Leaderboard

Hello! We reluctantly have to announce gloomy news to you all: Spooky Halloween Deals are now available in AirVPN... Save up to 74% on AirVPN longer plans (*) (*) When compared to 1 month plan price Deal will expire on 2026-11-03 UTC Check all plans and discounts here: https://airvpn.org/plans If you're already our customer and you wish to jump aboard for a longer period with this un-boo-lievable deal, any additional plan will be added on top of already existing subscriptions and you will not lose any day. Every plan gives you all the features that made AirVPN a nightmare for snoopers and a scary service for competitors. Just check this frighteningly long list of terrific features if you dare: a clear mission without compromises https://airvpn.org/mission exclusive and comfortable remote inbound port forwarding system flexible, opt-in block lists against malware and other hostile entities. Pick predefined lists, add exceptions or additional blocks, define your own lists, or just use our totally neutral DNS by default improved API functions to let you control and configure VPN features and account settings WireGuard integration AmneziaWG support in Eddie Android edition, with traffic mimicry of real websites (QUIC) to defeat DPI-based VPN blocking. This year our traffic wears a costume too: with AmneziaWG on Eddie Android, your connection goes trick-or-treating dressed up as an ordinary website, and DPI won't recognise who's behind the mask. Security-hardened Eddie Desktop edition Strong infrastructure growth: about 25% more total capacity in one year. Our servers grew by a ghastly 25% this year: more bandwidth to haunt the Internet at full speed. IPv6 support, including IPv6 over IPv4 and IPv4 over IPv6 refined load balancing to squeeze every last bit per second from VPN servers free and open source software for Android, Linux, Mac and Windows offering advanced features easy "Configuration Generator" web interface for access through third party software guaranteed minimum bandwidth allocation GDPR compliance and very high privacy protection standards no log and/or inspection of clients' traffic effective traffic leaks prevention by AirVPN software Tor support via AirVPN software on Linux, Mac and Windows various cryptocurrencies accepted without any intermediary no obligation to use our free and open source software to enter AirVPN infrastructure. Interoperability is an AirVPN priority. perfectly clear and easy to read Privacy Notice and Terms https://airvpn.org/privacy No tricks, only treats! We witch you a spooktacular Halloween AirVPN Staff

Update: restrictions lifted Hello! The PHP project released the fixed versions earlier than scheduled, and we have installed them on every system of our infrastructure. The temporary restrictions described above have now been removed: The forum is writable again: you can post new topics and replies, edit posts, upload attachments,date your profile. The support ticket area works normally: you can open new tickets and reply to existing ones from the website. Password recovery works again. The customer API (https://airvpn.org/api/) accepts multipart/form-data requests again. If you wrote to support@airvpn.org in the meantime, there is no need to open a ticket as well: we will answer you there. If any of the functions above still fails for you, please clear your browser cache and try again; if the problem persists, open a ticket or write to support@airvpn.org. VPN connections, Eddie and the AirVPN Suite were not affected at any time. Thank you for your patience and understanding. AirVPN Staff

