wireguard ANSWERED Can't access to DuckDuckGo&ProtonMail on certain computer when using WireGuard.

[Nikolai Stalin 0]

I have 3 computers. Desktop, NAS, and Laptop. All of them installed Windows 10 21H2 and Eddie Version 2.21.2 beta. They are connected to same router, but only Laptop is connected via WiFi. This problem happens only on Desktop and NAS. Exact same setting, but Laptop is fine.

Without VPN connection or when using OpenVPN, there is no problem accessing to DuckDuckGo and ProtonMail.

There were also few other websites I could't access, but I don't remember them. I just need my DuckDuckGo back.

Things I tried to solve the problem:
Use other web browser (Chrome, Edge, IE).
Change VPN server (same country&different country).
Exit Eddie and relaunch.
Reboot computer.
Change WireGuard port 1637 to 47107.
Change DNS address to 10.4.0.1 and fde6:7a:7d20:4::1.
Change DNS address to VPN server's gateway IP address.
Change DNS address from AirVPN's local one (10.128.0.1) to Cloudflare (1.1.1.1).
Delete (at Control Panel, remaining setting files (USERNAME\AppData\Local\Eddie), network adapters and drivers) and reinstall Eddie.
Nothing solved the problem.

[OpenSourcerer 1467]

For all computers, connect, then in Logs tab of Eddie click the lifebelt icon and export it to file. Name the files accordingly, then upload them. Don't paste the output here as many people do, the output of each report is long.

[Nikolai Stalin 0]

Why does everyone call the Red Circular Icon as lifebelt? It looks like a donut to me😁.

I hope some korean words in the files don't bother you. If there is a problem let me know. I'll try my best to translate them to english.

I found out something interesting.
I can access these websites:
https://www.naver.com/
https://dict.naver.com/
https://news.naver.com/

but I can't access these:
https://map.naver.com/
https://land.naver.com/

From second to fifth, they are all same. Subdomains of first one. What makes the difference between them?

Also I found out that I can access to DuckDuckGo and other websites using Tor without exiting Eddie. Why does Tor work fine with WireGuard?

Desktop.txtFetching info... NAS.txtFetching info... Laptop.txtFetching info...

[OpenSourcerer 1467]

  On 12/5/2021 at 12:37 PM, Nikolai Stalin said:

Why does everyone call the Red Circular Icon as lifebelt? It looks like a donut to me😁.

It's the system report, useful for support cases. Support cases are cases where users need help. If someone needs help, you throw a lifebelt to him/her. Ergo, lifebelt icon for a support file that helps users in need.
You can of course throw donuts at them. Begs the question of this action's usefulness for the people in need.

  On 12/5/2021 at 12:37 PM, Nikolai Stalin said:

https://land.naver.com/

This one blocks AirVPN servers, it seems. The other does a HTTP 301 redirect according to the route checker; it's possible that after it a 403 is sent, too. Not so interesting in the end; there could be a valid reason why Maps are blocked.

As for the support files themselves, I should've been clearer. Please close all Eddie instances first and reopen them, then connect. Because on your laptop you made a fresh connection so one can follow the connection logs from the start while on NAS and Desktop the connections seem to have run for some time already. My diff tool therefore marked all the logs as different; difficult to notice details this way. Can you please redo all three with fresh connections?

[Nikolai Stalin 0]

That's weird. Both Land and Map have no problem accessing on Laptop. I checked https://ipleak.net/ to make sure my laptop is properly connected to VPN. It says I'm connected to Iskandar and no DNS leak. I thought my desktop and NAS was the problem until now, but maybe laptop is the weird one?

Oh, I'm really sorry. I never thought of that. Here are your fresh baked ones.

There is a reason why only my laptop had fresh Eddie instance. After waking up computer from suspend or hibernate, Eddie always can't connect to any of the AirVPN servers. It seems like he's stuck and looping at some point. Someday I left Eddie for almost 2 hours but he was still connecting. The only way to use VPN again is exiting and reopening Eddie. At least killing Eddie solve this problem, I'm okay with it.

