Leaderboard

Nonono, I meant.. why do you have 67 DNS servers and call it normal when it clearly isn't?

Hello all, This is collection from different tutorials which I will refer here, but usually changed since some things changed. Setting up VPN on Synology is modified neolefort tutorial from here and reconnect script if from sundi which you can find here, which probably modified this script, plus my iptables for blocking Synology on router level when VPN fails. Other contributions: foobar666 - you no longer need to enter variables manually _sinnerman_ - fixed script for DS 6.1 I'm doing this mostly because I usually forget things I managed to solve after year or two, so this is way to have constant reminder how it was solved and also help others. 1. Get your certificates from AirVPN. Go to the https://airvpn.org/generator/ page to generate the configuration file. (1) SELECT the Advanced Mode (under "Config generator" title ) (2) SELECT LINUX OS (3) Under "Protocols" section select one with protocol UDP, port 443 and tls-auth in the right column (at the time of writing, it was in middle of the list). You can choose any combination of protocol/port, but then also change iptables accordingly if you are using failsafe script. Don't choose any combination which has tls-crypt in the right column. (4) Under "Advanced - OpenVPN only" section (right part of page), toggle "Separate keys/certs from .ovpn file" button and change/leave OpenVPN version to 2.5 (This works in DSM 7.2.1. For older versions you will maybe have to select OpenVPN version 2.4). (5) SELECT 1 SERVER (refer to section "by single servers") OR COUNTRY OR ANYTHING ELSE YOU WANT In original tutorial, neolefort said to choose 1 server, because in that case you will get IP instead of xxx.airvpn.org domain. Choosing 1 server is safe because it doesn't need working DNS when you want to connect to VPN. If you choose anything else, you need working DNS on your router when establishing VPN connection. (6) Click "GENERATE" at the bottom. (7) Page will reload with links on top to your files, save them to you computer. Following files will be generated: -AirVPN_XXXXX_UDP-443.ovpn -ca.crt -user.crt -user.key -ta.key 2. Setup AirVPN on Synology. - Login as admin or with user from Administrator group. - Open Control panel. - Go "Network" and click on tab "Network Interface" - Click on button "Create" - "Create VPN profile" - Choose "OpenVPN (via importing .ovpn file)" - Click "Advanced options" so it shows all options - Profile name: anything you want, but please keep is short and if you can without spaces " ", for example "AirVPN". - User name: LEAVE EMPTY (for DSM 7+ just put anything here) - Password: LEAVE EMPTY (for DSM 7+ just put anything here) - Import .ovpn file: click button and import your AirVPN_XXXXX_UDP-443.ovpn - CA certificate: click button and import your ca.crt - Client certificate: click button and import your user.crt - Client key: click button and import your user.key - Certificate revocation: LEAVE EMPTY - TLS-auth key: click button and import your ta.key - Click "Next" - Select all options and click "Done" Now you have working OpenVPN link on your Synology. You just need to start it from "Control panel" - "Network" - "Network Interface". If you want to make your connection faster, you can remove some ciphers. Look for this line in .ovpn file: data-ciphers AES-256-GCM:AES-256-CBC:AES-192-GCM:AES-192-CBC:AES-128-GCM:AES-128-CBC And change it to this: data-ciphers AES-128-GCM Then save file and create new connection with it. After some testing I found out AES-128-GCM is fastest from all other mentioned in settings. You can also test other ciphers your self and leave one you find fastest. EXTRAS!!! 3. Setting up external access to your Synology. First what you will notice is, "I CAN'T ACCESS MY SYNOLOGY FROM OUTSIDE OF MY LAN!!!!!!! OMG OMG OMG!!!!" I will not explain port fowards on your router here, if you don't know how to make one, learn! (1) You can port forward trough AirVPN webpage and access your Syno via VPN exit IP. This sometimes works, most of times it doesn't since Syno has some ports you cannot change. Anyway, change your default HTTP / HTTPS port on Syno to your forwarded AirVPN port and you should be fine. But forget about Cloudstation and similliar things. (2) If you want to access Syno via you ISP IP (WAN), then problem is, your Syno is receiving your connection, but it's replying trough VPN. That's a security risk and those connections get droped. But there is solution! - Access "Control panel" - "Network" - "General" - Click "Advanced Settings" button - Mark "Enable multiple gateways" and click "OK" and then "Apply" You're done! It's working now (if you forwarded good ports on your router). 4. Prevent leaks when VPN connection on Synology fails. There will be time, when you VPN will fail, drop, disconnect, and your ISP IP will become visible to world. This is one of ways you can prevent it, on router level. For this you need Tomato, Merlin, DD-WRT or OpenWRT firmware on your router. I will tell you steps for Tomato router. If you are using different firmware, then you need to learn alone how to input this code into your router. Since Shibby version 129 for ARM routers, syntax of iptables changed and depending on which version of iptables you are using, apply that code. - Login to your router (usually just by entering 192.168.1.1 into your browser, if your IP is different, find out which is your gateway IP). - Click on "Administration" - Click on "Scripts" - Choose tab "Firewall" For Shibby v129 for ARM and later (iptables 1.4.x) us this: #Use this order of commands because it executes in reverse order. #This command will execute last, it kills all UDP requests. iptables -I FORWARD -p udp -s 192.168.1.100 -j REJECT #This command will execute second and will block all TCP source ports except those needed for web access or services iptables -I FORWARD -p tcp -s 192.168.1.100 -m multiport ! --sports 5000,5001,6690 -j REJECT #This command will execute first and will ACCEPT connection to your VPN on destination port 443 UDP iptables -I FORWARD -p udp -s 192.168.1.100 -m multiport --dports 443 -j ACCEPT For earlier Shibby versions and later for MIPS routers: #Use this order of commands because it executes in reverse order. #This command will execute last, it kills all UDP requests. iptables -I FORWARD -p udp -s 192.168.1.100 -j REJECT #This command will execute second and will block all TCP source ports except those needed for web access or services iptables -I FORWARD -p tcp -s 192.168.1.100 -m multiport --sports ! 