Hello! We're very glad to inform you that the Black Friday weeks have started at AirVPN! Save up to 74% when compared to the one-month plan price Check all plans and discounts here: https://airvpn.org/buy If you're already a customer of ours and you wish to jump aboard for a longer period, any additional subscription will be added on top of already existing subscriptions and you will not lose any day. What's new since last Black Friday OpenVPN 2.7 with Data Channel Offload (DCO) on every server. The whole network now runs OpenVPN 2.7 with the DCO kernel module, which processes encryption inside the kernel for higher throughput and lower CPU load. The Configuration Generator default profile is DCO-ready, with no deprecated directives (details https://airvpn.org/road_to_openvpn26) 17 new 10 Gbit/s full duplex servers in Amsterdam (Netherlands), London and Manchester (United Kingdom), Toronto (Canada), Los Angeles and New York City (USA) and Stockholm (Sweden) United Kingdom infrastructure fully renewed: all the old 1 Gbit/s servers were replaced by six new 10 Gbit/s servers, which raises the UK theoretical peak from 15 to 60 Gbit/s. In Sweden, the older Uppsala servers were retired in favour of new 10 Gbit/s hardware in Stockholm Total infrastructure bandwidth up by about 25%, now over 1.3 Tbit/s Faster uploads and smoother performance under load: a deep rework of server-side routing and firewall rules removed a bottleneck on busy high-speed servers, and network tuning sharply reduced packet drops Eddie Android edition 4.0 and 4.1: full AmneziaWG support alongside OpenVPN and WireGuard. It includes a built-in database of more than 30 real websites whose traffic your connection can imitate, to get past VPN blocking. Login keeps working even when our bootstrap servers are unreachable, and IPv4 and IPv6 can travel over an IPv6 tunnel with WireGuard and AmneziaWG. Version 4.1 brings improved stability, from Android 5.1 to Android 16, Android TV included Eddie desktop edition 2.26.2 for Windows, macOS and Linux (ARM included): OpenVPN 2.7, WireGuard for Windows 1.0, extensive security hardening of the privileged components, and stronger encryption of saved profiles AirVPN Suite 2.1 and 2.2 for Linux (x86-64, AArch64 and ARMv7): reworked network and default gateway detection, a new option to choose whether IPv4 traffic travels over an IPv6 tunnel, improved IPv6 handling and a security-hardened traffic splitting manager. Hummingbird 2.1.0 for macOS runs natively on both Intel and Apple Silicon AirVPN is one of the oldest and most experienced consumer VPNs on the market, operating since 2010. It never changed ownership and it was never sold out to data harvesting or malware specialized companies as regrettably happened to several competitors. Ever since 2010 AirVPN has been faithful to its mission ( https://airvpn.org/mission ). AirVPN does not inspect and/or log client traffic and offers: five simultaneous connections per account (additional connection slots available if needed) state-of-the-art and flexible inbound remote port forwarding ( https://airvpn.org/forums/topic/63545-update-remote-port-forwarding-system-expansion ) active daemons load balancing for unmatched high performance ( https://airvpn.org/forums/topic/48234-speedtest-comparison/?do=findComment&comment=131616 ) - current 'all-time high' on the client side is 730 Mbit/s with OpenVPN and 2000 Mbit/s with WireGuard flexible and customizable opt-in block lists ( https://airvpn.org/forums/topic/49876-new-feature-dns-block-lists ) protecting you from adware, trackers, spam and other malicious sources. You can customize answers or exceptions globally, at account level or even at single device level. powerful API ( https://airvpn.org/faq/api ) Full IPv6 support comfortable management of your client certificates and keys ( https://airvpn.org/forums/topic/26209-how-to-manage-client-certificatekey-pairs ) OpenVPN, WireGuard and AmneziaWG (Android) connections AES-GCM and ChaCha20 OpenVPN ciphers on all servers Perfect Forward Secrecy with unique per-server 4096-bit Diffie-Hellman keys internal DNS: each server runs its own DNS server. free and open source software client-side software support for traffic splitting on an application basis on Android and Linux and on a destination basis on Windows and macOS GPS spoofing in Eddie Android edition AirVPN is the only VPN provider which is actively developing the OpenVPN 3 library with a fork that's currently 379 commits ahead of OpenVPN master and adds key features and bug fixes for a much more comfortable and reliable experience: https://github.com/AirVPN/openvpn3-airvpn AirVPN, in accordance with its mission ( https://airvpn.org/mission ), develops only free and open source software for many platforms, including Android, Linux (both x86 and ARM based systems), macOS and Windows. Promotion due to end on 2026-12-03 (UTC). Kind regards & datalove AirVPN Staff

Hello! We're very glad to inform you that a new 10 Gbit/s full duplex server located in New York City, USA, is available: Hiisi. The AirVPN client will show automatically the new server; if you use any other OpenVPN or WireGuard client you can generate all the files to access it through our configuration/certificates/key generator (menu "Client Area"->"Config generator"). The server accepts connections on ports 53, 80, 443, 1194, 2018 UDP and TCP for OpenVPN and ports 1637, 47107 and 51820 UDP for WireGuard. Hiisi supports OpenVPN over SSL and OpenVPN over SSH, TLS 1.3, OpenVPN tls-crypt and WireGuard. Full IPv6 support is included as well. As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses. You can check the status as usual in our real time servers monitor , by clicking the server name. Direct link: https://airvpn.org/servers/Hiisi Do not hesitate to contact us for any information or issue. Kind regards & datalove AirVPN Staff Photo by John Dillenbeck (Public Domain)

Hello! First of all, thank you for writing free and open source software dedicated to AirVPN. We had a quick look at both repositories. The code is careful and we did not find any telemetry and/or third-party endpoints. The client identifies itself honestly and the documentation describes our protocol accurately. We appreciate it. There are three points that affect our infrastructure, which you might like to take into account for the next releases. References are to wave-vpn-desktop at commit ce9a15fd and wave-vpn-mobile at commit 64a2be1b. 1. Periodic tunnel verification (desktop) verify_tunnel() in src/platform/linux.rs runs every 60 seconds for the whole session: the tun check for each IP family and the dns check on https://<server>_exit.airservers.org:89/check/, plus a checkdns.airvpn.org query. Any failure tears the tunnel down. Eddie runs these checks only once, right after connecting. With a 60 second loop, a short outage of the check service would disconnect every Wave VPN user at the same time, and they would all reconnect together. You might like to consider running the checks only at connection time, or much less often with some random jitter, and not disconnecting on a single failed check. 2. Latency measurement (desktop and Android) The "ping" is a TCP connection to port 443 on the first entry IPv4 of every server (src/gui.rs on desktop, vpn/Connection.kt on Android), so about 250 connections are opened and closed at every login, launch and refresh. The desktop refresh can go down to 15 seconds from the command line, and the Android manual refresh has no rate limit. A lighter probe such as ICMP echo, fewer probes in parallel, cached results with a minimum interval between refreshes, and no probes while connected (they go through the tunnel and skew the ranking anyway) would help a lot. Also, on desktop an unreachable server currently counts as 0 ms (src/documents.rs), so "Best server" ends up preferring servers that do not answer. 3. Bootstrap servers (desktop and Android) The desktop client always uses the bootstrap URLs and the RSA key from the AirVPN.json compiled into the binary and ignores the ones in the manifest (src/lib.rs, src/documents.rs). If we change bootstrap addresses or rotate the key, older builds would stop working. It might be worth storing and using the bootstrap URLs and key from the latest manifest, and keeping the embedded ones only as a first-run fallback. On Android, Protocol.kt and Session.kt send user and manifest at every refresh, always to the first URL, with no backoff while the bootstrap servers are unreachable. Trying the other URLs when one fails, with an increasing delay between retries, would make the client more robust and lighter on our side. Thank you again for your work. Feel free to ask here if anything about the protocol is unclear. Kind regards

Just switched from Proton, thank you!

