AirVPN servers pushing IPv6, killing connection

[jdelliott 0]

I have set ipv6 to off in both bluetit.rc and goldcrest.rc, and yet the AirVPN servers are still sending an IPv6 address, which is not supported in my setup, and it's killing the connection. It has worked great for a long time not, this is recent. I am using a Debian LXC on proxmox. 

Error:

AirVPN Username: 
AirVPN Password for user jdelliott@gmail.com: 
2025-08-02 06:12:36 Bluetit - AirVPN OpenVPN3 Service 1.3.0 - 1 June 2023
2025-08-02 06:12:36 OpenVPN core 3.8.4 AirVPN linux x86_64 64-bit
2025-08-02 06:12:36 Copyright (C) 2012-2022 OpenVPN Inc. All rights reserved.
2025-08-02 06:12:36 OpenSSL 3.0.16 11 Feb 2025
2025-08-02 06:12:36 Bluetit is ready
2025-08-02 06:12:36 Bluetit options successfully reset
2025-08-02 06:12:36 Bluetit successfully set to command line options
2025-08-02 06:12:36 Requesting AirVPN connection to Bluetit
2025-08-02 06:12:37 Network filter and lock are using nftables
2025-08-02 06:12:37 ERROR: system 'modules.builtin' does not exist.
2025-08-02 06:12:37 Network filter successfully initialized
2025-08-02 06:12:37 Session network filter and lock successfully enabled
2025-08-02 06:12:37 ERROR: NetFilter::commit(): Cannot commit item. (rule: insert rule ip filter OUTPUT ip daddr bootme.org/32 counter accept)
2025-08-02 06:12:37 AirVPN bootstrap servers are now allowed to pass through the network filter
2025-08-02 06:12:37 Logging in AirVPN user 
2025-08-02 06:12:37 AirVPN user successfully logged in
2025-08-02 06:12:37 Selected user key: PfSense
2025-08-02 06:12:37 Auto quick connection mode enabled
2025-08-02 06:12:37 Starting quick OpenVPN connection to AirVPN server Telescopium, Vancouver (Canada)
2025-08-02 06:12:37 Trying protocol UDP, port 443, IP entry 3
2025-08-02 06:12:37 Starting OpenVPN Connection
2025-08-02 06:12:37 TUN persistence is enabled.
2025-08-02 06:12:37 Network lock set to 'nftables' by Bluetit policy
2025-08-02 06:12:37 OpenVPN core 3.8.4 AirVPN linux x86_64 64-bit
2025-08-02 06:12:37 Frame=512/2112/512 mssfix-ctrl=1250
2025-08-02 06:12:37 NOTE: This configuration contains options that were not used:
2025-08-02 06:12:37 Unsupported option (ignored)
2025-08-02 06:12:37 6 [resolv-retry] [infinite]
2025-08-02 06:12:37 8 [persist-key]
2025-08-02 06:12:37 9 [persist-tun]
2025-08-02 06:12:37 11 [explicit-exit-notify] [5]
2025-08-02 06:12:37 EVENT: RESOLVE
2025-08-02 06:12:37 Local IPv4 address 192.168.101.110
2025-08-02 06:12:37 Local interface eth0
2025-08-02 06:12:37 Setting up network filter and lock
2025-08-02 06:12:37 Allowing system DNS 192.168.101.1 to pass through the network filter
2025-08-02 06:12:37 ERROR: Cannot allow system DNS to pass through network filter
2025-08-02 06:12:37 Adding IPv4 server 192.30.89.53 to network filter
2025-08-02 06:12:37 ERROR: Cannot activate network filter and lock
2025-08-02 06:12:37 Contacting 192.30.89.53:443 via UDP
2025-08-02 06:12:37 EVENT: WAIT
2025-08-02 06:12:37 Connecting to [192.30.89.53]:443 (192.30.89.53) via UDPv4
2025-08-02 06:12:38 EVENT: CONNECTING
2025-08-02 06:12:38 Tunnel Options:V4,dev-type tun,link-mtu 1585,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA512,keysize 128,key-method 2,tls-client
2025-08-02 06:12:38 Peer Info:
IV_VER=3.8.4 AirVPN
IV_PLAT=linux
IV_NCP=2
IV_TCPNL=1
IV_PROTO=990
IV_MTU=1600
IV_CIPHERS=AES-256-GCM:AES-128-GCM:BF-CBC
UV_IPV6=no
IV_GUI_VER=Bluetit - AirVPN OpenVPN3 Service 1.3.0
IV_SSL=OpenSSL 3.0.8 7 Feb 2023
IV_BS64DL=1