5000,5001,6690 -j REJECT #This command will execute first and will ACCEPT connection to your VPN on destination port 443 UDP iptables -I FORWARD -p udp -s 192.168.1.100 -m multiport --dports 443 -j ACCEPT Port TCP 5000 = HTTP for for Synology web access (change to your if it's not default) Port TCP 5001 = HTTPS for for Synology web access (change to your it's not default) Port TCP 6690 = Cloud Station port Port UDP 443 = AirVPN connection port which you defined in step 1 of this tutorial. If you are using TCP port, then you need to change "-p udp" to "-p tcp" in that line. If you need more ports, just add them separated by comma ",". If you want port range, for example 123,124,125,126,127, you can add it like this 123:127. Change IP 192.168.1.100 to your Synology LAN IP. Be careful NOT TO assign those ports to your Download Station on Synology. This isn't perfect, you can still leak your IP through UDP 443, but since torrent uses mostly TCP, those chances are minimal. If you use TCP port for VPN, then those chances increase. If you really want to be sure nothing leaks even on UDP 443 (or your custom port), you need to choose 1 (ONE) AirVPN server. You need to find that server entry IP and change last IPTABLES rule to something like this: iptables -I FORWARD -p udp -s 192.168.1.100 -d 123.456.789.123 -m multiport --dports 443 -j ACCEPT Where 123.456.789.123 is AirVPN server entry IP. This will allow UDP 443 only for that server, rest will be rejected by router. These are all my opinions, from my very limited knowledge, which may be right and may be wrong. 5. Auto reconnection when VPN is down. Since when you made your VPN connection on your Synology, you checked "Reconnect" option, Syno will try to reconnect automaticly when connection fails. But in some cases, your network will be offline long enough and Syno will stop trying to reconnect, or will hang with VPN connection established, but not working. In those cases you can use this auto reconnect script. This is reconnect script. Just select all script text and copy it. #VPN Check script modified Sep 11, 2016 #Script checks if VPN is up, and if it is, it checks if it's working or not. It provides details like VPN is up since, data #received/sent, VPN IP & WAN IP. #If VPN is not up it will report it in the log file and start it #Change LogFile path to your own location. #Save this script to file of your choosing (for example "synovpn_reconnect"). Store it in one of your Synology shared folders and chmod it: "chmod +x /volume1/shared_folder_name/your_path/synovpn_reconnect" #Edit "/etc/crontab" and add this line without quotes for starting script every 10 minutes: "*/10 * * * * root /volume1/shared_folder_name/your_path/synovpn_reconnect" #After that restart cron with: "/usr/syno/sbin/synoservicectl --restart crond" #!/bin/sh DATE=$(date +"%F") TIME=$(date +"%T") VPNID=$(grep "\[.*\]" /usr/syno/etc/synovpnclient/openvpn/ovpnclient.conf | cut -f 2 -d "[" | cut -f 1 -d "]") VPNNAME=$(grep conf_name /usr/syno/etc/synovpnclient/openvpn/ovpnclient.conf | cut -f 2 -d "=") LogFile="/volume1/filmovi/Backup/airvpn/check_airvpn_$DATE.log" PUBIP=$(curl -s -m 5 icanhazip.com) #PUBIP=$(curl -s -m 5 ipinfo.io/ip) #PUBIP=$(curl -s -m 5 ifconfig.me) CHECKIP=$(echo $PUBIP | grep -c ".") start_vpn() { echo "VPN is down. Attempting to (re)start now." >> $LogFile # /usr/syno/bin/synovpnc kill_client --protocol=openvpn --name=$VPNNAME /usr/syno/bin/synovpnc kill_client /bin/kill `cat /var/run/ovpn_client.pid` 2>/dev/null sleep 35 echo 1 > /usr/syno/etc/synovpnclient/vpnc_connecting echo conf_id=$VPNID > /usr/syno/etc/synovpnclient/vpnc_connecting echo conf_name=$VPNNAME >> /usr/syno/etc/synovpnclient/vpnc_connecting echo proto=openvpn >> /usr/syno/etc/synovpnclient/vpnc_connecting /usr/syno/bin/synovpnc reconnect --protocol=openvpn --name=$VPNNAME >> $LogFile } sleep 6 echo "======================================" >> $LogFile echo "$DATE $TIME" >> $LogFile if ifconfig tun0 | grep -q "00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00" then if [ "$CHECKIP" == 1 ] then IPADDR=$(/sbin/ifconfig tun0 | grep 'inet addr' | cut -d: -f2 | awk '{print $1}') RXDATA=$(/sbin/ifconfig tun0 | grep "bytes:" | cut -d: -f2 | awk '{print $1,$2,$3}') TXDATA=$(/sbin/ifconfig tun0 | grep "bytes:" | cut -d: -f3 | awk '{print $1,$2,$3}') UPTIME=$(cat /var/log/messages | grep "$IPADDR" | awk '{print $1}' | tail -1) UPTIME=$(date -d"$UPTIME" +"%Y/%m/%d %H:%M:%S") echo "VPN is up since: $UPTIME" >> $LogFile echo "Session Data RX: $RXDATA" >> $LogFile echo "Session Data TX: $TXDATA" >> $LogFile echo "VPN IP is: $IPADDR" >> $LogFile echo "WAN IP is: $PUBIP" >> $LogFile else start_vpn fi else start_vpn fi exit 0 (1) Login to you Synology DSM web interface as admin. - As admin go to "Control panel" - "Task Scheduler" (you need to enable advanced mode in top right corner of control panel for this) - Click "Create" button near top of page, then select "Scheduled Task" and then "User-defined script" (2) New popup window will open. - under "Task:" enter task name - under "User:" select "root" if it's not already selected - switch to "Schedule" tab and select how often you want this task to run, my settings are: - "Run of following days" - "Daily" - "First run time" - 00:00 - "Frequency" - "Every 10 minutes" - "Last run time" - 23:50 - switch to "Task settings" tab - paste script you copied into empty box under "User-defined script" title - press OK and you're done I tested this on DSM 6.2.2 and it works without problems for now. Still, I'm keeping old instructions in next post, if someone wants to do it like that. Tip: If you don't want logfile, you can comment out those lines, or remove ">> $LogFile" code from whole script. That's all. If you entered everything correctly, you should be fine and ready to go! Comments are welcome. If you find mistakes, please correct me.