Been a happy member for about 5 years! Thank you for reliable and private service! You guys are a godsend!!! 😁

New here, just got my subscription. Thank you!

Hello, thank you for the report. We checked all exit addresses, IPv4 and IPv6, of our Phoenix servers (Guniibuu, Khambalia, Sheratan) and Chicago servers (Fang, Kruger, Meridiana, Praecipua, Sadalsuud, Sneden, Superba): MaxMind GeoLite2, ipinfo.io and ip-api.com all place them correctly in Phoenix, Arizona and Chicago, Illinois, US. Google and Meta use their own location data for IP addresses, which can differ from those public databases, so they can place a shared exit address in another country even when the public databases are right. We cannot edit their data directly. Google offers a form to report a wrong IP location: https://support.google.com/websearch/workflow/9308722?hl=en Submit it while connected to the affected server; Google says updates can take more than a month. If it happens again, please post the server name and the exit IP shown by https://ipleak.net at that moment, so we can check that specific address. In the meantime, a server in another city or country is the practical workaround. Kind regards

Hi all, I built Wave VPN, an open-source (GPL-3.0) WireGuard client for AirVPN on Android and Linux. Sign in with your AirVPN account, pick a server, and connect. AirVPN does not endorse this independent project. Download: vpn.vwave.me. On Android, add my F-Droid repository to get automatic updates. Version 0.1.1 is an early release. Anyone can use it, but I have not tested it on every device and setup yet. Disclosure: AI coding agents (Claude Opus 5.5 and GPT 6.1 Sol) wrote most of the code, tests, and documentation under my direction. The source code and every test report, including failures, are public. Features Pick the lowest-latency server or search the full list, with ping, load, and saved favorites. Android supports split tunneling and Always-on VPN. On Linux, AirVPN verifies that your IPv4, IPv6, and DNS traffic go through the tunnel. Linux includes a Network Lock firewall that stays active until you turn it off, a recovery button, and an Eddie account importer. The app contains no analytics or telemetry. It talks only to AirVPN. The client supports WireGuard only. Sign-in details. Sign in with your AirVPN username and password. The app uses the same encrypted protocol as Eddie, so you do not need to generate an API key. Your device encrypts your credentials using Android Keystore or your Linux desktop keyring, and sends them only to AirVPN. Comparison with Eddie Eddie handles many tasks, and Wave relies on Eddie's published protocol implementation. Wave takes a different approach: The interface uses Jetpack Compose on Android and Rust on Linux, centered on a single Connect control. The settings include only basic WireGuard options and sensible defaults. On Linux, the app runs as an unprivileged user while a dedicated helper executes a fixed list of network commands. The firewall rules stay active if the main process exits unexpectedly. Every test report is public, including runs that failed. The Linux version can import your saved Eddie account. Eddie supports OpenVPN, Windows, macOS, and advanced routing options. If you need those options, use Eddie. Known issue Android reminder: Android can leak DNS during VPN reconnects or app crashes, even with Always-on VPN and blocking enabled, as documented by Mullvad. I also observed this in my Samsung tests. Links Android source Linux source Release key: 4140 18C0 BBB8 C0A7 0A80 BF57 0AA3 2CCB 2C0B 3951 (verified on keys.openpgp.org) Bugs and feedback Bug reports: open a GitHub issue on the Android or Linux repository. Include the app version, operating system version, and reproduction steps. General questions: post in this thread. Security disclosures: email vesselwave@protonmail.com. Do not post passwords, private keys, or WireGuard configuration files. I maintain this project in my spare time and respond as schedule permits. Thanks for trying it! ♡

+1 As of this posting, all sub <100 ping servers (Singapore AND Japan) are at 70-90+% capacity. Also, recently, there was the fibre XGS-PON upgrades and multiple undersea cables coming online in Singapore, the typical ISP landline package has increased from 1GBPS to 10GBPS, and mobile capacity has increased significantly as well. (60GB/month used to cost around $30-90, 300GB/month is now $10-30) I'd say these 3 factors are signals for a capacity upgrade for the region.

Halloween renewal - Grazie, Eduardo, from New World.

.

