Leaderboard

Hello! We're very glad to inform you that we have just released Hummingbird 1.1.0, featuring: both SystemV-style init and systemd support for Linux update to the latest OpenVPN3-AirVPN and asio libraries Hummingbird is AirVPN's free and open source OpenVPN 3 client based on AirVPN's OpenVPN 3 library fork. Hummingbird is available for: Linux x86-64 (reasonably recent distribution on par with Debian 9 libraries and kernel is required) Linux ARM 32 (example: Raspbian for Raspberry Pi) Linux ARM 64 (example: Ubuntu 19 and 20 for Raspberry Pi) macOS (Mojave or higher version required - please read important notes for Mac users at the end of the announcement) Main features: Lightweight and stand alone binary No heavy framework required, no GUI Tiny RAM footprint Lightning fast Based on OpenVPN 3 library fork by AirVPN with tons of critical bug fixes from the main branch, new ciphers support and never seen before features ChaCha20-Poly1305 cipher support on both Control and Data Channel providing great performance boost on ARM, Raspberry PI and any Linux-based platform not supporting AES-NI. Note: ChaCha20 support for Android had been already implemented in our free and open source Eddie Android edition robust leaks prevention through Network Lock based either on iptables, nftables or pf through automatic detection proper handling of DNS push by VPN servers, working with resolv.conf as well as any operational mode of systemd-resolved additional features For a thorough Hummingbird overview please consult https://airvpn.org/hummingbird/readme/ Hummingbird 1.1.0 adds support to Linux systems based on SystemV-style init https://en.wikipedia.org/wiki/Init#SYSV too, while the previous versions supported Linux systemd based systems only. Therefore, we gladly achieve compatibility with 35 additional Linux distributions: https://distrowatch.com/search.php?ostype=All&category=All&origin=All&basedon=All&notbasedon=None&desktop=All&architecture=All&package=All&rolling=All&isosize=All&netinstall=All&language=All&defaultinit=SysV&status=Active#simple We think it's important to support Init Freedom: https://devuan.org/os/init-freedom because systemd is POSIX incompatible and because, as the UNIX Veteran Admin collective noticed in 2014 when they announced a Debian fork: This situation prospects a lock in systemd dependencies which is de-facto threatening freedom of development and has serious consequences for Debian, its upstream and its downstream. You can download Hummingbird for Linux (all flavors) and macOS respectively here: https://airvpn.org/linux and here: http://airvpn.org/macos Important notes for macOS users From now on we provide both a signed, code-hardened, notarized version and a non-notarized version of Hummingbird for macOS. The notarized version is available essentially for those users who prefer it, but it is not recommended. The notarized version will run without blocks by Apple's Gatekeeper, but will let Apple correlate your real IP address, Apple ID and other data potentially disclosing your identity to the fact that you run, and when you did it for the first time, an application by AirVPN. If that's not acceptable for you, just download the tarball package .tar.gz (it is NOT notarized and NOT signed with our Apple developer ID on purpose) and include it in the exceptions to run non-notarized programs. In the future this could not be allowed anymore, but at the moment it is. For a more thorough explanations on important privacy issues caused by Apple and notarization please see for example here https://lapcatsoftware.com/articles/notarization-privacy.html and here https://lapcatsoftware.com/articles/catalina-executables.html Kind regards & datalove AirVPN Staff

Hello! We're very glad to inform you that a new 1 Gbit/s server located in Vienna (AT) is available: Beemim. The AirVPN client will show automatically the new server; if you use any other OpenVPN client you can generate all the files to access it through our configuration/certificates/key generator (menu "Client Area"->"Config generator"). The server accepts connections on ports 53, 80, 443, 1194, 2018 UDP and TCP. Just like every other "second generation" Air server, Beemim supports OpenVPN over SSL and OpenVPN over SSH, TLS 1.2 and tls-crypt. Full IPv6 support is included as well. As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses. You can check the server status as usual in our real time servers monitor: https://airvpn.org/servers/Beemim/ Do not hesitate to contact us for any information or issue. Kind regards and datalove AirVPN Team

I can tell you what I do to watch netflix and amazon prime while connected to airvpn. You will need another device outside the vpn to which you have ssh access, in my case a raspberry pi. What I do is use dynamic port forwarding to end up with a browser that works outside the VPN. You have to be careful as anything you browse in there will go through the other device and not the VPN. The steps would be: 1. Set up ssh access to a device outside the VPN I will not describe the whole process of setting up ssh access as there is plenty information on the internet. 2. Start a dynamic port forwarding the most basic command would be something like ssh -D port_number device Lets say port_number is 24007. when you run this command the port will be forwarded until you close the console. If you use windows you can look for putty (I think plink is the name of the utility you need). 3. Configure a browser to use that as a proxy If you use firefox and want to keep using it have a look to browsers profiles. firefox -P NoVPN Just be careful not to set this profile to be the default when you open firefox. Open preferences and search for proxy settings (inside Network settings) and select: o Manual proxy configuration. ... SOKS Host: 127.0.0.1 Port: 24007 o SOCKS v5 # Proxy DNS when using SOCKS v5 I added an image to clarify this. Once you are done netflix (or pretty much anything that works at your place outside the VPN) will work in this browser. If this can be useful to you and need any extended help setting things up just let me know.

I just run it in "screen". And start it with "crontab"/"crond". For screen you can use a command something like "screen -fa -dmS openvpn_client openvpn_exe ...". Then you don't have to keep an SSH session open for it. To disconnect in screen is "ctrl-a" followed by "d". To resume a session is "screen -r openvpn_client". To list sessions is "screen -ls". See "man screen". To start it with cron, you could put "screen -fa -dmS openvpn_client openvpn_exe ..." into "~/bin/openvpn_client". Then run "crontab -e" and add an entry like "@reboot /bin/bash -l $HOME/bin/openvpn_client". See "man crontab" and "man 5 crontab". "crontab -e" will ask what editor to use. I suggest "nano". See the bottom line in nano for how to save and exit (ctrl-o and ctrl-x). When you want to change the VPN configuration file being used you would edit "~/bin/openvpn_client"" to change the argument passed to "openvpn_exe". I find this approach works in any Linux distro and is not broken during release upgrades. My setup is a little more elaborate than what I described. Just trying to point out one approach. EDIT: I added a bit about using "screen" and "cron" to the github wiki page.

