Jump to content
Not connected, Your IP:


Popular Content

Showing content with the highest reputation since 11/30/21 in Posts

  1. 2 points

    New feature: DNS block lists

    Hover over that little pictogram with your mouse, will you? Default = "The air to breathe the real Internet" Customized = "The air to breathe the filtered Internet" I do admit that at the very first I asked myself what it exactly means, too, but it quickly occured to me that it's used in the same way as other boolean values on the website, on IPLeak, in Eddie. Its meaning is therefore unambiguous.
  2. 1 point

    Hummingbird unofficial Docker image

    I just committed fixes to https://gitlab.com/fschaeckermann/hummingbird.git that now make the hummingbird client run in an Alpine Linux container as well. The produced image of Dockerfile.alpine is merely 23.6MB in size… good enough for a service container with a single purpose I guess. Next is to look closer at what happens with IPv6 in a docker container. There seems to be some kind of permission problem…
  3. 1 point

    WireGuard beta testing available

    You're downloading an OpenVPN config, not a Wireguard one. Enable the beta setting here: https://airvpn.org/preferences/ then select Wireguard in the config generator.
  4. 1 point
    Well… after a couple of days digging deeper into the source code, I was able to make hummingbird 1.1.2 compile and run in a Docker container with working network lock. Clone my fork from https://gitlab.com/fschaeckermann/hummingbird.git and read instructions in README.md I made it compile under Alpine Linux as well, but iptables seems to misbehave in some breaking way. Therefore the Alpine image is not really usable yet. @whiteowl3: I shamelessly copied your work and incorporated it in the Dockerfile - tini and entrypoint.sh and healthcheck.sh including. The client is actually issuing modprobe and iptables commands to create the network lock (using iptables-legacy, maybe that was the reason you couldn’t see any rules?). I haven’t tested with nftables or pf. That might even work under alpine… Also, if ipv6 gets in the picture, things go haywire! But ipv6 and Docker is an altogether different can of worms…. Have fun! And post your results here if you like.
  5. 1 point
    looks like this is all confusion around which entry IP are tls-crypt and which are tls-auth. tls-auth entry points use sha1. tls-crypt entry points use sha512 and tls encryption+auth. so, keep an eye on which config you make. details matter.
  6. 1 point
    That is a difficult thing to do because it may not be their fault entirely. If they want to use OpenVPN bundled with Synology because it's what they can reasonably do with their skillset, they are locked to OpenVPN 2.3, believe it or not. Synology doesn't seem to be updating much on their Linux-based NAS boxes.
  7. 1 point

    WireGuard beta testing available

    These results are from the Speedtest.net CLI. You can find installation instructions here: https://www.speedtest.net/apps/cli. I use the Debian package, which is available here: https://packagecloud.io/ookla/speedtest-cli
  8. 1 point

    WireGuard beta testing available

  9. 1 point

    WireGuard beta testing available

    Looks like speedtest run from LInux CLI: https://www.speedtest.net/apps/cli FWIW here's what I'm getting with 4 cores dedicated to my VPN VM. I've seen higher numbers with different servers. Server: Cox - Wichita - Wichita, KS (id = 16623) ISP: Quintex Alliance Consulting Latency: 25.00 ms (0.32 ms jitter) Download: 635.78 Mbps (data used: 698.7 MB ) Upload: 570.65 Mbps (data used: 577.7 MB ) Packet Loss: 0.0%
  10. 1 point
    @ciudad Hello! It's not planned at the moment because it's more comfortable for us the current single tls-crypt key. tls-crypt 2 doesn't change anything for the client, while on the server side, in our specific case, it would be useless because we maintain tls-auth for backward compatibility,. Any denial attempt would remain potentially possible via tls-auth, hence we would have a complication for nothing. However when we drop tls-auth (we're afraid not in the near future because of the amount of old OpenVPN versions connecting to our service) then tls-crypt-2 will become attractive indeed.. Kind regards
  11. 1 point