@after_lunch Hello! Thank you for the complete report, it shows what is happening. Your Wi-Fi adapter gets its DNS servers from your router: 194.168.4.100 and 194.168.8.100, which are your ISP's resolvers. Eddie 2.26.2 sets the AirVPN DNS (10.128.0.1) only on its own adapter, and in some circumstances its DNS leak protection fails to block queries sent to the resolvers of the other adapters. This is a known bug of 2.26.2, and your report matches it: Network Lock is active and the log says "DNS leak protection with packet filtering enabled", yet Windows still reaches your ISP's resolvers. You can solve it in one of two ways: 1. Stay on 2.26.2 and apply a workaround: open Eddie's Preferences > DNS, enable "Force all network interfaces for DNS", save, then disconnect and reconnect. OR 2. Upgrade to Eddie 2.27.2 beta, which contains the fix: https://airvpn.org/forums/topic/81340-eddie-desktop-edition-227-beta-released/ Then repeat the test on ipleak.net while connected: only AirVPN DNS servers should be listed. If your ISP's resolvers still appear after the workaround, please switch to 2.27.2, and if they persist there too, post a new system report. About hiding long text: the forum does not convert spoiler tags typed by hand. Use the Spoiler button in the editor toolbar and paste the text inside the box that appears, or simply attach the report as a .txt file. Kind regards

I have been facing a predicament for months, which is that Steam thinks i'm a bot and doesn't let me play any multiplayer games in.. multiplayer, and I can't turn my VPN off to use all 5 ports on it to host numerous servers. The problem is, there isn't a way to IP or domain whitelist Steam, since I don't know any of the ip's it uses to connect, and they change alot. This is where app-based tunneling would shine though, and here is why 1. App based tunelling would most likely save you guys alot of bandwidth, now people can tell the VPN to send web browser connections through their actual internet, and then you won't have alot of traffic taken up by YouTube streams 2. This defeats the need to switch to other clients, which is clunky and complicated. 3. It lets you do everything in one app (Eddie), which is extremely convenient and simple for newcomers to use, probably bringing more subscribers to the VPN too since split-tunneling is a useful feature 4. It straight up lets you split tunnel some stuff in the first place, such as Steam i've already mentioned, which uses a variety of ip's and domains i don't know, and i'm not about to spend a few hours in wireshark getting all the ip's/domains and adding them. So please, 4 good reasons on why app split-tunneling should be added to Eddie. P.S. another thing I noticed was that the split-tunneling already in Eddie didn't seem to work until I reconnected the VPN, is this a limitation, a bug, or just something that isn't added? - Thanks, a pleading CS2 player and server hoster

Thank AirVPN team for cheap, stable VPN, another 3 years from me 😉

That would be great. Even a 10 year plan 😂 You could do that even now. Just stack up the subscription. I agree. Thank you devs!

Hi AirVPN team, First of all, congratulations on the excellent service and on remaining a truly independent VPN, still faithful to its original values. That is becoming increasingly rare and deserves to be appreciated. The current three-year offer is great! But since some of us are planning to stay aboard for a very long time, how about a five-year package with an extra-special discount for your most loyal customers? Then I could pay now and not think about renewing again until after 2030! :-) Just asking on behalf of the AirVPN faithful… you never know! Thanks again for the excellent service. Keep up the great work! Kind regards & datalove

Hello! A quick follow-up on the WireGuard session counter issue mentioned above. The cause has been identified and fixed, and the fix is currently being rolled out across our infrastructure. Servers that have already received the update are back to reporting accurate figures, and the remaining ones will follow shortly, so the connection counts shown in the server monitor and in the related statistics will match reality again in the very near future. As previously stated, actual connections and the service itself have never been affected, only the displayed counter was. Kind regards

Thank you all for the valuable feedback. Following this thread, we have identified a bug, most likely introduced on October 7th-8th, which causes the WireGuard session counter on some servers to grow incorrectly over time. As a result, the number of connections currently shown in the server monitor is higher than the real one. The actual connections, and the service itself, are not affected. We are working on a fix and will update this thread as soon as it is in place. On a side note, this also means that our no-overselling commitment is honoured by an even wider margin than the one computed by @fsy Kind regards

Would it be possible to have added the ability to use 3rd party DNS services which support DNS over TLS or DNS over HTTPS? I'd love the option to paste in the NextDNS DNS-over-HTTPS link ( https://dns.nextdns.io/xxxxx) and funnel all DNS requests for a certain devices through it. There's a lot of added functionality/logging available through such a service and it would be a good addition I think.

Hey there, i've been recently to hamburg and talked to some guys who are working on a project called "Freifunk" [1] [2] in hamburg. They have around 400 Nodes, serving around 600 Clients at the moment, running and providing censorship free internet without any kind of limitation. The free access to the internet is not the main goal, but a feature. The "main goals of freifunk are to build a network that is decentralized, owned by those who run it and to support local communications". They are always looking for reliable vpn server to keep the community project running and the risk of being sued low. The community is running under the "Pico Peering Agreement v1.0" [3]. Maybe it´s something you want to support. [4] [1] freifunk.hamburg.net [2] https://en.wikipedia.org/wiki/Freifunk [3] http://www.ohrensessel.net/ffhh/total [3] http://www.picopeer.net/PPA-en.html [4] https://hamburg.freifunk.net/kontakt

@Staff Please consider adding more servers in these locations if possible. Thank you.

Well. I have the same issue, I just do the steps again. And wait for the new version.

Oooh almost forgot it. Thanks, just got my 3 year renewal. 👻 I'm regularly checking prices for a year now, as far as I can tell Halloween sale is the best, you should get it now, otherwise you have to wait a year. Easter or birthday sale did not have such a big discount iirc.