This message shows up in the most unlikely places. Could be a database bottleneck or something. Anyway, it's not a threat, go back one page and retry what you wanted to do.

There are no startup scripts with systemd, only unit files defining a variety of things, be it a service, a socket, a target, etc. But you can execute a script with such a unit file which comes close to what you mean. Anyway, it should be possible. Create a basic service file, something like the following, name it like "ovpn-selective.service" or so, then move it to /lib/systemd/system and trigger a daemon-reload:: [Unit] Description=Selective OpenVPN connection After=network-online.target Wants=network-online.target [Service] ExecStart=/path/to/the/script.sh --with the --arguments +you -want to +use [Install] WantedBy=multi-user.target $ sudo mv ovpn-selective.service /lib/systemd/system/ $ systemctl daemon-reload Check that it works. If it does, mark it for startup: $ systemctl start ovpn-selective.service $ systemctl enable ovpn-selective.service

The change this week in Hong Kong, with direct jurisdiction by the CCP/Beijing government and the override of the "Two Systems" agreement by security laws and mainland police presence seems to require review of whether users can have confidence of privacy or security when using HK servers. One reference of the impact and scope and implications is this Australian newspaper article: https://www.smh.com.au/world/asia/hong-kong-s-new-national-security-laws-reach-beyond-china-20200701-p557zd.html Although it is undesirable to follow the Trumpist/US MIC with various anti-China propaganda, it should be recognised that although China is increasingly powerful and aggressive, the rest of Asia is a considerable counterweight (Japan, S Korea, Taiwan, Indonesia, Australia, India, etc) and European organisations such as AirVPN have alternatives. Perhaps Taiwan can be a replacement for CCP HK, or more servers in Japan and Singapore, or perhaps give Indonesia a bit more modern industry ?

You could add the following in the [Service] section: ExecStartPre=/usr/bin/hummingbird --recover-network This will always execute what you are doing to make it work again, not only after resetting. But that's alright since hummingbird will exit with code 0, anyway, even if it prints two errors: $ sudo ./hummingbird --recover-network Hummingbird - AirVPN OpenVPN 3 Client 1.0.3 - 3 June 2020 It seems this program has properly exited in its last run and it has already restored network settings on exit. ERROR: Backup copy of resolv.conf not found. ERROR: Backup copy of network filter not found. $ echo $? 0

Solid wifi performance does not equal solid openvpn performance. If you want good openvpn performance get the asus AC86 (eighty six) and install Merlin firmware. It's got an AES-NI CPU so it'll rock openvpn.

FWIW, the dd-wrt forum community has pretty much settled on the Netgear Nighthawk X4S R7800 router as their standard recommendation for those wanting solid performance, reasonable cost, and super dd-wrt support, the latter because the R7800 appears to have become the primary dd-wrt development platform.

Would recommend a Netgate SG-1100 as your wired router front-end. It's about $170. You can customize almost any setting since it's using PFSense as the firewall and BSD as the OS. Then, you can use your current wifi as an AP only, depending, of course, on your home layout. I use OpenWRT on my wifi AP and it works extremely well. Caveat - I only connect to AirVPN on my desktop. I don't run it through the sg-1100. I could if I wanted to, but given all the problems with locality, rather than create a bunch of client and software exceptions, I will just go online with my desktop, or connect to AirVPN using a mobile app if a need arises. I also use PFBlocker on the SG-1100 and it does a great job filtering all the network garbage and ads. Hope this helps!

Hello! Today we're starting AirVPN tenth birthday celebrations! From a two servers service located in a single country providing a handful of Mbit/s, the baby has grown up to a wide infrastructure in 22 countries in three continents, providing now 240,000+ Mbit/s to tens of thousands of people around the world. In 2019 and 2020, software development enhancement has paid off: now AirVPN develops on its own an OpenVPN3 forked library which resolves various problems from the main branch and adds new features. The library is used in Hummingbird, a free and open source software for Linux and Mac, known for its speed and compactness, in Eddie Android edition and in a new software which will be announced in June. Hummingbird has been released even for ARM based Linux devices, and runs fine for example in Raspberry PI. Eddie Desktop edition has been extensively rewritten to improve performance, reliability and security. Now anything not related to the user interface is written in C++ and a lot of security hardening has been implemented. Total compatibility with macOS Catalina, Windows 10 and latest Linux distributions has been achieved, and specific packages for various, widespread Linux distributions are available for easier installation. Eddie can act as a GUI for Hummingbird in Linux and Mac, while in Windows, Eddie can also be easily configured to run OpenVPN 2.5 with the wintun driver to achieve remarkable OpenVPN performance boost and put Windows on par with other systems OpenVPN throughput ability. Furthermore, the wintun driver resolves various problems which affected TAP-Windows driver. Development for OpenBSD and FreeBSD has been unfortunately re-planned but we're glad to announce here that it will continue, starting from summer 2020. All AirVPN