than people at the entire earth, so...

But then again, IPv6 was build with people not having to port forward in mind as I understand.

With IPv4 in the opening post I already explained other providers than AirVPN, so I think the future is in IPv6 but,...

Not all software is IPv6 aware or becomes it aware and will continue to require IPv4 and in my example that is eMule as you guessed it.

With torrent like a Ubuntu GNU/LINUX distribution port forwarding works fine and the client is native GNU/Linux so no WINE in between it. Also I did see for example downloading a Linux Distribution shows easily hundreds of connected computers and so my theory of a firewall outside of AirVPN is unlikely.

My current theory is eMule should become IPv6 ready and a native client aMule should be put back in the repositories. ( aMule is the native GNU/Linux version and eMule is the Windows version. )


Since Linux is a kernel I use the term GNU/Linux for desktop GNU/Linux distributions like a famous person always calls it every time.

What I also tried is running windows in a virtual machine but windows is requiring resources especially disk resources which I don't like. Especially Windows 10 requires also so much time to maintain and people that have tried Windows 10 with a classical mechanical HDD know how much disk I/O Windows 10 does.  Windows XP in a virtual machine is no longer possible because even Firefox is no longer working with Windows XP, but it would have been an option. For now I could install Windows 7 in a virtual machine to get eMule running but in that case I need to buy a new SSD since my storage drive has only a few GigaByte cache that would wear out with running a Virtual Machine on it. But buying a new SSD and installing Windows 7 perhaps 8.1 to run eMule would be possible, but $$$ for Microsoft to run a single application and so much time which could be spend better.

So on topic again, what about IPv6

[OpenSourcerer 1435]

On 8/24/2021 at 11:55 AM, Obvious said:

But then again, IPv6 was build with people not having to port forward in mind as I understand.

While true about forwarding as no end user device usually gets public v4 addresses (so they must be mapped on the firewall to the private v4), be advised that the port must still be opened in almost all routers since there's still a firewall involved dropping connections.
 

On 8/24/2021 at 11:55 AM, Obvious said:

My current theory is eMule should become IPv6 ready and a native client aMule should be put back in the repositories. ( aMule is the native GNU/Linux version and eMule is the Windows version. )

You should probably jump ship to BitTorrent as well. eD2k was cool, when it actually was the year 2k. It's like using 2G GSM because it was cool in the 2000s while the world around you is on its way to 5G technology. eMule will most probably never become v6 ready, don't get your hopes up.
 

On 8/24/2021 at 11:55 AM, Obvious said:

Since Linux is a kernel I use the term GNU/Linux for desktop GNU/Linux distributions like a famous person always calls it every time.

Then you should probably start calling your phone Foxconn/Apple. Same logic: It's an iPhone, but if most of the hardware is made by Foxconn, don't you dare leave out Foxconn! They want to be marketed, too!!
Stallman does not really encourage freedom of speech here. Just because people choose to bundle GNU tools in their distribution because it's widely regarded as standard does not mean Stallman's word is law. He also doesn't think highly of freedom of women, so, yeah, think thrice about everything he writes and says.
 

On 8/24/2021 at 11:55 AM, Obvious said:

Windows XP in a virtual machine is no longer possible because even Firefox is no longer working with Windows XP, but it would have been an option.

It is. You only need the last version of Firefox with XP support. Should be Firefox 52 ESR. You can download them quite safely from oldversion.com or so. But, yeah, don't do banking with that system.
 

On 8/24/2021 at 11:55 AM, Obvious said:

So on topic again, what about IPv6

Last year or so Staff mentioned that IPv6 in port forwarding not a priority but on the list. Can't find the post right now, though.

[Oblivion 2013 8]

Linux behavior is very different compared to Windows. In Windows 10 for example a user is able to take over a port anytime when the username is the same. Within Linux different things happen. In this case running eMule in Wine. However within Linux there is something you can do. It requires up to 2 minutes to make a port available for forwarding once it has been used. In Windows as said another program within the same user account could takeover this port anytime. This is not a problem within WINE or a program running on WINE. It is how Linux is designed. And Linux TCP/IP stack is from BSD. Actually it is Windows that is different, and with this difference especially port forwarding also comes running Windows Executables in Wine having different behaviour.

Technical explanation following: THIS IS NOT A BUG, it is how Windows is designed, and Linux BSD IP stack can never follow this since Windows does not follow the design as it should be. However you will never notice this if you use WINDOWS.
 

In case you have a port in use error, wait 2 minutes, no need for
 reboot.