    Linux: AirVPN Suite 1.1.0 released

    Cannot reproduce. If nft is installed, Linux nftables is always used and NetLock is engaged successfully. If Linux iptables is explicitly selected: ! 2021.11.30 10:58:01 - Activation of Network Lock - Linux nftables ! 2021.11.30 10:58:03 - Deactivation of Network Lock ! 2021.11.30 10:59:04 - Activation of Network Lock - Linux iptables F 2021.11.30 10:59:04 - Exception: iptables don't reply, probabily kernel modules issue 10:58 is with NetLock mode Automatic.
  12. 1 point

    WireGuard beta testing available

    Some *killer* speeds with Wireguard: Server: Clouvider Ltd - Los Angeles, CA (id = 35056) ISP: HugeServer Networks, LLC Latency: 12.48 ms (0.81 ms jitter) Download: 688.44 Mbps (data used: 904.8 MB ) Upload: 35.42 Mbps (data used: 44.7 MB ) Packet Loss: 0.0%
  13. 1 point
    Unknown User

    WireGuard beta testing available

    It works GREAT, Thanks AirVPN for adding Wireguard and Jacker for the link. My setup: Home: WireGuard AirVPN --> AdBlocker PfBlockerNG --> AirVPN DNS --> END Outside the House: WireGuard Remote --> WireGuard AirVPN --> AdBlocker PfBlockerNG --> AirVPN DNS --> END
  14. 1 point

    WireGuard beta testing available

    Here is the link to his channel. https://m.youtube.com/watch?v=bCNnP8FDSNA It's saves a lot of head scratching 😁
  15. 1 point
    And you are right, the ISP is Amanah Tech because that's whom the data centers belong to. It's a hosting and colocation provider, which means other organizations can rent servers there. These are marked by the org field in some IP API responses: { "isp" : "Amanah Tech Inc.", "org" : "McAfee, Inc. - Plano", "as" : "AS32489 Amanah Tech Inc.", "query" : "" } I wouldn't try honestly. Best thing you can do is not to use it privately. I made a small Bash function for such lookups. ip-api () { curl -s http://ip-api.com/$1 } IP-API.com
  16. 1 point
    Hello! It's an Invision Power Board feature we don't like as well, but it's used only for your comfort. We do not exploit (if it was even possible) such data to profile you. We are anyway dropping IPB (the procedure is not trivial, we started it months ago but some more time is still needed). Also note that our web site and apps do not use tracking cookies, trackers or anything else and we run scripts to wipe out some IPB caching, just in case it was dangerous. If we had known in 2010 that IPB would have evolved in this way, our initial choice for the community and non-community forum would have probably been different ProtonMail had a court order to log and transmit the IP address of a specific account, they actually did not do it before they were served the subpoena. It's anyway a mail related issue, not a VPN one, where a subpoena can't indicate an e-mail address (we do not require an e-mail address in account data). Please note that contrarily to what numerous "competitors" did, in 11 years of activity AirVPN has never disclosed the identity of its customers, not a single one. In any case some skepticism is welcome and we invest very much on Tor (4% of worldwide Tor exit nodes traffic is supported economically by AirVPN), which is free for everyone and offers a very robust layer of anonymity. Use Tor for free in any case and especially if you can't trust us. Last but not least, the problem you have correctly underlined is negligible when compared to other dangers you must take into account. We wrote an article in 2013 to suggest how to defeat powerful adversaries, even when you can't trust one of your providers (including the VPN). It's an 8 years old article but it's still good and valid: https://airvpn.org/forums/topic/54-using-airvpn-over-tor/?tab=comments#comment-1745 Kind regards
  17. 1 point
    chimney sweep

    Double Hop?