applications and libraries are free and open source software released under GPLv3. We think that it's somehow surprising that AirVPN not only survived, but even flourished for 10 years, in an increasingly competitive market and increasingly privacy hostile environment. No whistles and bells, no marketing fluff, no fake locations, no advertising on mainstream media, a transparent privacy policy, no trackers on the web site or in mobile applications, no bullshit of any kind in our infrastructure to sell your personal data to any personal data merchant, and above all a clear mission that is the very reason which AirVPN operates for https://airvpn.org/mission , are probably, all together, the factors which allowed such a small "miracle" and maybe make AirVPN unique. Thank you all, you users, customers, members of the community, moderators, developers: the small "miracle" happened because of you, because you saw something in AirVPN. Kind regards and datalove AirVPN Staff

Hello, last year I had written a wrapper for Eddie's CLI version (in bash) to be able to use it more easily and extensively in the linux command line like the GUI, but with less resources. I have used it since then every day without problems, but now I have finally gotten to overhaul it and adjust it to Hummingbird because it is just so much faster! I also tried to make it more easy to configure (by having a separate configuration file) and added some new functionality like support (and automatic recognition) of iptables and nftables to lock down the system even without being connected to AirVPN and automatic connection at boot with a systemd unit. Again, feel free to use this as you wish, I hope someone can benefit from this. I'm happy about any improvements and corrections and will update this if I find the time. Features graphical interface in the command line to connect to AirVPN with Hummingbird (no Eddie involved) runs in background, the interface can be closed/opened anytime without affecting the running connection possibility to connect to any server with just one ovpn configuration file easily connect to a random server, to a recommended server, to the recommended server of a specific country or to a specific server sortable list of all servers including info like used bandwidth, load and number of users possibility to connect to other VPNs with openconnect lock down system by default (permanently if you want), so even without AirVPN/Hummingbird running there won't be any unwanted network traffic automatically establish connection at boot (which can later be controlled via the interface) logging of Hummingbird's output (number of days to keep logs for can be adjusted) system notifications to let you know what happens in the background Some general notes The default network lock determines, like Hummingbird itself, if iptables, iptables-legacy or nftables is available on your system and will use the first one found in that list. You can overwrite that by specifying which one to use in the configuration file. Once activated, the lock will stay in place until manually deactivated, so no internet connection will be possible unless connected to AirVPN or other whitelisted VPNs. You can make the lock permanent (or rather activate at boot) by enabling that option in the configuration file. AirVPN's network lock overwrites the default network lock, so there will be no interference. IMPORTANT: If you have any frontend firewall for iptables/nftables running, you might to disable that or read up on how it might interfere with rule changes you make directly via iptables/nft. The same thing applies if you use just Hummingbird itself. If you enable the default permanent network lock, it will write the lock rules at boot, most likely overwriting rules by firewalld or the like, but other enabled firewalls might interfere later. Also important: If you have SELinux and you want to use nftables for Hummingbird starting at boot, you have to create a SELinux exception for nft bcause otherwise it will be denied and Hummingbird starts without setting up its own lock, thus leaving you unprotected (AirVPN staff is aware of this issue). You can do that with audit2allow. Follow for example this guide to troubleshoot the problem and fix it with the solution given by sealert. Check your /etc/resolv.conf file while not running Hummingbird (because Hummingbird's network lock replaces that file temporarily) to make sure your router is not set as a nameserver (so no 192.168... address). Some routers will push themselves on that list by DHCP whenever you connect to their network. Since communication with the router is allowed in the lock rules, DNS requests will be handled by the router and sent to whatever DNS server is configured there even when network traffic should be blocked. There are ways to prevent that file from being changed by DHCP, best configure network manager for that if you use it. To connect to other VPNs, their IPs must be whitelisted and DNS requests for their domains must be allowed in the default network lock rules (netfilter_ipbatles.rulesipv4/ipv6 and/or netfilter_nftables.rules). Only edit those files with the default network lock deactivated. The rules for airvpn.org can be copied and adjusted. You can set custom options for Hummingbird in the interface or the configuration file. All the possible options can be found in the Hummingbird manual or with sudo hummingbird --help Apart from dialog I tried to only use basic system tools. The scripts will check if everything needed is present, if not they will exit. At least bash 4 is needed. The scripts rely mostly on dialog, awk and curl (and iptables/nft as described and openconnect