Linger Time. The Linger Time is globally configurable on most
 systems and by default rather long (two minutes is a common value
 you will find on many systems). It is also configurable per
 socket using the socket option SO_LINGER which can be used to
 make the timeout shorter or longer, and even to disable it
 completely. Disabling it completely is a very bad idea, though,
 since closing a TCP socket gracefully is a slightly complex
 process and involves sending forth and back a couple of packets
 (as well as resending those packets in case they got lost) and
 this whole close process is also limited by the Linger Time. If
 you disable lingering, your socket may not only lose data in
 flight, it is also always closed forcefully instead of
 gracefully, which is usually not recommended. The details about
 how a TCP connection is closed gracefully are beyond the scope of
 this answer, if you want to learn more about, I recommend you
 have a look at this page. And even if you disabled lingering with
 SO_LINGER, if your process dies without explicitly closing the
 socket, BSD (and possibly other systems) will linger nonetheless,
 ignoring what you have configured. This will happen for example
 if your code just calls exit() (pretty common for tiny, simple
 server programs) or the process is killed by a signal (which
 includes the possibility that it simply crashes because of an
 illegal memory access). So there is nothing you can do to make
 sure a socket will never linger under all circumstances.

The question is, how does the system treat a socket in state
 TIME_WAIT? If SO_REUSEADDR is not set, a socket in state
 TIME_WAIT is considered to still be bound to the source address
 and port and any attempt to bind a new socket to the same address
 and port will fail until the socket has really been closed, which
 may take as long as the configured Linger Time. So don't expect
 that you can rebind the source address of a socket immediately
 after closing it. In most cases this will fail. However, if
 SO_REUSEADDR is set for the socket you are trying to bind,
 another socket bound to the same address and port in state
 TIME_WAIT is simply ignored, after all its already "half dead",
 and your socket can bind to exactly the same address without any
 problem. In that case it plays no role that the other socket may
 have exactly the same address and port. Note that binding a
 socket to exactly the same address and port as a dying socket in
 TIME_WAIT state can have unexpected, and usually undesired, side
 effects in case the other socket is still "at work", but that is
 beyond the scope of this answer and fortunately those side
 effects are rather rare in practice.

There is one final thing you should know about SO_REUSEADDR.
 Everything written above will work as long as the socket you want
 to bind to has address reuse enabled. It is not necessary that
 the other socket, the one which is already bound or is in a
 TIME_WAIT state, also had this flag set when it was bound. The
 code that decides if the bind will succeed or fail only inspects
 the SO_REUSEADDR flag of the socket fed into the bind() call, for
 all other sockets inspected, this flag is not even looked
 at.

SO_REUSEPORT
SO_REUSEPORT is what most people would expect SO_REUSEADDR to be.
 Basically, SO_REUSEPORT allows you to bind an arbitrary number of
 sockets to exactly the same source address and port as long as
 all prior bound sockets also had SO_REUSEPORT set before they
 were bound. If the first socket that is bound to an address and
 port does not have SO_REUSEPORT set, no other socket can be bound
 to exactly the same address and port, regardless if this other
 socket has SO_REUSEPORT set or not, until the first socket
 releases its binding again. Unlike in case of SO_REUESADDR the
 code handling SO_REUSEPORT will not only verify that the
 currently bound socket has SO_REUSEPORT set but it will also
 verify that the socket with a conflicting address and port had
 SO_REUSEPORT set when it was bound.

SO_REUSEPORT does not imply SO_REUSEADDR. This means if a socket
 did not have SO_REUSEPORT set when it was bound and another
 socket has SO_REUSEPORT set when it is bound to exactly the same
 address and port, the bind fails, which is expected, but it also
 fails if the other socket is already dying and is in TIME_WAIT
 state. To be able to bind a socket to the same addresses and port
 as another socket in TIME_WAIT state requires either SO_REUSEADDR
 to be set on that socket or SO_REUSEPORT must have been set on
 both sockets prior to binding them. Of course it is allowed to
 set both, SO_REUSEPORT and SO_REUSEADDR, on a socket.

There is not much more to say about SO_REUSEPORT other than that
 it was added later than SO_REUSEADDR, that's why you will not
 find it in many socket implementations of other systems, which
 "forked" the BSD code before this option was added, and that
 there was no way to bind two sockets to exactly the same socket
 address in BSD prior to this option.

[Oblivion 2013 8]

The technical details between Windows its interpretation of a TCP/IP stack is different enough that you will encounter problems with software running in WINE, which provides Windows software able to run in LINUX. When port forwarding is lost, you will have to wait 2 minutes, since LINUX does not allow to take over a port within 2 minutes, Windows however does. This can make you think you need to reboot e.g. But that is not necessary. I will contact the eMule developers, since there is something they can do. They can add just a FLAG towards opening a listening socket. As of now eMule socket cannot be available if eMule is shut down and 2 minutes have not expired. This is NOT A BUG, it is how Windows works. Since WINE is meant to mimic Windows with al the bugs and its misinterpretation, you can only accept that software meant for Windows can never run according to LINUX/BSD as it was meant. It is also a commonly known fact that Windows has slightly different incompatibilities to enhance Microsoft dominance. It probably is very wiser to make software running on WINE not to be able to exactly mimic Microsoft. Since eMule is under development, the point of assistance is the currently active maintainer to simply add the flag that the socket is released for port forwarding with permission.

