Leaderboard

… I'm not that old, though… 😕 Anyway, you're welcome.

Here is the script/systemd service that I use on my own home server: https://github.com/zimbabwe303/WireGuard-rotate-AirVPN By default it is set up for use with AmneziaWG but it is very easy to switch to the standard WireGuard client, just change the following variables at the beginning of wg_rotate.sh: wg_quick=wg-quick wg=wg amnezia_ENABLE=0 Basically it is able to go through a randomized list of servers completely automatically, either by timer or by an external trigger (the trigger is a file created either manually or by a cronjob). It connects to a server, tests the connectivity and moves to another one if this one is down or unstable. You don't need to create the full list of servers yourself, just the short list with wildcards (e.g. AirVPN_wg/AirVPN_AT-*_UDP-47107*.conf).

Hello! Some customers have contacted the support team asking for a comment on the port shadow attack described in CVE-2021-3773 and brought into the spotlight for the umpteenth time during the Privacy Enhancing Technologies Symposium 2024: https://citizenlab.ca/2024/07/vulnerabilities-in-vpns-paper-presented-at-the-privacy-enhancing-technologies-symposium-2024/ To explain why, unlike many other VPN services, AirVPN is not vulnerable to various attacks under the generic port shadow umbrella, please download the new paper and read below while watching table 2 on page 121: in our infrastructure public entry-IP addresses and public exit-IP addresses are not the same (M6). This is an absolute protection against ATIP, connection inference, and port forwarding overwrite and also makes port scan impossible (another reason for which port scan is impossible is given by additional isolation, see the end of the message) per-host connection limit is enforced (M3) making eviction re-route extremely difficult if not impossible static private IP address is implemented (M2) with WireGuard (it can be changed by explicit key renewal user's action) and highly likely with OpenVPN as long as the user connects to the same server with the same key, another (redundant) protection against port scan In our infrastructure additional protections are in place. We prefer not to disclose them all at the moment, we will just mention the block of any communication between nodes in the same virtual network either through private or public addresses. That's why, unlike any corporate VPN with shared resources, you can't contact any service inside the VPN (except the DNS), not even your own, from a machine connected to the same VPN in our infrastructure. Decapsulation as described on the paper is doomed to fail for this isolation/compartmentalization and this is also another reason for which port scans are not possible. TL;DR AirVPN infrastructure, according to the current state of the art in remediation and mitigation by security researchers as well as paper authors, is not vulnerable to the attacks described under the port shadow umbrella in this new paper. Kind regards & datalove AirVPN Staff

Perhaps Air could allow port forwarding on selected servers only and not all of them. This could allow for users that want to torrent, still being able to, but with a limited server choice while all the other servers could be kept 'clean'.