    I've had issues with payments while being connected via AirVPN. This is something that I would expect from ecommerce websites and I don't see that anything could be done about it other than constantly adding new IP addresses, which would be a cat and mouse game. I do these payments while the VPN is off. I understand that this can be an issue if you are using WiFi networks while travelling. In that case, one might want to do that with a VPN on.
  18. 1 point
    This guide will explain how to setup OpenVPN in a way such that only select programs will be able to use the VPN connection while all other life continues as usual. Please read this notice before applying the guide Advantages: fail-free "kill switch" functionality (actually better than 98% of VPNs out there) continue using another VPN as primary or don't reroute any other traffic at all nobody, not even peers on LAN, will be able to connect to your torrent client (the only way: through the VPN connection) - eliminating unintended leaks Disadvantage: the apps will still use your default DNS for hostname lookups (secure your DNS separately!) See two more drawings at the end. The guide is applicable to all VPN providers who don't restrict their users to use the OpenVPN client. The method however is universally applicable. It was made with examples from Windows, but with Linux/BSD you will only need little tweaking to do. Specifically, net_gateway placeholder may not available and that's all there is to it. Android clients are probably too limited for this task and lack options we need. - Since there'll be a lot of text, sections titled in (parantheses) are entirely optional to read. The other guide by NaDre is old (2013), hard to read and pursues a slightly different approach. A Staff member actually posted a good first comment there, that's what we're gonna do. (Preface) The BitTorrent as a network is entirely public. Through the decentralized technology called DHT, everyone in the world can find out what torrents you are presumably participating in (this does not apply to private trackers who disable DHT). Clearly this creates an unhealthy atmosphere for privacy of users, e.g. one could find out the OS distribution one is using for a more targetted attack etc. Sometimes the ISPs are outright hostile to peer-to-peer technologies due to the traffic and bandwidth these are consuming. Instead of upgrading dated infrastructure, they cripple their users instead. There are many reasons to use a VPN, that was but a limited selection. ("Split-tunneling") This has become somewhat a marketing term nowadays, but actually explains the nature of the traffic flow well. In this guide only the programs set to use the VPN connection will use it, nothing else. All your traffic goes past the VPN while torrent client traffic (or any other selected program) uses only the VPN connection. ("Kill switch") We'll literally nail it using software settings of your program (the torrent client). This is a marketing-loaded name. In short: if the VPN connection is not available, no traffic ought to be sent bypassing it. In most cases where you have a VPN redirect all your system traffic - you should not rely on it as a feature. The OpenVPN software on Windows is not 100% proof, based on empirical evidence (reconnects and startup/shutdown phases) and some other VPN providers do no better (based on comments and stories). The only bulletproof solution: the VPN tunnel is set up on an intermediary device your PC is connected to - your end device (the PC) has no chance whatsoever to bypass the tunnel in that case. If the VPN provider uses a firewall under the hood, that's good too but with this guide you will not need a firewall nor rely on the VPN software. ("Dual-hop") With the knowledge and methods from this guide you will be able to daisy-chain multiple VPN servers. In essence, your traffic passes PC->VPN1->VPN2->Destination. This was not intended for this guide nor with AirVPN, it's finicky and I wouldn't recommend it myself without a real need and skills to automate the setup and configuration. How it will work Many users (aka mostly idiots on Reddit) are running in circles like qBittorrent is the only client (or probably the only application in the universe, unconfirmed) that can be set to use a certain VPN. Here's the technicality: this is called 'binding' - you can 'bind to IP' which will force the app to use a specific IP address and nothing else. If it cannot use the IP (when VPN is disconnected) then it will not be able to do any networking at all. The OS will deny any communication with the internet: boom! Here's your praised 'kill switch' and 'split-tunneling', 2-in-1. This is the next best bulletproof solution (the only better alternative is