Leaderboard

I currently run a linux firewall without eddie and just use openvpn client. here is what i did to protect against dns leaks and maintain privacy. i don't use windows because of privacy concerns so i don't know how well this translates. assuming you have a layer 3/4 firewall, you can try this. the network: set the interface to start disabled on bootup. this is not necessary, but will work if you're firewall is not default. then you can set your firewall before the interface is open. nothing can leak during boot because the interface did not come up. in the firewall: set policy to block on input (inbound), output, and forward (or whatever windows equivalent is). this should be the default action in case there are no specific rules to catch particular traffic. setting this means nothing passes the firewall unless you explicitly allow it. set all rules with tracking (ct state), such that no inbound traffic is allowed unless it is a response from a request you sent out. only exception is icmp and other network diagnostic protocols like traceroute, which in my opinion should be open. icmpv6 should be selectively open since it also does network setup. log all blocked traffic on the physical interface: open source and destination port 67/68, udp, inbound and outbound so your ISP can give you an IP. configure your client to not accept the dns it will give you. open destination upd port 53 or 853 only for specific IPs, typically a public DNS that advertises no logs. this is your fall back in case vpn drops or if you connect to vpn using a domain name. your ISP will see this traffic, but it will not be destined to your ISP DNS. it will pass through and go to the server you specify. i am not yet convinced encrypted dns actually hides your dns, but i would consult with a network admin. open destination tcp/udp port 1194 (or whatever port you are using for VPN). Do not use port 443 for VPN as that is the same port for https website traffic. Note: broadly speaking, destination port 53 and 853 will not be open, blocking dns leaks. this is permanent i used to have to open port 80 for AirVPN IPs to make the initial connection, but I don't see this in my firewall anymore, so it may not be necessary. if you see this in your firewall logs when attempting a vpn connection, apply this rule in the same format as above, but make sure it is limited to only just the AirVPN IPs as this would otherwise allow normal website traffic. on the tunnel interface: open source and destination port 67/68, udp, inbound and outbound so Airvpn can give you an IP. you can use AirVPN dns, or create a rule to use the public dns of your choice like on the physical interface. open destination port 53 outbound on the 10/8 IP range, or if you have a way to limit it to just the DNS that you get with VPN, that'll work. (AirVPN will give you an IP starting with 10.) open destination port ntp outbound on the 10/8 IP range (to keep the time accurate on your devices) open destination tcp port 80,443 outbound, for website traffic. 8443 for websockets if you use things like chat/voice on a website app like discord. Ongoing: open any other ports you may be using, such as Steam IPs. Check your firewall logs any time something doesn't work, and add those ports. exhibit discernment about whether to open a port, as you may see crap trying to leak out of your network, not just dns. this is expected and is keeping your stuff private. speedtest sites like to use port 8080, so open destination port 8080 (ct state new) if you want to test your speed, and on inbound, open source port 8080 (ct state established) Note: broadly speaking, destination port 53 and 853 will not be open, blocking dns leaks. this is permanent Extra Notes: starting or stopping your vpn will not change any firewall rules. you will not have access to websites unless vpn is up. this will not work if you're using port 443 for your tunnel. the tunnel port and website port needs to be different. in some countries, this may not be possible. for every outbound destination port (ct state new) opened, there should be a corresponding inbound source port (ct state established) opened as well. traffic is 2 way, outgoing request, incoming response this may not be comprehensive. my firewall has a lot more rules and i may have missed something. view your firewall logs to see what is being blocked, and see whether you need to open it. This should absolve the need for a network lock, and maintain privacy during bootup and anytime eddie is not running. check your firewall logs for traffic on port 53 over the wan interface. these will be dns leaks you prevented. A quick note about windows: Microsoft overrides the hosts files and looks for various microsoft domains it uses for telemetry gathering. it will ignore these rules. this means the standards government hosts files are no longer being followed. this is a violation of long standing networking standards and causes people to reduce trust in the rest of the windows network setup. because of this, you should no longer trust that your firewall will not be overridden by Windows and allow dns traffic through even if you explicitly blocked it. Microsoft has admitted to running a keylogger since Windows 10. i mean ... my god. linux has come a long way in usability. you no longer have to be a hacker to run it well. i would make an attempt to convert to linux. it has been 30 years since computers were around. it is no longer acceptable to be computer-illiterate. old world literacy means you know how to use a feather quill pen. modern literacy means you know how to work your way around a computer. know the tool you use to communicate. linux is a different paradigm, but it is still just a computer. It would be great if somewhere on this site is pinned exact instructions for windows. it will help those concerned and those who don't yet know they should be. for anyone knowledgeable enough, please feel free to correct any of this if it is incorrect. share the knowledge! i don't frequent this site. admins have permission to edit this. -s

109.202.110.35 s9.rapidgator.net last time

Hello! I am a bit new to the Torrenting world, and I have set up my VPN(airvpn) and I have Qbitorrent. I have set up a port and put that port into my port for incoming connections, and I have my torrent running through Eddie(Airvpn). For some reason every time I click "Test open" under my port it says "Connection timed put(101)" Can anyone tell me what I am doing wrong?

@itsmeprivately Hello! Please try the following settings (usually they are strictly necessary to bypass China blocks): switch to OpenVPN (if you haven't already done so) by tapping the icon "VPN Type" on the main view. Each tap switches between WireGuard and OpenVPN. force connection over TCP to port 443 in the following way: open "Settings" and expand "AirVPN" by tapping on it tap "Default OpenVPN protocol", select "TCP" and tap "OK" tap "Default OpenVPN port", select "443" and tap "OK" tap "Quick connection mode", select "Use default options only" and tap "OK" Finally test again connections to various servers in various locations. Kind regards