2025-08-02 06:12:38 VERIFY OK: depth=1, /C=IT/ST=IT/L=Perugia/O=airvpn.org/CN=airvpn.org CA/emailAddress=info@airvpn.org, signature: RSA-SHA512
2025-08-02 06:12:38 VERIFY OK: depth=0, /C=IT/ST=IT/L=Perugia/O=airvpn.org/CN=Telescopium/emailAddress=info@airvpn.org, signature: RSA-SHA512
2025-08-02 06:12:38 SSL Handshake: peer certificate: CN=Telescopium, 4096 bit RSA, cipher: TLS_CHACHA20_POLY1305_SHA256   TLSv1.3 Kx=any      Au=any   Enc=CHACHA20/POLY1305(256) Mac=AEAD

2025-08-02 06:12:38 Session is ACTIVE
2025-08-02 06:12:38 EVENT: GET_CONFIG
2025-08-02 06:12:38 Sending PUSH_REQUEST to server...
2025-08-02 06:12:39 Sending PUSH_REQUEST to server...
2025-08-02 06:12:39 OPTIONS:
0 [redirect-gateway] [ipv6] [def1] [bypass-dhcp]
1 [dhcp-option] [DNS] [10.19.14.1]
2 [dhcp-option] [DNS6] [fde6:7a:7d20:f0e::1]
3 [tun-ipv6]
4 [route-gateway] [10.19.14.1]
5 [topology] [subnet]
6 [ping] [10]
7 [ping-restart] [60]
8 [ifconfig-ipv6] [fde6:7a:7d20:f0e::10a0/64] [fde6:7a:7d20:f0e::1]
9 [ifconfig] [10.19.14.162] [255.255.255.0]
10 [peer-id] [3]
11 [cipher] [AES-256-GCM]
12 [protocol-flags] [cc-exit] [tls-ekm] [dyn-tls-crypt]
13 [tun-mtu] [1500]

2025-08-02 06:12:39 PROTOCOL OPTIONS:
  cipher: AES-256-GCM
  digest: NONE
  ncp enabled: yes
  key-derivation: TLS Keying Material Exporter [RFC5705]
  compress: NONE
  peer ID: 3
  control channel: tls-crypt enabled
2025-08-02 06:12:39 EVENT: ASSIGN_IP
2025-08-02 06:12:39 ERROR: Cannot add address fde6:7a:7d20:f0e::10a0 pushed by the server. IPv6 is not available in this system
2025-08-02 06:12:39 TUN Error: tun_prop_error: tun_builder_add_address IPv6 failed
2025-08-02 06:12:39 EVENT: TUN_SETUP_FAILED [FATAL ERROR] tun_prop_error: tun_builder_add_address IPv6 failed
2025-08-02 06:12:39 ERROR: TUN_SETUP_FAILED
2025-08-02 06:12:39 EVENT: DISCONNECTED
2025-08-02 06:12:39 WARNING: Backup copy of resolv.conf not found. DNS settings do not need to be restored.
2025-08-02 06:12:39 ERROR: item has no associated handle (rule: add rule ip filter OUTPUT ip daddr bootme.org/32 counter accept)
2025-08-02 06:12:39 Session network filter and lock rollback successful
2025-08-02 06:12:39 Client exception in transport_recv: tun_exception: not connected
2025-08-02 06:12:39 Waiting for pending threads to finish
2025-08-02 06:12:42 Logging out AirVPN user 
2025-08-02 06:12:42 Session network filter and lock are now disabled
2025-08-02 06:12:42 Bluetit session terminated

[Staff 10232]

@jdelliott

Hello!

Thank you, we will investigate. It looks like the server sends IPv6 push even when UV_IPV6 environment variable is not sent out by the client. In the meantime can you please check a connection over WireGuard? Since there is no push with a WireGuard connection, but all the addresses must be set earlier on client side, the problem should not occur.

Kind regards