to use an intermediary VPN device, as any software could choose a different interface now to communicate with the internet). In a broader sense, you want to 'bind to a network interface' - your client will use any available IPs from the VPN interface - making it ready for IPv4 and IPv6. Oh and you don't need to change the IP once the VPN connection changes to another server. The OS handles the rest. Examples of programs that can bind to user-defined addresses include: (Windows) ping, tracert (IPv6-only, WTF?), curl and wget, and many others, including your favorite torrent client You will find guides online how to do that in your client or just look in settings. (Linux-specific differences of the guide) If you are a Linux/*nix user, there're some minor changes to the quick guide below: * Create custom VPN interface: Create with ip tuntap command. The below line will create 5 interfaces "tun-air1" etc. for YOUR user. Specifying your user allows OpenVPN to drop root rights after connection and run under your user (security). AirVPN allows up to 5 connections. If you have no use for this, create only one. user="$(whoami)"; for i in {1..5}; do sudo ip tuntap add dev "tun-airvpn$i" mode tun user "$user" group "$user"; done Check their existance with ip -d a -- the interfaces will not be shown under /dev/tun* ALTERNATIVE: openvpn --mktap/--mktun. See manual with man openvpn * Select custom VPN interface: This config part differs from Windows, very confusing. Steps: 1. Replace "dev-node" in config with "dev" 2. Add "dev-type tun" or "tap". Example of config: # if you have these defined multiple times, last entries override previous entries dev tun-airvpn1 # previously dev-node dev-type tun # previously "dev tun" on Windows There're no more differences. In-depth explanation: If you try to use dev-node like for Windows, you will see: OpenVPN log: ERROR: Cannot open TUN/TAP dev /dev/tun-airvpn1: No such file or directory (errno=2) Example strace of error: openat(AT_FDCWD, "/dev/tun-airvpn1", O_RDWR) = -1 ENOENT (No such file or directory) OpenVPN cannot find the TUN/TAP with the name? No, on Linux/*nix/*BSD dev-node has a totally different meaning. Dev-node specifies where the control interface with the kernel is located. On Linux it's usually /dev/node/tun, for the "mknode" command. If OpenVPN can't detect it for some reason, then you'd need to use dev-node. Finally you can start OpenVPN from terminal: sudo openvpn --config 'path/to/config.ovpn' --user mysystemusername --group mysystemusergroup Windows Quick Guide Go to the folder where you installed OpenVPN and its exe files: 'C:\Program Files\OpenVPN\' Open CMD inside the 'bin' folder: Hold Shift + Right Click the 'bin' folder -> 'Open Command Window here' We will use tapctl.exe to create a new VPN network interface solely for use with AirVPN (to look around: run "tapctl.exe" or "tapctl.exe help") C:\Program Files\OpenVPN\bin>tapctl create --name AirVPN-TAP {FDA13378-69B9-9000-8FFE-C52DEADBEEF0} C:\Program Files\OpenVPN\bin> A TAP interface is created by default. I have not played enough with Wireguard's TUN to recommend it. You can check it out, it will be under adapters in your Windows network settings Important: Configure your app/torrent client to use this 'AirVPN-TAP' interface. This is what ensures your traffic never leaks. It may appear under a different name, in such case find out which one it is in the output of 'ipconfig /all' (enter this into CMD) If your client does not allow to bind to a general interface but a specific IP (poor decision) then connect to the VPN first to find out the local IP within the VPN network. In this case with AirVPN you may only use one single server or you'll have to constantly change the IP in settings. Generate AirVPN configs where you connect to the server via IPv4! This is important Add these to the .ovpn config files (either under 'Advanced' on the config generator page or manually to each config file) # NOPULL START route-nopull # IF YOU DO NOT USE ANOTHER VPN THAT TAKES OVER ALL YOUR TRAFFIC, USE "net_gateway" (just copy-paste all of this) # net_gateway WILL BE AUTOMATICALLY DETERMINED AND WILL WORK IF YOU CONNECT THROUGH OTHER NETWORKS LIKE A PUBLIC WIFI # personally, due to a second VPN, I had to specify my router IP explicitly instead of net_gateway: # "default"/"vpn_gateway"/"remote_host"/"net_gateway" are allowed placeholders for IPv4 route remote_host net_gateway route vpn_gateway route default 666 route-ipv6 ::/0 default 666 dev-node AirVPN-TAP # END OF NOPULL Test if the configuration works. Full tests, don't leave it up to chance. In-depth explanation of the OpenVPN config route-nopull rejects any networking routes pushed to you by the server, we will write our own route remote_host <router IP> we tell our system that, to reach remote_host (the AirVPN server IP), it must send traffic to <router IP>. The subnet mask says that this only applies to this single IP set <router IP> to be net_gateway (only for Windows users, check availability on other platforms) <router IP> may be any of the OpenVPN placeholders too, for example "net_gateway" should work universally (you avoid hard-coding the router IP and if it ever changes: wondering years later why the config no longer works) <router IP> is "" in my case, for my home router that connects me to the internet. route vpn_gateway we tell our system that all 10.x.x.x traffic will be sent to the AirVPN server the internal VPN network with AirVPN is always on the - network range. The subnet mask reflects that. However this may interfere with other VPNs if you ever need to be connected to both at once. I will not go into detail on this. What you need to do is to be more specific with 10.x.x.x routes in this config, i.e. instead of /8 subnet, only route the specific /24 subnet of the current VPN server (AirVPN uses a /24 subnet for your connections on each VPN server -> 10.a.b.0 vpn_gateway is one of OpenVPN placeholders route default 666 allow routing of ANY traffic via the VPN we set the metric to 666, metric defined as path cost (historically) so setting it to a high value will make sure no normal connection runs through it, unless specifically bound to the VPN IP. route-ipv6 ::/0 default 666 same for IPv6. How many can claim they have working VPN IPv6 setup? Welcome in the future. IPv6 is over 20 years old at this point anyhow. dev-node AirVPN-TAP (Windows-only) tell OpenVPN to ONLY use this network interface to create the VPN tunnel on. Nothing should interfere with our setup now That's all, folks! Note: Somehow on Windows my AirVPN connection receives a wrong internal IP that doesn't enable networking at first. In my case I need to wait 1-3 minutes until OpenVPN reconnects itself based on ping timeout: after the reconnect I receive another IP and everything starts to work. I do not know whether it's an OpenVPN or a Windows bug. One last note: using multiple VPNs Actually this will work, that's how I roll. As long as both VPNs don't clash by using the same subnet. If this happens, you will need to change Line 5 to point to a more specific (aka smaller) subnet tailored to your AirVPN server. Specifying a 10.x.x.0/24 subnet for routing will surely do (subnet mask: Just be aware that you cannot practically use the same IP range in both networks at the same time (well, you'd need to bind the application you are using to either interface, which you cannot do with a browser or the printing service in case of internal resources). (The story of broken net_gateway) For this placeholder, OpenVPN attempts to determine your 'default gateway', i.e. the router all your internet traffic passes through. It normally works, but may not be supported on other platforms (Linux, sigh). However it has one unintended side-effect: if you already have a VPN that reroutes all your traffic, net_gateway will make all AirVPN traffic go through the first VPN: Your traffic -> VPN1 -> Internet Torrent traffic -> VPN1 -> AirVPN -> Internet That's the unintended dual-hop. Surely you can extend that scheme to 3,4,n-hops if you fiddle enough with routing, subnet masks and correct order. I'm not responsible for headaches We avoid that behavior with Line 4 from our config - the remote_host line forces the AirVPN traffic to go straight to the internet (through your LAN router). One more thing: net_gateway is not available for IPv6 routes in OpenVPN. That's why it currently only works with a IPv4 connection to the VPN server. (Crash course: Subnet masks) You've seen the weird number above. You should refer to other pages for a proper explanation, but basically this is a very simple way for computers to determine the range of IP addresses that are part of a network (a subnet). What's simple for computers is very hard to grasp for us humans. 255 means there are NO changes allowed to the first set of IP numbers. I.e. the 10 in always stays a 10. 0 means all numbers can be used. I.e. the zeroes in can be (0-255), lowest address is and the last address is (technically, is the first and the last is reserved for 'broadcast') Any number in between denotes ... a range in between. 