if needed), so it should work on most systems. I wrote and tested this on Fedora 32 with Hummingbird 1.0.3. It should be possible to use any ovpn config file generated by the AirVPN's config generator. Even with the file for one specific server it should be possible to connect to any other server because the server override function is used here. I haven't tested that extensively though and just use the config file for earth. AirVPN's API seems to be a little unreliable sometimes as in not correctly reporting the connection status. Sometimes the API reports me not being connected although I am connected to an AirVPN server. This is no big deal, it just means that the connection status sometimes may be shown falsely as disconnected. If you have the default network lock activated, no traffic would be possible if you were actually disconnected. And, lastly, VERY IMPORTANT: I am still no programmer and do this only on this on the side, so even though I tried my best to make these scripts secure and error free, there might very well be some bad practice, never-ever-do-this mistakes or other hiccups in there. It works very well for me (and has for quite a while by now), but better check it yourself. Installation Make sure you have the prerequisites installed: dialog, bash >=4, curl and awk. Copy the content of all the files to separate files on your computer, name them accordingly, and put them in the appropriate folders. It says where they belong above the file contents. Make sure to change the ownership of the systemd unit file to root:root and give the scripts execute permissions. Alternatively download the VPNControl.tar, cd into the directory where VPNControl.tar has been downloaded to and enter the following commands: tar -xvf VPNControl.tar mkdir -p "$HOME/.vpncontrol/config" && mkdir "$HOME/.vpncontrol/logs" mv vpncontrol.conf "$HOME/.vpncontrol/config/" mv netfilter_* "$HOME/.vpncontrol/config/" mv VPNControl.sh "$HOME/.local/bin/" sudo mv airvpn_boot.sh "/usr/local/bin/" sudo chown root:root airvpn.service sudo mv airvpn.service "/etc/systemd/system/" Generate a config file with AirVPN's OpenVPN Config Generator (I use the one for "Earth", but theoretically it should work with any) and put it in the config directory. Adjust the path name in the configuration file. The script assumes you have all the configuration files in the folder $HOME/.vpncontrol/config/, logs in $HOME/.vpncontrol/logs/ and the boot script in /usr/local/bin/. In the airvpn_boot.sh-script you have to adjust the path for the source command (line 34) to point to the configuration file. If you want to use different locations, you have to change them in the configuration file and (for the boot script) in the systemd unit file. If you want to use a different location for the configuration file itself, you have the change the VPNCONTROL_CONFIG variable in the VPNControl.sh-script and again the source path in the airvpn_boot.sh-script. The VPNControl.sh-script is meant to be run as a regular user. If you want to run it as root, you have to for sure change the VPNCONTROL_CONFIG variable from the previous step. Otherwise it should be possible to run it as root without problems (except notifications), but I haven't tested it. You need to insert your own API key in the configuration file. It can be found in your account under Client Area -> API. Without this, connections will still work, but user info and connection status in the main window will not be properly updated. Enable the systemd unit with sudo systemctl daemon-reload sudo systemctl enable airvpn.service If you use a setup where bash cannot be found at '/usr/bash', you have to change the path in the unit accordingly. Also I ran into a problem where systemctl complained that it couldn't find the unit. I don't know what the cause was (pretty sure the ownership and permissions were right), but it worked after I duplicated another .service file already present in /etc/systemd/system (with sudo cp) and then renamed it and exchanged the contents. Disable firewall frontends if needed (e. g. firewalld) and if you want to use the default network lock. (Firewall daemons don't necessarily interfere, but have the ability to overwrite the lock any time.) DONE! Now Hummingbird will try to establish a connection after boot. You can call the control script at any time with VPNControl.sh and disconnect/reconnect/do whatever. The script can be exited without affecting the running connection. Files These are all the necessary files (scripts and configuration files) with their default locations. Be aware that there might be a problem when manually copying the contents from here to text files where unwanted characters are inserted. If that's the case, please download the attached archive (at the very bottom of this post) and use the files from there. For the future I plan to put this somewhere more easily accessible like Gitlab. This is the main script, the interface. $HOME/.local/bin/VPNControl.sh #!