Hello! We proudly announce that today AirVPN has become an Electronic Frontier Foundation "Super Major Donor". The Electronic Frontier Foundation is the leading nonprofit organization defending civil liberties in the digital world. Founded in 1990, EFF champions user privacy, free expression, and innovation through impact litigation, policy analysis, grassroots activism, and technology development. We work to ensure that rights and freedoms are enhanced and protected as our use of technology grows. https://www.eff.org Check our mission page: https://airvpn.org/mission Kind regards and datalove AirVPN Staff

Hello! We inform you that we have started contributions to Chelsea Manning's legal fund. We are proud to contribute to it but not "glad", meaning that in a really democratic and free country Chelsea Manning would not be detained indefinitely for her refusal to testify before a grand-jury (*) in matters that she exhaustively treated before a court martial, and would not need a legal fund at all by now. (*) A grand jury means that the public is not allowed entry: the hearings are held in secret She disclosed nearly 750,000 military and diplomatic documents to WikiLeaks revealing, amongst many other things, war crimes. I will not participate in a secret process that I morally object to, particularly one that has been used to entrap and persecute activists for protected political speech. Chelsea Manning Manning should be regarded as a hero. [...] doing what an honest, decent citizen should be doing: letting your population know what the government, the people who rule you are doing. They want to keep it secret of course. Noam Chomsky Action Network page for Manning's legal fund donations: https://actionnetwork.org/fundraising/chelsea-manning-needs-legal-funds-to-resist-a-grand-jury-subpoena Check our mission page: https://airvpn.org/mission Kind regards and datalove AirVPN Staff

I agree, an option about datetime formats. As soon as possible, promised.