@voidfactory Thank you, the log you attached is exactly what was needed, and it shows the cause precisely. First, a quick picture of the pieces involved. niri is your Wayland compositor which draws and manages every window on your desktop. Eddie UI (like Discord) is an X11 application, and niri does not talk X11 itself: X11 applications run through xwayland-satellite, a bridge that starts Xwayland, acts as the X11 window manager towards those applications and presents each X11 window to niri as a normal Wayland window. All your X11 applications share that single bridge and its single connection to niri. When you activate Network Lock, Eddie opens a small dialog window. That window declares a minimum height of -5 pixels in its X11 size hints (WM_NORMAL_HINTS: min_size 102x-5). xwayland-satellite passes this value unchanged to the compositor as the Wayland minimum size, and the Wayland protocol (xdg_toplevel.set_min_size) forbids negative values: niri answers with a protocol error, the connection is closed and xwayland-satellite panics in the same second: Since every X11 application goes through that same bridge, all of them lose their display at that moment, which is why Discord goes down too, and eddie-tray then segfaults (the core dump you found) as a consequence. niri itself keeps running and quietly restarts xwayland-satellite, without telling anyone that it has just crashed: no notification, no warning, just a fresh bridge where the old one used to be, in the best tradition of a strict code of silence. The only visible symptom is your X11 applications vanishing all at once, and nobody saw anything. In other words, a single window asking to be at least minus five pixels tall is enough to take down every X11 application on your desktop: quite a lot of power for a negative number. So this is neither a permissions problem nor the Mesa issue we mentioned earlier, which is why updating xwayland-satellite did not help. Two things are wrong here: the negative value in that Eddie dialog, which we will report to the Eddie developers, and xwayland-satellite crashing on it instead of ignoring or clamping it. A regular Xwayland or X11 session tolerates such a hint, which is why the problem appears only under xwayland-satellite. If you like, you can report it to the xwayland-satellite project with the lines above: https://github.com/Supreeeme/xwayland-satellite/issues Until one of the two is fixed, on niri please use one of the options that do not need X at all, both with Network Lock: - Eddie CLI edition (eddie-cli) - AirVPN Suite (Bluetit daemon and Goldcrest client): https://airvpn.org/linux/suite/ About video playback on Viki and WeTV: it is not related to this crash. If it happens only while connected to the VPN, please try a few different servers and let us know. Kind regards

May I request the addition of 10Gbps Tokyo and Singapore servers? Thank you.

Hello! AirVPN is not affected. All our websites and web services (airvpn.org and our other domains) use Let's Encrypt certificates, which chain to ISRG Root X1. No eMudhra root or intermediate certificate is part of any of our certificate chains. The VPN connections do not depend on public certificate authorities at all: OpenVPN: your client authenticates our servers only against AirVPN's own private CA, which is included in your configuration file. A certificate issued by any public CA, eMudhra included, is rejected. WireGuard: there are no certificates. The server is authenticated by its public key, which is also in your configuration file. Eddie: it communicates with our infrastructure through a channel encrypted and authenticated with an RSA key built into Eddie itself, so it does not rely on the certificate store of your system. Since the tunnel is authenticated this way, someone on your local network or at your ISP cannot use a forged public certificate to get between you and our VPN servers. The remaining risk is the general one that applies to every website: a person who holds one of the compromised intermediate keys could forge a certificate for any domain, and a browser or operating system that has not received the block could accept it. Mozilla, Google, Apple and Microsoft have already revoked and blocked the affected certificates, thus upgrade asap. Kind regards

I had to reinstall Eddie client for several times and setting it up is always a quest for the whole evening. Had lost my evenings with 2.26.2 - 2.27.1 version update and ovpn-dco failure on win 10, thx experimental version managed to be here again. So many users have ISP blocks and it's always a great problem to recieve server list, for me I had to search for some free VPN, download, connect and retrieve airvpn server list, though Eddie app loggs in without any problems even with isp blocks. Imagine how you can simplify life of common users if app would have some servers in memory or kind of random test servers to connect to get info.

Steps 1 and 2 fixed my issue, to be safe, I also did step 3. Thanks

@Tech Jedi Alex I've not yet found someone that has ported Airvpn or Eddie to SFOS. I'll keep looking as I am reluctant to us the AAP on SFOS just yet. Principally because I am trying to avoid the upcoming Google 'shutdown of FOSS (Keep Android open

@gtrman Hello! Thank you, the backup file shows the remaining cause. The backup was saved before step 2, so it still shows the old ALL APPLICATION PACKAGES entry (AC) with FA; that is expected. The second entry that blocks Eddie is this one: (A;OICIIO;FA;;;CO) It is the CREATOR OWNER entry, which the normal icacls output shows as CREATOR OWNER:(OI)(CI)(IO)(F). On a default installation it is stored as (A;OICIIO;GA;;;CO). GA (generic all) and FA (explicit full access) grant the same permissions in practice, but Eddie's check reads the stored value as it is: it accepts GA and rejects FA. Because icacls displays both as (F), the difference was not visible in the first output. This entry does not give anyone access to System32 itself, only to files created there later, and only for their owner. Eddie's check does not make this distinction yet, and we will report it to the developers. Please open a Command Prompt as administrator again and run the following commands. 1. Save a backup of the current permissions: icacls "%SystemRoot%\System32" /save "%USERPROFILE%\system32-acl-backup2.txt" 2. Store the CREATOR OWNER entry in its default form: icacls "%SystemRoot%\System32" /grant:r "*S-1-3-0:(OI)(CI)(IO)(GA)" S-1-3-0 is the fixed identifier of CREATOR OWNER, so the command works with any Windows language. As before, it may take a minute; wait until it reports "Successfully processed 1 files". 3. Save the new permissions to a second file, to check them:Open icacls "%SystemRoot%\System32" /save "%USERPROFILE%\system32-acl-check.txt" system32-acl-check.txt with your favorite text editor. It should contain (A;OICIIO;GA;;;CO) and (A;OICI;0x1200a9;;;AC), and no entry ending with FA;;;CO or FA;;;AC. Then start Eddie. If it still shows the same error, please post the content of system32-acl-check.txt here. To undo only today's change, you can run: icacls "%SystemRoot%" /restore "%USERPROFILE%\system32-acl-backup2.txt" Kind regards