/bin/bash # interactive shell script to control the command line version of the AirVPN Hummingbird client and openconnect more comfortably and extensively # originally created in January 2019 for Eddie, updated for use with Hummingbird in June 2020 # check if at least bash 4 is used if [ "${BASH_VERSINFO[0]}" -lt "4" ] then echo "This sript can only be run with bash 4 or higher." exit fi # check if necessary programs are installed PROGRAMS=( hummingbird dialog curl awk ) MISSING="false" for p in "${PROGRAMS[@]}" do command -v $p $> /dev/null if [ ! $? = "0" ] then echo "Please install $p to use this script." MISSING="true" fi done if [ "$MISSING" = "true" ] then exit fi # check which network filter is available (determined NETFILTER will be overriden if set in config file) NETFILTERS_AVAILABLE=( iptables iptables-legacy nft ) NETFILTER="none" for n in "${NETFILTERS_AVAILABLE[@]}" do command -v $n $> /dev/null if [ $? = "0" ] then NETFILTER="$n" break fi done # source variables which are subject to change from config file VPNCONTROL_CONFIG="$HOME/.vpncontrol/config/vpncontrol.conf" source "$VPNCONTROL_CONFIG" # variables which probably won't have to be changed DIALOG_OK=0 DIALOG_CANCEL=1 DIALOG_HELP=2 DIALOG_EXTRA=3 DIALOG_ITEM_HELP=4 DIALOG_ESC=255 HEIGHT=0 WIDTH=0 BACKTITLE="VPN Control" FORMAT="text" URL="https://airvpn.org/api/" COLS=$( tput cols ) ROWS=$( tput lines ) PID=$$ # set network-lock argument for hummingbird depending on available backends if [ "$NETFILTER" = "nft" ] then NETFILTER_HUM="nftables" elif [ "$NETFILTER" = "iptables" -o "$NETFILTER" = "iptables-legacy" ] then NETFILTER_HUM="iptables" else NETFILTER_HUM="on" fi function check_sudo { # check if user has sudo privileges sudo -vn &> /dev/null # gain sudo privileges for commands that need it (better than running everything with sudo) if [ $? = "1" ] then unset EXIT_STATUS_SUDO #PASS_PROMPT="Establishing OpenVPN connections and checking and changing network traffic rules requires root privileges. Please enter your password:" until [ "$EXIT_STATUS_SUDO" = "0" ] do dialog \ --backtitle "$BACKTITLE" \ --title "Password Needed" \ --output-fd 1 \ --insecure \ --passwordbox "$PASS_PROMPT" 11 35 | xargs printf '%s\n' | sudo -Svp '' &> /dev/null EXIT_STATUS_PIPE=( "${PIPESTATUS[@]}" ) EXIT_STATUS_DIALOG="${EXIT_STATUS_PIPE[0]}" EXIT_STATUS_SUDO="${EXIT_STATUS_PIPE[2]}" EXIT_SUDO_TEST="${EXIT_STATUS_PIPE[2]}" PASS_PROMPT="The password you entered is incorrect. Please try again:" case $EXIT_STATUS_DIALOG in $DIALOG_CANCEL|$DIALOG_ESC) return 1 ;; esac done # keep sudo permission until script exits or permissions are revoked (e.g. when computer goes to sleep) while [ "$EXIT_SUDO_TEST" = "0" ]; do sudo -vn; EXIT_SUDO_TEST=$?; sleep 60; kill -0 "$PID" || exit; done &> /dev/null & fi return 0 } function get_list { SERVICE_NAME="status" timeout --signal=SIGINT 10 curl -s "$URL$SERVICE_NAME/?format=$FORMAT" > "/tmp/.airvpn_server_list.txt" } function sort_list_servers { # pipe server status list to awk, filter out unnecessary stuff, # combine lines that relate to same server into single lines which are saved as array, # loop through array to format info, # print array and sort according to options, # add numbers to list for menu LIST_SERVERS=$(awk -F '[.]' \ 'BEGIN{OFS=";"} \ /^servers/ && !/ip_/ && !/country_code/ {c=$2; \ if (c in servers) servers[c]=servers[c] OFS $3; \ else servers[c]=$3; \ for (k in servers) gsub(/;bw=/, " :", servers[k]); \ for (k in servers) gsub(/;bw_max=/, "/", servers[k]); \ for (k in servers) gsub(/;currentload=/, " :", servers[k]); \ for (k in servers) gsub(/;health=/, "%:", servers[k]); \ for (k in servers) gsub(/;.*=/, ":", servers[k]); \ for (k in servers) gsub(/^.*=/, "", servers[k])} \ END{for (c in servers) print servers[c]}' "/tmp/.airvpn_server_list.txt" | sort -t ":" $1) LIST_SERVERS=$( echo "$LIST_SERVERS" | sed 's/:/;/' ) } function sort_list_countries { LIST_COUNTRIES=$(awk -F '[.]' \ 'BEGIN{OFS=";"} \ /^countries/ && (/country_name/ || /country_code/) {c=$2; \ if (c in countries) countries[c]=countries[c] OFS $3; \ else countries[c]=$3; \ for (k in countries) gsub(/;.*=/, ":", countries[k]); \ for (k in countries) gsub(/^.*=/, "", countries[k])} \ END{for (c in countries) print countries[c]}' "/tmp/.airvpn_server_list.txt" | sort -t ":" -d) } function get_userinfo { SERVICE_NAME="userinfo" # filter specific lines, save values (after "=") to variables after protecting whitespace read U_LOGIN U_EXP U_CONNECTED U_DEVICE U_SERVER_NAME U_SERVER_COUNTRY U_SERVER_LOCATION U_TIME <<< $( \ timeout --signal=SIGINT 10 curl -s "$URL$SERVICE_NAME/?key=$API_KEY&format=$FORMAT" | \ awk -F '[=]' \ 'BEGIN{ORS=";"} \ /^user.login|^user.expiration_days|^user.connected|^sessions.*device_name|^connection.server_name|^connection.server_country=|^connection.server_location|^connection.connected_since_date/ \ {print $2}' | \ sed 's/\ /\\\ /g' | sed 's/;/\ /g' \ ) if [ "$U_CONNECTED" = "true" ] then U_CONNECTED="connected" U_SERVER_FULL="$U_SERVER_NAME ($U_SERVER_LOCATION, $U_SERVER_COUNTRY)" U_TIME=$(date -d "$U_TIME UTC" +"%a %d. %b %Y %H:%M:%S") else U_CONNECTED="not connected" U_SERVER_FULL="--" U_TIME="--" fi } function connect_server { if [ "$KILLED" = "true" ] then DATE=$( date +%Y%m%d ) LOG_NAMES=($( ls "$LOG_PATH" | grep hummingbird.*log | sort -d )) LOG_NR=${#LOG_NAMES[@]} LOG_CURRENT="$LOG_PATH/hummingbird_current_$DATE.log" # if no log files should be kept, discard current logfile after process finishes, otherwise append to log file of current date if [ "$LOG_DAYS" = "0" ] then LOG_FINISH="/dev/null" else LOG_FINISH="$LOG_PATH/hummingbird_$DATE.log" fi if [ "$LOG_NR" -gt "0" ] then # check if newest log file is from today and if not, increase counter, so with the upcoming logfile the file limit will be kept if [ ! $( echo ${LOG_NAMES[-1]/#hummingbird_/} | cut -d "." -f 1 ) = "$DATE" ] then LOG_NR=$(( $LOG_NR+1 )) fi # check if more logs (including the upcoming one) are present than there should be and if so, remove oldest ones if [ "$LOG_NR" -gt "$LOG_DAYS" ] then cd "$LOG_PATH" rm "${LOG_NAMES[@]:0:(( $LOG_NR-$LOG_DAYS ))}" cd - fi fi # run hummingbird in background and detached from current window, write output to logfile, read it from there to dialog and catch sign of successful connection # hummingbird's timeout option is used, so it has enough time after sleep to recover without trying forever; TIMEOUT variable is used to try another server after some time when it is reasonable to not expect a successful connection anymore (sudo hummingbird $HUM_OPTIONS --network-lock "$NETFILTER_HUM" --timeout "$TIMEOUT_REC" --server "$1"."