2^(32-prefix)=number. Number is the amount of available addresses and prefix is called the subnet prefix. Both are meant to describe the same thing. For or with subnet mask of you get addresses in range -- 2^(32-26) = 64. Similarly you can convert the subnet mask into the prefix number and work from there; or eyeball it: 256-192 = 64. (Two ways to accomplish routing) If you have two equal routes, e.g. goes through VPN with metric 666 goes through LAN router with metric 10 then obviously the default route for a packet will travel through (2) - because it's a cheaper path. Unless an application specifies to talk only on the VPN interface. However a different rule applies whenever a more specific route exists goes through VPN2 with metric 666 goes through LAN router with metric 10 goes through VPN1 with metric 30 goes through VPN1 with metric 30 Here the routes (3) and (4) cover the entire addressing space, just like However because they are more specific, they'll be preferred for all traffic because these routes are more selective. This is how OpenVPN does override system routing with VPN routing by default. This is also what the other guide attempted as well, by pushing four {0,64,128,192}.0.0.0/2 routes. Since that was more specific, it would in return override the 0,128 routes and so on. We can calculate how many multi-hops we would be able to do with this method: IPv4 has 32 bits, we will not touch the last 8 bits of the subnets. That leaves us then with 24 bits or 24 maximum amount of hops. Theoretically. The routing table would be outright f---- to look at. This method is a bit more 'secure' in a way because you don't need to rely on overriding a certain metric value, you just slap a more specific route on top and it's automatically made default. Also you don't need to override the default gateway (router) and all that junk. However with my preferred method (first) you can quite easily do DIY dual-hop routing: goes through VPN2 with metric 666 goes through LAN router with metric 10 goes through VPN1 with metric 30 goes through VPN1 with metric 30 <VPN2-IP>/32 goes through VPN1 with metric (any) Such a setup will make sure that all traffic destined for the internet (hits 3 and 4) will go through VPN1. If a program specifies the VPN2 network interface, then VPN2 will be reached via VPN1 first (you->VPN1->VPN2). This is quite 'quizzacious' to set up/control. Not part of this guide. As a part of this guide we told the system to route VPN2 via router on LAN. Yet you could indeed chain multiple VPNs this way and force the VPN1 to not only catch all traffic but also be chained via multiple VPNs itself so you would not need to manually set programs. I've seen scripts online for that purpose. Although be aware of MTU issues due to encapsulation. Troubleshooting tips TEST. SERIOUSLY, TEST YOUR SETUP BEFORE ENGAGING YOUR DATA CANNONS! A couple hours now are infinitely many times more worth than a 'leaked' mistake and headaches later on. https://ipleak.net/ - tests your client's default connection route. It would not tell you if your client is alternatively available on LAN for example. If you followed this guide and set up your client correctly, it will not be available on LAN etc. See the images below: 'without interface binding' (most newbie users) and 'with interface binding' (this guide) Wireshark to inspect how the traffic is actually flowing. Follow online tutorials, you only need to select the right network interfaces and filter traffic by port/IP (tcp/udp and your local or VPN IP) curl to send network requests. Like ifconfig.co / ifconfig.io will respond with the IP address it sees you as: curl --interface <your computer IP> http://ifconfig.co curl --interface http://ifconfig.co # for IPv4 or IPv6, default route curl -4 http://ifconfig.co curl -6 http://ifconfig.co > route -4 print and > route -6 print on Windows. To compare the outputs, you can use Notepad++ with the compare plugin (you need two documents open, one in left and another in right pane before comparing). PS: AirVPN configuration generator does not support #comment lines. Please fix. Sorry Linux users, maybe another time I will write something tailored to you. But I believe you are smart cookies and will adapt the OS-specific steps to fulfill this guide's goal.
  19. 1 point

    [SOLVED] ipv6 error 1

    If the above solution does not work try checking ALL of your Windows adapters in Windows Network and Internet. Jog the adapter settings (Disable/Enable) and make make sure they are enabled, especially the "Wintun Userspace Tunnel" adapter that (on mine) shows the red x as "Unplugged" but when right clicked is still enabled.....strange. This has solved my occasional connection issues with the Eddie Client set to : "Inside Tunnel if supported, otherwise blocked" (Layer IPv6 in networking). Hope this helps some folks.
  20. 1 point

    Servers in South America

    Not anytime soon.
  21. 1 point
    Probably because they decided not to use women and children as suicide bombers, or fire rockets indiscriminately into civilian areas. But this isn't really the place to discuss it.
  • Create New...