When eMule is closed, the socket is released, LINUX says 2 minutes must expire, however with the FLAG, eMule can be launched and have the socket again. But that requires time for release of eMule to have this enabled.

[UndeN 1]

Hi,
I setup my airvpn to one AC1750 Router and i make port forwarding on 44158 and i check and still show closed!!

Some one can help?


 

[OpenSourcerer 1435]

@UndeN, your post is irrelevant to the topic. Please open your own and give more info on your setup, logs/Eddie support file and anything else you can say.

[Oblivion 2013 8]

If you are new you understand that port forwarding never requires you to setup any port inside your router. This topic is about establishing connection and having port forwarding over the VPN AirVPN tunnel either by OpenVPN or WireGuard.

You should never open ports that you have chosen in AirVPN to forward IN YOUR ROUTER !!!!!!!!!. I consider your comment relevant, since you probably are new.

This topic is about people using AirVPN behind double NAT, and getting open ports for incoming traffic. And yes that works.

The best news I can give you at this moment for me running at linux is the following.

Test at Linux if a port forward is in use:


netstat|grep tcp



netstat|grep udp


You will see your port in use when your application using this ports is running, However, once you use these ports, it takes upto 2 minutes after closing an application before these ports will become out of the WAIT_STATE.

Especially since this topic is about running windows software in WINE at Linux you will see the following:
ESTABLISHED

for a port that is actually forwarded. However if you close the software running on WINE in LINUX, ( Windows Software on WINE on Linux) you will see WAIT_STATE for 2 minutes. There is no reason to disconnect, there is no reason to reboot. It is called LINGER TIME. Windows allows a user to take over a port immediately, LINUX however does not. In Linux just wiat 2 minutes before starting up the Windows Software running in WINE atop of LINUX again.

You can confirm this by running

netstat|grep tcp
netstat|grep udp


The ports in awaiting state go away within 2 minutes, that is default among linux. Windows however allows a user that created this socket connection to take over this socket immediately.




 

[Oblivion 2013 8]

6 hours ago, UndeN said:

I cannot edit this as I wish, a new user has a question.

Edited ... by Oblivion 2013
new user uses port forwarding the wrong way

[Oblivion 2013 8]

Dear Staff please provide new user with hyperlink to startup guide either Windows or Linux considering Port Forwarding. Primary message is as always, never port forwarding inside router is required. Port forwarding is handled bypassing the router or anything else. I do not have the right hyperlink. I assumed people have already knowledge about port forwarding when posting here. I know how it feels when a person responds that it requires port forwarding in their router e.g. Indeed I once had these questions too. As explained, I studied behavior of Windows Software Running on Linux with WINE and everything I eventually had to do was wait 2 minutes before starting a Windows Application that requires open port forwarding inside WINE. But Windows did not require this.

Thank you for your time, and Newbie thinks port forwarding is required in the router, which is never so.

[Oblivion 2013 8]

In Windows a software application that requires a port forwarded needs to manually have an exception in the Windows Firewall. I hope this answers the new user its question. Without Windows Firewall allowing the application software to accept incoming ports it will not work.

You will need to allow an application to have incoming connections. I found a website showing this. This requires an external website.

https://www.groovypost.com/howto/microsoft/allow-program-through-windows-7-firewall/

It shows you allowing an application, you need that application to be allowed, without it, it will not work. There is not much difference between Windows 10 or Windows 8.

Here is a more complicated official Microsoft Website that unfortunately is right but difficult to understand.
https://docs.microsoft.com/en-us/dotnet/framework/wcf/samples/firewall-instructions
 

[UndeN 1]

Hi,

is not windows software bro, is one hotspot how need 44158 open port to work!
and sorry i make mistake whit the topic, not need to be so agresive 😁

[Staff 9972]

@UndeN

Hello!

Please check your ticket before going on with the discussion, it looks like you ignored the answer by the support team member who should have found the fault in your configuration (executive summary: you did not forward remotely port 44158 form your AirVPN account control panel). Also, as a moderator already told you, please do not hijack threads, you already opened your own on the matter, keep the discussion there. By following simple rules and moderator directions you will improve forum readability. Thanks in advance.

Kind regards