Hello! We're very glad to inform you that AirVPN Suite version 2.2.0 is now available for x86-64 and ARM based Linux systems. This is a maintenance and security hardening release focused on the traffic split infrastructure. The 2.2.0 Suite includes: Bluetit: lightweight, ultra-fast D-Bus controlled system daemon providing full connectivity and integration to AirVPN servers, or generic OpenVPN and WireGuard servers. Bluetit can also enforce Network Lock and/or connect the system to AirVPN during the system bootstrap Goldcrest: Bluetit client, allowing full integration with AirVPN servers, users, keys, profiles as well as generic OpenVPN and WireGuard servers Hummingbird: lightweight and standalone binary for generic OpenVPN and WireGuard server connections Cuckoo: traffic split manager, granting full access and functionality to AirVPN's traffic split infrastructure airsu: a "run and forget" tool to automatically set and enable the user environment for the X.Org or Wayland based ecosystem without any user input WHAT'S NEW NEW: Cuckoo security hardening: namespace directories are now opened with additional ownership and permission checks NEW: once root privileges have been dropped, Cuckoo can no longer regain them (no_new_privs is now set) NEW: traffic split namespace names are now validated by both Bluetit (trafficsplitnamespace run control directive) and Cuckoo, and are limited to 32 characters WireGuard and network namespace runtime directories now use /run/wireguard and /run/netns (legacy /var paths removed) improved POSIX compliance of the installation script Please note: if you have set a custom trafficsplitnamespace longer than 32 characters, you need to shorten it before upgrading. AirVPN Suite 2.2.0 is free and open source software released under GPLv3. Source code is available on GitLab: https://gitlab.com/AirVPN/AirVPN-Suite AirVPN Suite 2.2.0 is available for x86-64, AArch64 (ARM 64 bit) and armv7l (ARM 32 bit) architectures. Legacy versions are also available. https://airvpn.org/linux/suite/ AirVPN Suite resources, links and forum: https://airvpn.org/forums/topic/79336-airvpn-suite-resources/ Kind regards & datalove AirVPN Staff

Hello! The problem seems completely resolved. Kind regards

@gtrman Hello! Thank you for the detailed list of checks. The error comes from a security check in Eddie, not from netsh.exe itself. Eddie runs netsh.exe and other Windows tools with administrator privileges, so before running them it verifies that neither the executable nor its folder can be modified by an account other than SYSTEM, Administrators or TrustedInstaller. Otherwise a non-administrator could replace the tool and have it run with elevated privileges. The empty text after "not allowed:" in your screenshot indicates that netsh.exe itself passed the check, but its folder, C:\Windows\System32, did not: some other account is allowed to create files in it. This is not the default Windows configuration. It is usually left behind by a "take ownership" or "grant full access" tweak or tool applied to system folders in the past. This also explains why sfc, DISM and reinstalling Eddie, portable or installer, did not help: they do not reset the permissions of the System32 folder. To confirm, please open a Command Prompt and run the following command. It only displays the permissions and does not change anything: icacls "%SystemRoot%\System32" Then post the output here. If you prefer, you can replace your computer name and user name with placeholders, but please leave the rest unchanged. On a default installation only NT SERVICE\TrustedInstaller, NT AUTHORITY\SYSTEM and BUILTIN\Administrators can write to that folder. An additional entry with (F), (M), (W) or (WD) for your user account, Users, Authenticated Users or Everyone is the likely cause. Please do not take ownership of System32 or change its permissions recursively in the meantime. Once we see the output, we will tell you how to remove only the extra entry. Kind regards

thanks @pHxaq and @Staff for the info!

@lotuslove165 Still working with the folks at Airvpn. Looks like we are getting close to a solution. I'll be delighted if the rule changes they can make will finally facilitate KVM ---> NAT ----> VPN with lock protection. Will keep you informed.