Yeah, I understand that this cat and mouse game must be annoying for vpn operators. It's not that much of a deal to switch servers manually anyway. Just a small correction though, it's not just airvpn that's blocked by zippy but many German IPs, there was an article on heise about it: https://www.heise.de/newsticker/meldung/Filehoster-Zippyshare-sperrt-Nutzer-in-Deutschland-aus-4408980.html

IPLeak.net is completely unreachable for me today. I hope it's a maintenance issue as I've been using the site happily for a few years now. What alternatives are there of the same quality?

Excuse me, what the hell? You sure?

In Google's case it's basically tax deductions and good PR.

@giganerd Hello! It's an interesting consideration. In nowadays world some choices are hard, either because you do not have enough evidence or because astroturfing and other operations are ongoing. At some point you must make a decision. We have carefully evaluated EFF operations especially on legal and law procedural grounds, software releases and informative/educational articles, and we have found an outstanding work. We do not believe that Google huge sponsoring amount might impair EFF operations in the field of privacy (which is in our opinion a threat to Google current model and even more in the growing practical AI applications), at least not in the near future, and we hope that this is not the beginning of a "capture by sponsorship" (something which sinisterly reminds "regulatory capture" by big companies, although the means are different) which happened multiple times, for example with newspapers and publishers: I am a giant company and progressively buy your newspaper spaces for my ads, until you depend on me economically; then one day I tell you "do not publish that, rather publish this, or else I will withdraw all of my ads from one day to another". Take Tor, as an additional example. It's no secret that we have significantly supported Tor and the Tor Project in the last years. However, the Tor Project has been funded almost entirely by the former Broadcasting Board of Governors (BBG, now USAGM), the US Navy and the US Department of State bureau for Human Rights for years. Is this enough reason to drop Tor and not use it anymore? No, because we have total lack of substantial evidence about backdoors to favor any the mentioned agencies or anybody else, and that a person that should be above any suspect under this context (Edward Snowden) recommends Tor usage. Eyes must always remain wide open but at the same time if you get lost in a network of theories and you see conspirators everywhere you risk to get stuck and never act. Kind regards

I'm not sure how to judge Google's 1M donation to the EFF, though. Is this a good sign or a downright sign that EFF does things in favor of Google? One does not simply donate such a sum to someone, especially if you're a tech giant donating to a tech-oriented organization.

Updated to reflect changes on 03-Aug-18 (previously, access was blocked from most servers).

hi, I have Android 7.1.2 on a Google Pixel XL, and the braniacs at Google designed a phone that does NOT support an SD card. :-( I cannot move the .ovpn files to an SD card, so Hexane's workaround will not work for me. The .opvn files are thus still stuck in gray limbo. Can anyone offer a workaround? Thanks. nevermind. figured out a fix - chose import from phone and manually chose download directory. Seems to have worked. Go figure. ;-)

Hello, I was having the exact same problem, this seems to have fixed it for me: https://airvpn.org/topic/20812-very-very-slow-dns-lookup/ (Although, I didn't disable IPV6 anywhere) ​Hi all... Okay so I appear to have fixed this. Don't ask me why this worked and the first step may be unnecessary but it worked for me: ​1. Disable IPV6 everywhere: Both adapters, OS and Router. This on it's own didn't fix the problem. ​2. Set the TAP adapter to a lower metric than your network adaptor: ​ ​1. Network connections -> Adapter Settings -> TAP-Windows Adapter V9 -> Properties -> Internet Protocol Version 4 (TCP/IPv4) -> Properties -> Advanced ​Uncheck Automatic Metric Interface Metric == 14 2. Network connections -> Adapter Settings -> Ethernet -> Properties -> Internet Protocol Version 4 (TCP/IPv4) -> Properties -> Advanced ​Uncheck Automatic Metric Interface Metric == 15 ​ This second step instantly fixes the problem for me. If I set the metrics to the same value or automatic the problem instantly comes back. ​Let me know if this works for you and Happy Holidays xx

Website: http://www.leonardo.tv/ Italian TV Streaming Status: OK Routing: All servers to IT route.