$DOMAIN" "$CONFIG_PATH" &> "$LOG_CURRENT"; notify-send "AirVPN" "Hummingbird process has finished."; sleep 1; cat "$LOG_CURRENT" >> "$LOG_FINISH"; rm "$LOG_CURRENT") & tail -f -n 5 "$LOG_CURRENT" | dialog --backtitle "$BACKTITLE" --title "Connecting to AirVPN (Server: $1) ..." --progressbox 20 80 & tail -f -n 5 "$LOG_CURRENT" | timeout --signal=SIGINT "$TIMEOUT_CON" grep -q -m 1 "EVENT: CONNECTED" INIT_EXIT=$? pkill -f tail.*hummingbird_current if [ "$INIT_EXIT" = "0" ] then sleep 1 get_userinfo notify-send "AirVPN" "VPN connection successfully established to AirVPN's server $U_SERVER_FULL." else U_CONNECTED="error during connection attempt" U_SERVER_FULL="--" U_TIME="--" sudo pkill -2 hummingbird notify-send "AirVPN" "Connection attempt to an AirVPN server has failed." # need to wait long enough, so "current" log file is deleted before next connection attempt, otherwise file counter will be too high and delete other log files (takes arount +20ms, but sometimes more, so better to add 1s) sleep 2 fi else U_CONNECTED="error during disconnection" U_SERVER_FULL="--" U_TIME="--" fi } function connect_openconnect { if [ "$KILLED" = "true" ] then DATE=$( date +%Y%m%d ) LOG_NAMES=($( ls "$LOG_PATH" | grep openconnect.*log | sort -d )) LOG_NR=${#LOG_NAMES[@]} # if no log files should be kept, discard current logfile after process finishes, otherwise append to log file of current date if [ "$LOG_DAYS" = "0" ] then LOG_FINISH="/dev/null" else LOG_FINISH="$LOG_PATH/openconnect_$DATE.log" fi if [ "$LOG_NR" -gt "0" ] then # check if newest log file is from today and if not, increase counter, so with the upcoming logfile the file limit will be kept if [ ! $( echo ${LOG_NAMES[-1]/#openconnect_/} | cut -d "." -f 1 ) = "$DATE" ] then LOG_NR=$(( $LOG_NR+1 )) fi # check if more logs (including the upcoming one) are present than there should be and if so, remove oldest ones if [ "$LOG_NR" -gt "$LOG_DAYS" ] then cd "$LOG_PATH" rm "${LOG_NAMES[@]:0:(( $LOG_NR-$LOG_DAYS ))}" cd - fi fi ALT_SERVER=$(echo -n "$CONNECT_INFO" | cut -d$'\n' -f 1) ALT_GROUP=$(echo -n "$CONNECT_INFO" | cut -d$'\n' -f 2) ALT_USER=$(echo -n "$CONNECT_INFO" | cut -d$'\n' -f 3) ALT_PASS=$(echo -n "$CONNECT_INFO" | cut -d$'\n' -f 4) ALT_OPTS=$(echo -n "$CONNECT_INFO" | cut -d$'\n' -f 5) echo "$ALT_PASS" | (sudo openconnect $ALT_OPTS --authgroup=$ALT_GROUP --user=$ALT_USER --passwd-on-stdin $ALT_SERVER &> "$LOG_PATH/openconnect_current_$DATE.log"; notify-send "Openconnect" "Openconnect process has finished."; sleep 1; cat "$LOG_PATH/openconnect_current_$DATE.log" >> "$LOG_FINISH"; rm "$LOG_PATH/openconnect_current_$DATE.log") & timeout --signal=SIGINT 3 tail -f -n 20 "$LOG_PATH/openconnect_current_$DATE.log" | dialog --backtitle "$BACKTITLE" --title "Connecting via openconnect ..." --timeout 5 --programbox 20 80 U_CONNECTED="connected" U_SERVER_FULL="$ALT_SERVER" U_TIME=$(date +"%a %d. %b %Y %H:%M:%S") else U_CONNECTED="error during disconnection" U_SERVER_FULL="--" U_TIME="--" fi } function disconnect_server { # check for running instance of hummingbird HUM_PID=$( pgrep hummingbird ) if [ $? = 0 ] then # kill process and wait for confirmation from process output # check if running instance of hummingbird is writing to logfile and if so, listen there for confirmation sudo ls -l "/proc/$HUM_PID/fd" | grep hummingbird_current &> /dev/null if [ $? = 0 ] then sudo pkill -2 hummingbird & tail -f -n 5 "$LOG_PATH/hummingbird_current_"* | dialog --backtitle "$BACKTITLE" --title "Disconnecting from AirVPN ..." --progressbox 20 80 & tail -f -n 5 "$LOG_PATH/hummingbird_current_"* | timeout --signal=SIGINT 3 grep -q -m 1 "Thread finished" pkill -f tail.*hummingbird_current else # in case connection was started without this script sudo pkill -2 hummingbird sleep 2 fi # give some time to completely close process, without sleep it's too early for new connection sleep 1 pgrep hummingbird &> /dev/null if [ $? = 1 ] then KILLED1="true" notify-send "AirVPN" "VPN connection has been stopped successfully." else KILLED1="false" notify-send "AirVPN" "An error has occured during the disconnection attempt." fi else KILLED1="true" fi # check for running instance of openconnect pgrep -f "openconnect.*--" &> /dev/null if [ $? = 0 ] then pkill -2 -f "openconnect.*--" sleep 1 pgrep -f "openconnect.*--" &> /dev/null if [ $? = 1 ] then KILLED2="true" notify-send "AirVPN" "VPN connection to openconnect has been stopped successfully." # somehow openconnect doesn't receive SIGINT and shuts down improperly, # so vpnc can't restore resolv.conf by itself sudo cp "/var/run/vpnc/resolv.conf-backup" "/etc/resolv.conf" else KILLED2="false" notify-send "AirVPN" "An error has occured during the attempt to disconnect from openconnect." fi else KILLED2="true" fi if [ "$KILLED1" = "true" -a "$KILLED2" = "true" ] then KILLED="true" else KILLED="false" fi } function toggle_lock { if [ "$1" = "activate" ] then if [ "$NETFILTER" = "iptables-legacy" ] then sudo iptables-legacy-save > "${NETFILTER_RULES_IPTABLES}ipv4.backup" sudo ip6tables-legacy-save > "${NETFILTER_RULES_IPTABLES}ipv6.backup" sudo iptables-legacy-restore < "${NETFILTER_RULES_IPTABLES}ipv4" sudo ip6tables-legacy-restore < "${NETFILTER_RULES_IPTABLES}ipv6" elif [ "$NETFILTER" = "iptables" ] then sudo iptables-save > "${NETFILTER_RULES_IPTABLES}ipv4.backup" sudo ip6tables-save > "${NETFILTER_RULES_IPTABLES}ipv6.backup" sudo iptables-restore < "${NETFILTER_RULES_IPTABLES}ipv4" sudo