ANSWERED Enter from one country, exit from another

[fhopper 0]

Hi there. I've been connecting (from Miami) directly to the Airvpn servers in Sweden and Netherlands for a few years now but have recently noticed that speedtest-cli shows really low speeds (<10Mb down and up) in my (wireguard on linux) airvpn namespace. If i connect to an Airvpn server near Miami, I get full speeds (321Mb down 288Mb up). I'm beginning to wonder if my ISP is the cause for the slow speeds when connecting to the Sweden/Netherlands servers. Is it possible to enter Airvpn from Miami but have my exit IP (public IP) be from an Airvpn server in a different country?

[OpenSourcerer 1441]

On 3/9/2024 at 3:07 PM, fhopper said:

Is it possible to enter Airvpn from Miami but have my exit IP (public IP) be from an Airvpn server in a different country?

It's not. The only exception is if you're trying to reach supported websites through the rerouting feature.

[reversevpn 4]

Actually, it is possible to chain AirVPN connections so that you enter from one country and exit from another, if you are using Linux. Keep in mind though that doing so will consume 2 airvpn sessions out of the 5 you are allowed instead of just 1.

To do that, here are the steps you need to follow:
1. Set up a systemd-nspawn container that connects to the AirVPN server in Miami
2.  Keep in mind the entry ipv4 of the AirVPN server you want to exit from. You can find this in the Endpoint= line in the wireguard conf you download.
3.  Set up IP Masquerading in the container from step 1 using iptables -t nat -A POSTROUTING -i host0 -o (name of AirVPN wireguard interface) -j MASQUERADE
4. Remember to also allow ip forwarding on both the contaienr and the host machine
5.  On the host machine, run ip rule add to (whatever entry address the miami server has) lookup main and ip route add (whatever the entry address of the airvpn server you want to exit from is) via (whatever the address of the systemd-nspawn container is).
6. Adjust the MTU of the inner VPN(the one where you want to exit from) to 1340
7. Start the inner VPN
8. Run ip rule show. Make sure that whatever ip rule that wiregaurd setup has a lower priority than the rule you entered in step 4.

If you need more help, feel free to ask.

Edited ... by reversevpn
removed "to" from ip route add command

[Stalinium 47]

Sure technically it is possible. It comes with caveats especially the troubles caused by MTU size mismatches are a hassle to diagnose and resolve. If you asked me, that's the reason most clients and providers don't attempt it. There's very tiny benefit overall. Yet the downside to VPNs of double the traffic.

You are right, this may be an issue with your ISP. Maybe they changed the routing and it's *only* an MTU issue... again. If you have IPv6 try to connect via IPv6.

It's doable on Windows + OpenVPN too with a lot of careful config commands to set up a correct route. An easier approach is to nest virtual machines here are 2 examples:

Host OS: Connected to server 1
Guest OS: NAT Network (uses host's connection, vpn via s1 here) + connected to server 2. Do your browsing inside guest to access internet via isp-s1-s2-internet

Alternatively you do not connect to VPN on Host OS, but Guest1 is connected to S1 and inside Guest1 you run another nested (sic) VM Guest2 that connects to S2.