Hello! For AirVPN WireGuard connections, the IPv4 gateway and DNS server address is 10.128.0.1. WireGuard uses a single IPv4 subnet, and this address remains the same regardless of which AirVPN server you connect to. Please keep 10.128.0.1 as your DNS DNAT target. 10.4.0.1 is an OpenVPN DNS address, and its availability through some WireGuard connections should not be relied upon. Your observation that it works through a German endpoint does not change the address to use with WireGuard. The reported difference alone does not establish a DNS outage on Dutch servers. You are also right about the documentation: our Specs page describes 10.4.0.1 as reachable from any virtual subnet without explicitly restricting that statement to OpenVPN. That wording is misleading for WireGuard users, and we apologize for the confusion. We will assess the situation and either clarify the Specs page or make 10.4.0.1 consistently reachable for DNS queries through WireGuard on all servers (not recommended anyway, see below). In any case, we recommend using the VPN gateway address as the DNS server address, as AirVPN supports this configuration, with both OpenVPN and WireGuard. We recommend using 10.128.0.1 for WireGuard DNS and ensuring that DNS traffic can only leave through the VPN tunnel. Route-injection attacks on hostile networks can otherwise divert DNS queries outside the tunnel, exposing the requested domain names and potentially enabling forged DNS replies. This class of attack can also affect WireGuard deployments, depending on the operating system’s routing and firewall configuration. For your OPNsense setup, redirect the selected clients’ DNS traffic, both UDP and TCP port 53, to 10.128.0.1, ensuring that the redirected traffic is routed through the WireGuard tunnel. Firewall rules should prevent those clients from falling back to WAN when the VPN is unavailable. Port 53 redirection alone does not control applications using DNS over HTTPS or DNS over TLS. Your interpretation of the successful dig @10.4.0.1 test with DNAT targeting 10.128.0.1 is correct: it does not demonstrate that 10.4.0.1 itself answered. Kind regards

Hello! We inform you that all of our VPN servers in Uppsala, Sweden, will cease operations during the night between 30 September and 1 October 2026. This withdrawal is part of our ongoing hardware renewal and connectivity improvement programme. These servers have already been partially replaced by brand-new servers in Northern Europe featuring more powerful hardware and 10 Gbit/s connectivity. Further deployments will complete their replacement. If you currently connect to our Uppsala servers, please select alternative servers before the withdrawal. If you use OpenVPN or WireGuard configuration files pointing specifically to these servers, please generate replacement configurations through our Config Generator in the Client Area. Do not hesitate to contact us for any information or assistance. Kind regards & datalove AirVPN Staff

Hello! We're very glad to announce the Eddie Android edition 4.1.0 is available Eddie Android edition is a fully integrated with AirVPN, free and open source client allowing comfortable connections to AirVPN servers and generic VPN servers offering compatible protocols: OpenVPN, WireGuard, and AmneziaWG 2.0 powered up protocol. Source code available on GitLab: https://gitlab.com/AirVPN/EddieAndroid Eddie Android edition is Android TV friendly and also offers GPS spoofing, traffic splitting on an application basis, 10 languages, extended compatibility from Android 5.1.1 to Android 16, and much more. What's new Eddie Android edition 4.1.0 introduces a new custom AirVPN library that combines wg-go and amneziawg-go into a single runtime. This architectural change addresses a fundamental constraint of the Go runtime. Go was designed with the assumption that only one runtime instance exists per process and does not support multiple independent runtimes within the same process. The previous 4.0 version had been linked against two separate Go-based libraries since support for Amnezia WireGuard was introduced. Despite the precautions implemented, on a small subset of devices, this configuration still resulted in rare crashes. Analysis showed that such crashes originated from Go runtime components, most notably the garbage collector. By consolidating both libraries into a single Go runtime, Eddie Android Edition 4.1.0 gets rid of these crashes across all supported devices. Furthermore, Eddie Android edition 4.1.0 adheres more strictly to AmneziaWG protocol version 2 real implementations. Specifically: The <c> tag for I parameters has been removed. Although documented for about a year, it was never implemented in the AmneziaWG protocol and any implementation intent was dropped during February 2026. Because, regrettably, it remained in the Amnezia documentation, Eddie 4.0.x still generated this parameter in certain profiles, resulting in the well-known interoperability issues with other clients. Eddie 4.1.0 eliminates this inconsistency. See: https://github.com/amnezia-vpn/amneziawg-go/issues/120 Added support for the <rc> and <rd> tags for I parameters. Jc, Jmin, Jmax parameters must now be ≥ 1. Previous Eddie / Amnezia releases accepted values ≥ 0, making it possible to explicitly configure zero junk packets, thereby allowing users to explicitly configure a logically degenerate state in which the junk-packet mechanism remained enabled while simultaneously instructing it to emit precisely zero junk packets. This is no longer supported; to disable junk packet generation please omit the J parameters. WireGuard compatibility now requires the canonical header mapping (Hₙ = n), as packet header identifiers are interpreted in a strict semantic order. Earlier AmneziaWG implementations, including that used by Eddie 4.0.x, internally canonicalized header mappings, allowing any non-repeating permutation of {1, 2, 3, 4} to preserve WireGuard compatibility. Eddie now enforces the canonical mapping whenever interoperability with standard WireGuard peers is required, including connections to AirVPN servers using the default Amnezia configuration. Eddie Android Edition 4.1.0 also includes updated libraries and dependencies. Please refer to the changelog available here for additional details. Download link, checksum and changelog Quick reference and download page: https://airvpn.org/android/eddie Eddie Android edition 4.1.0 APK direct download short URL: https://airvpn.org/tv Eddie Android edition 4.1.0 is also available on the Google Play Store https://play.google.com/store/apps/details?id=org.airvpn.eddie Changelog is available here: https://gitlab.com/AirVPN/EddieAndroid/-/blob/master/ChangeLog.txt?ref_type=heads SHA-256 checksum if you prefer to download from our web site and side load the app:  $ sha256sum EddieAndroid-4.1.0-VC40.apk d154767a4b4f65c8248f5a3529875bc022a9032baae696beb81529d478d6c190 EddieAndroid-4.1.0-VC40.apk Kind regards & datalove AirVPN Staff