ip6tables-restore < "${NETFILTER_RULES_IPTABLES}ipv6" elif [ "$NETFILTER" = "nft" ] then # put command to flush ruleset at top of backup file, so when it is loaded to restore the old rules, all previous rules are deleted in the same transaction (would take 2 transacions otherwise) echo "flush ruleset" > "${NETFILTER_RULES_NFTABLES}.backup" sudo nft list ruleset >> "${NETFILTER_RULES_NFTABLES}.backup" sudo nft -f "${NETFILTER_RULES_NFTABLES}" fi elif [ "$1" = "deactivate" ] then if [ "$NETFILTER" = "iptables-legacy" ] then if [ -s "${NETFILTER_RULES_IPTABLES}ipv4.backup" ] then sudo iptables-legacy-restore < "${NETFILTER_RULES_IPTABLES}ipv4.backup" sudo rm "${NETFILTER_RULES_IPTABLES}ipv4.backup" else sudo iptables-legacy -F sudo iptables-legacy -t nat -F fi if [ -s "${NETFILTER_RULES_IPTABLES}ipv6.backup" ] then sudo ip6tables-legacy-restore < "${NETFILTER_RULES_IPTABLES}ipv6.backup" sudo rm "${NETFILTER_RULES_IPTABLES}ipv6.backup" else sudo ip6tables-legacy -F sudo ip6tables-legacy -t nat -F fi elif [ "$NETFILTER" = "iptables" ] then if [ -s "${NETFILTER_RULES_IPTABLES}ipv4.backup" ] then sudo iptables-restore < "${NETFILTER_RULES_IPTABLES}ipv4.backup" sudo rm "${NETFILTER_RULES_IPTABLES}ipv4.backup" else sudo iptables -F sudo iptables -t nat -F fi if [ -s "${NETFILTER_RULES_IPTABLES}ipv6.backup" ] then sudo ip6tables-restore < "${NETFILTER_RULES_IPTABLES}ipv6.backup" sudo rm "${NETFILTER_RULES_IPTABLES}ipv6.backup" else sudo ip6tables -F sudo ip6tables -t nat -F fi elif [ "$NETFILTER" = "nft" ] then if [ -s "${NETFILTER_RULES_NFTABLES}.backup" ] then sudo nft -f "${NETFILTER_RULES_NFTABLES}.backup" sudo rm "${NETFILTER_RULES_NFTABLES}.backup" else sudo nft flush ruleset fi fi else return 1 fi check_lock if [ "$LOCK_ACTIVE" = "inactive" ] then dialog --backtitle "$BACKTITLE" --title "Default Network Lock Inactive" --msgbox "$MISSINGRULES" $HEIGHT $WIDTH elif [ "$LOCK_ACTIVE" = "active" ] then dialog --backtitle "$BACKTITLE" --title "Default Network Lock Active" --timeout 3 --msgbox "The default network lock is active." $HEIGHT $WIDTH else return 1 fi } function check_lock { if [ "$NETFILTER" = "iptables-legacy" ] then # load rules from ruleset file into array (only -A rules (append) are loaded), prefix with iptables or ip6tables command as fitting, change -A (append) to -C (check) mapfile -t IPRULESIPV4 < <(grep -e "-A " "${NETFILTER_RULES_IPTABLES}ipv4" | sed -e 's/^\(.*\)/sudo iptables-legacy \1/' -e 's/\ -A / -C /') mapfile -t IPRULESIPV6 < <(grep -e "-A " "${NETFILTER_RULES_IPTABLES}ipv6" | sed -e 's/^\(.*\)/sudo ip6tables-legacy \1/' -e 's/\ -A / -C /') LOCK_ACTIVE="error while checking" # only checks for presence of rules, not for order; if not present in default table (filter), check in other tables MISSINGRULES="The following rules are not present:\n" for i in "${IPRULESIPV4[@]}" do eval "$i" &> /dev/null if [ ! $? = "0" ] then eval "${i/legacy/legacy -t nat}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/legacy/legacy -t mangle}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/legacy/legacy -t raw}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/legacy/legacy -t security}" &> /dev/null fi if [ ! $? = "0" ] then MISSINGRULES="$MISSINGRULES\nIPv4: $i" LOCK_ACTIVE="inactive" fi done for i in "${IPRULESIPV6[@]}" do eval "$i" &> /dev/null if [ ! $? = "0" ] then eval "${i/legacy/legacy -t nat}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/legacy/legacy -t mangle}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/legacy/legacy -t raw}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/legacy/legacy -t security}" &> /dev/null fi if [ ! $? = "0" ] then MISSINGRULES="$MISSINGRULES\nIPv6: $i" LOCK_ACTIVE="inactive" fi done if [ "$LOCK_ACTIVE" = "inactive" ] then MISSINGRULES="${MISSINGRULES//sudo iptables -C /}\n\nPlease check manually." MISSINGRULES="${MISSINGRULES//sudo ip6tables -C /}" else LOCK_ACTIVE="active" fi elif [ "$NETFILTER" = "iptables" ] then # load rules from ruleset file into array (only -A rules (append) are loaded), prefix with iptables or ip6tables command as fitting, change -A (append) to -C (check) mapfile -t IPRULESIPV4 < <(grep -e "-A " "${NETFILTER_RULES_IPTABLES}ipv4" | sed -e 's/^\(.*\)/sudo iptables \1/' -e 's/\ -A / -C /') mapfile -t IPRULESIPV6 < <(grep -e "-A " "${NETFILTER_RULES_IPTABLES}ipv6" | sed -e 's/^\(.*\)/sudo ip6tables \1/' -e 's/\ -A / -C /') LOCK_ACTIVE="error while checking" # only checks for presence of rules, not for order; if not present in default table (filter), check in other tables MISSINGRULES="The following rules are not present:\n" for i in "${IPRULESIPV4[@]}" do eval "$i" &> /dev/null if [ ! $? = "0" ] then eval "${i/tables/tables -t nat}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/tables/tables -t mangle}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/tables/tables -t raw}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/tables/tables -t security}" &> /dev/null fi if [ ! $? = "0" ] then MISSINGRULES="$MISSINGRULES\nIPv4: $i" LOCK_ACTIVE="inactive" fi done for i in "${IPRULESIPV6[@]}" do eval "$i" &> /dev/null if [ ! $? = "0" ] then eval "${i/tables/tables -t nat}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/tables/tables -t mangle}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/tables/tables -t raw}" &> /dev/null fi if [ ! $? = "0" ] then eval "${i/tables/tables -t security}" &> /dev/null fi if [ ! $? = "0" ] then MISSINGRULES="$MISSINGRULES\nIPv6: $i" LOCK_ACTIVE="inactive" fi done if [ "$LOCK_ACTIVE" = "inactive" ] then MISSINGRULES="${MISSINGRULES//sudo iptables -C /}\n\nPlease check manually." MISSINGRULES="${MISSINGRULES//sudo ip6tables -C /}" else LOCK_ACTIVE="active" fi elif [ "$NETFILTER" = "nft" ] then # only checks if named tables from netfilter config file are present NFT_LOCK_TABLES=$( sudo nft list ruleset | grep "_lock" | wc -l ) if [ "$NFT_LOCK_TABLES" -ge "3" ] then LOCK_ACTIVE="active" else LOCK_ACTIVE="inactive" MISSINGRULES="The default network lock is deactivated. The nft tables with rules for the default network lock are not loaded." fi else return 1 fi } function yesno { dialog \ --backtitle "$BACKTITLE" \ --title "$1" \ --clear \ --yesno "$2" \ $HEIGHT $WIDTH EXIT_STATUS=$? } get_userinfo # if currently connected by openconnect, set status to unknown (connection could have been established outside of this script) pgrep -f "openconnect.