 

Desktop-2.txtFetching info... NAS-2.txtFetching info... Laptop-2.txtFetching info...

[Air4141841 30]

to be honest I had this EXACT issue yesterday.   and uninstalled Wireguard from my Pfense router for like the 5th time.

I ended up reading up more and found my MTU was set to 1480.   when I deleted my keys and redid them to 1420.  within the new interface it started to work again.  and is working right now 

no idea if this will help you.  but it is working right now for me on a US server and on pfsense again with the new MTU settings 

[Nikolai Stalin 0]

Where can I change the MTU value?

Found one at router settings page. Changed it from default 1500 to 1420. No luck. I think MTU setting here doesn't affect Eddie.

The other one was at network adapter's properties. But it was about Jumbo Frame and already set to 9KB.

[OpenSourcerer 1467]

I went through the logs but struggled a bit to find any notable differences. The config is very similar (existing differences don't relate to networking at all), the logs are largely similar. I noticed that the laptop had old routes still active. Probably because of standby, OpenVPN can't clear the routes in this case. If you reboot (not shutdown + startup), they should be gone, but they shouldn't relate to your problem in the first place.
If it's not an issue, use OpenVPN for the time being.

[Air4141841 30]

  On 12/6/2021 at 6:22 AM, Nikolai Stalin said:

Where can I change the MTU value?

Found one at router settings page. Changed it from default 1500 to 1420. No luck. I think MTU setting here doesn't affect Eddie.

The other one was at network adapter's properties. But it was about Jumbo Frame and already set to 9KB.

the interface setup page created for the new wireguard tunnell
1420 on both mtu and mss works for me 

then I believe you have to restart the wireguard service within pfsense 

[SurprisedItWorks 52]

1420 will generally work for router wireguard if the router itself is set at MTU=1500, the usual default for ethernet. They need to differ by 80 or more for a wireguard system that supports both IPv4 and IPv6 (even if you only use IPv4). 

This is a crude summary. MTU is a complex subject. Just be aware that (1) it's a maximum packet size in bytes (2) there may be many MTU settings in a system, because of where encryption overhead and overhead for UDP, TCP, and IP packaging gets added to the packet, and (3) you can usually get away with setting an MTU a little low, but setting it too high can totally stop everything. 

[Nikolai Stalin 0]

I just give up. Back to OpenVPN until WireGuard works well.

Everythings fine with OpenVPN except much slower download speed. Average 4Mbit/s from South Korea to AirVPN's Japanese server with OpenVPN. 200MBit/s with WireGuard. Tried Changing protocols at Eddie preferences, nothing helped, even TCP made download speed slower.

I hope WireGuard stable version works fine for both my computers.

[OpenSourcerer 1467]

Guess so. But hey, don't rule out a VPN provider change, alright? No one aims to bind you to something you're not satisfied with. If AirVPN doesn't work for you, you can always try another provider, see if it works better for your setup and use case. It's just the way it is.

[Nikolai Stalin 0]

Another VPN provider, like ExpressVPN?

Just kidding 😂. I used ExpressVPN before. It was faster, more stable and easier to use. But NO Port Forwarding. That's why I moved to AirVPN. Also much cheaper price. Air is about 60% cheaper per year than Express even without Black Friday discount. On Black Friday, only 1/4 of Express!

I like AirVPN. Not 100% satisfied, but 80% satisfied. There are small problems but I can accept them. I won't go back to Express.

[OpenSourcerer 1467]

  On 12/10/2021 at 4:30 AM, Nikolai Stalin said:

I like AirVPN. Not 100% satisfied, but 80% satisfied. There are small problems but I can accept them. I won't go back to Express.

There's more than ExpressVPN… but yeah, can't argue with the choice.