I also think this is a worthy cause to support, would really mesh well with Airvpn mission.

https://annas-archive.gl/ would appear to qualify under "Circumvent censorship and any other barrier to seek, receive and impart information and ideas without interference and regardless of frontiers" They also sell ad space: https://annas-archive.gl/faq

Hello! In the early stages, the names were taken from the constellations. A little later, from constellations and stars, and finally only from stars. We have exceptions in Tokyo: two servers are named after imaginary planets from Space Battleship Yamato and UFO Robot Grendizer. Kind regards

The eunomia.social domain linked from post #4 was taken over by Malaysian casino ads (can the link be removed/annotated?). Here is a live link, if only to the project announcement https://www.synyo.com/news/eunomia-project-to-combat-misinformation-with-decentralized-secure-and-trustworthy-social-media/

You should support Pleroma. It peers with Mastodon and the developers and users are much more pro-free-speech. Plus Pleroma's interface is a lot nicer looking than Mastodon's.

Hello! We're very glad to inform you that the Black Friday weeks have started in AirVPN! Save up to 74% when compared to one month plan price Check all plans and discounts here: https://airvpn.org/buy If you're already our customer and you wish to jump aboard for a longer period, any additional subscription will be added on top of already existing subscriptions and you will not lose any day. AirVPN is one of the oldest and most experienced consumer VPN on the market, operating since 2010. It never changed ownership and it was never sold out to data harvesting or malware specialized companies as it regrettably happened to several competitors. Ever since 2010 AirVPN has been faithful to its mission. AirVPN does not inspect and/or log client traffic and offers: five simultaneous connections per account (additional connection slots available if needed) inbound remote port forwarding with multiple pools active daemons load balancing for unmatched high performance - current 'all time high' on client side is 730 Mbit/s with OpenVPN and 2000 Mbit/s with WireGuard flexible and customizable opt-in block lists protecting you from adware, trackers, spam and other malicious sources. You can customize answers or exceptions globally, at account level or even at single device level. powerful API IPv6 full support comfortable management of your client certificates and keys AES-GCM and ChaCha20 OpenVPN ciphers on all servers Perfect Forward Secrecy with unique per-server 4096 bit Diffie-Hellman keys internal DNS. Each server runs its own DNS server. DNS over HTTPS and DNS over TLS are also supported. free and open source software client side software support to traffic splitting on an application basis on Android and Linux and on a destination basis on Windows and macOS GPS spoofing on Android application AirVPN is the only VPN provider which is actively developing OpenVPN 3 library with a fork that's currently 245 commits ahead of OpenVPN master and adds key features and bug fixes for a much more comfortable and reliable experience: https://github.com/AirVPN/openvpn3-airvpn AirVPN, in accordance with its mission, develops only free and open source software for many platforms, including Android, Linux (both x86 and ARM based systems), macOS and Windows. Promotion due to end on 2024-12-03 (UTC). Kind regards & datalove AirVPN Staff

Apologies if I have been unclear - this happens every time after the initial connection. Every single time. I have uninstalled and reinstalled the Suite three times now, with identical results: After configuring Bluetit, it works on the first reboot. Every reboot afterwards results in the above scenario. I have used the following methods for shutdown & rebooting: LXQt menu > shutdown, LXQt menu > restart, terminal/CLI> poweroff, terminal/CLI > reboot. These are not "unclean" shutdowns as far the operating system is concerned. If Bluetit requires some form of manual disconnect prior to shutting down or rebooting, that would seem to be a flaw in Bluetit. Likewise, even if there were an "unclean" exit, Bluetit should be able to recover on restart. Respectfully, in either of these scenarios, I believe this is a developer issue. In its current condition, Bluetit appears to be broken and unusable. Regards

What about supporting Signal? It’s a non-profit organization and their software is open source. Obviously it’s not as flexible as XMPP, but it seems to grow more popular: Signal might be the first privacy-oriented app for a lot of people. https://signal.org

Not only the internet. They give themselves the right to invade any country in the world who doesn't play under their rules.

Here are some technical background informations. The gateways would push at constant load about, 2 Mbit/s: ~633 GB 6 Mbit/s: ~1.9 TB 10 Mbit/s: ~3.2 TB 25 Mbit/s: ~8 TB Min. server requirements: CPU: 1x (64Bit) RAM: 1GB HDD: 5-8GB NIC: 1x Software: Debian Wheezy (7) 64Bit Kernel fastd batman-adv-Kernelmodul The gateways are sponsored by the community and serve, in connection with the vpn, as exit node of the network, they are used also to connect different city´s and hackerspaces (e.g. ChaosVPN [1]). For more informations, just ask and i´ll provide as much as possible [1] http://wiki.hamburg.ccc.de/index.php/ChaosVPN