*--" &> /dev/null if [ $? = 0 ] then U_CONNECTED="connected (openconnect)" U_SERVER_FULL="unknown" U_TIME="unknown" fi # set default message for network lock status, so password doesn't have to be entered when starting the script to check status if [ "$NETFILTER" = "none" ] then LOCK_ACTIVE="None of the supported network filters are available, so the default network lock cannot be used." else LOCK_ACTIVE="Select option 8 to check lock status." fi while true; do exec 3>&1 selection=$(dialog \ --cr-wrap \ --backtitle "$BACKTITLE" \ --title "Main Menu" \ --clear \ --cancel-label "Quit" \ --menu "This is a control script for VPN connections, primarily for AirVPN's Hummingbird client.\nThis script can be exited and re-entered without affecting a running connection.\n\nUser: $U_LOGIN\nDays Until Expiration: $U_EXP\n\nDefault Network Lock: $LOCK_ACTIVE\n\nStatus: $U_CONNECTED\nServer: $U_SERVER_FULL\nConnected Since: $U_TIME\n\nPlease select one of the following options:" $HEIGHT $WIDTH 9 \ "0" "Connect to Recommended Server" \ "1" "Connect to Recommended Server of Country" \ "2" "Connect to Specific Server" \ "3" "Connect to Random Server" \ "4" "Set Options for Hummingbird" \ "5" "Connect via Openconnect" \ "6" "Disconnect" \ "7" "Refresh User Info" \ "8" "Check Default Network Lock Status" \ "9" "Toggle Default Network Lock" \ 2>&1 1>&3) EXIT_STATUS=$? exec 3>&- case $EXIT_STATUS in $DIALOG_CANCEL|$DIALOG_ESC) yesno "Quit" "Exit Script?" case $EXIT_STATUS in $DIALOG_CANCEL|$DIALOG_ESC) ;; $DIALOG_OK) break ;; esac ;; esac case $selection in 0 ) PASS_PROMPT="Connecting to and disconnecting from AirVPN with hummingbird requires root privileges. Please enter your password:" check_sudo if [ $? = "0" ] then disconnect_server #get_list DOMAIN="vpn.airdns.org" INIT_EXIT="1" connect_server "earth" if [ ! "$INIT_EXIT" = "0" ] then count="1" for s in "${SERVERS_BEST_EU[@]}" do connect_server "$s" if [ "$INIT_EXIT" = "0" ] then break else (( count++ )) fi if [ "$count" -ge 5 ] then break fi done fi if [ ! "$INIT_EXIT" = "0" ] then for s in "${SERVERS_BEST_REST[@]}" do connect_server "$s" if [ "$INIT_EXIT" = "0" ] then break else (( count++ )) fi if [ "$count" -ge 7 ] then notify-send "AirVPN" "Connection unsuccessful after $count failed attempts." break fi done fi fi ;; 1 ) if [ ! -s "/tmp/.airvpn_server_list.txt" ] then get_list fi while true do sort_list_countries IFS=$':\n' exec 3>&1 COUNTRY_NAME=$(dialog \ --backtitle "$BACKTITLE" \ --title "Country List" \ --colors \ --no-collapse \ --column-separator ":" \ --menu "Choose a country from the list to connect to.\n\n\Zb Country Country Code\ZB" \ 30 50 31 $LIST_COUNTRIES 2>&1 1>&3) EXIT_STATUS=$? exec 3>&- IFS=$' \t\n' case $EXIT_STATUS in $DIALOG_CANCEL|$DIALOG_ESC) break ;; $DIALOG_OK) PASS_PROMPT="Connecting to and disconnecting from AirVPN with hummingbird requires root privileges. Please enter your password:" check_sudo if [ $? = "0" ] then SELECTED_COUNTRY=$(printf -- '%s\n' "${LIST_COUNTRIES[@]}" | grep "^$COUNTRY_NAME" | cut -d ":" -f 2 ) disconnect_server DOMAIN="vpn.airdns.org" connect_server "$SELECTED_COUNTRY" break fi ;; esac done ;; 2 ) while true; do exec 3>&1 SERVER_SORT=$(dialog \ --backtitle "$BACKTITLE" \ --title "Sort Server List" \ --no-collapse \ --ok-label "sort ascending" \ --extra-button \ --extra-label "sort descending" \ --menu "Please choose how you want to sort the server list." \ 14 0 7 \ "1" "Name" \ "2" "Country" \ "3" "Location" \ "4" "Continent" \ "5" "Bandwidth" \ "6" "Users" \ "7" "Load" \ 2>&1 1>&3) EXIT_STATUS=$? exec 3>&- case $EXIT_STATUS in $DIALOG_CANCEL|$DIALOG_ESC) break ;; $DIALOG_EXTRA) SERVER_SORT_OPTION="r" ;; $DIALOG_OK) SERVER_SORT_OPTION="" ;; esac if [ "$SERVER_SORT" = "5" -o "$SERVER_SORT" = "6" -o "$SERVER_SORT" = "7" ] then SERVER_NUM_OPTION="n" else SERVER_NUM_OPTION="" fi if [ ! -s "/tmp/.airvpn_server_list.txt" ] then get_list fi while true do sort_list_servers "-k$SERVER_SORT,$SERVER_SORT$SERVER_SORT_OPTION$SERVER_NUM_OPTION" IFS=$';\n' exec 3>&1 SELECTED_SERVER=$(dialog \ --backtitle "$BACKTITLE" \ --title "Server List" \ --colors \ --no-collapse \ --extra-button \ --extra-label "Refresh List" \ --column-separator ":" \ --menu "Choose a server from the list to connect to it. (Press ESC to go back.)\n\n\Zb Name Country Location Continent Bandwidth Users Load Health\ZB" \ 40 102 31 $LIST_SERVERS 2>&1 1>&3) EXIT_STATUS=$? exec 3>&- IFS=$' \t\n' case $EXIT_STATUS in $DIALOG_CANCEL) break 2 ;; $DIALOG_ESC) break ;; $DIALOG_EXTRA) get_list ;; $DIALOG_OK) PASS_PROMPT="Connecting to and disconnecting from AirVPN with hummingbird requires root privileges. Please enter your password:" check_sudo if [ $? = "0" ] then disconnect_server DOMAIN="airvpn.org" connect_server "$SELECTED_SERVER" break 2 fi ;; esac done done ;; 3 ) PASS_PROMPT="Connecting to and disconnecting from AirVPN with hummingbird requires root privileges. Please enter your password:" check_sudo if [ $? = "0" ] then disconnect_server get_list INIT_EXIT="1" count="0" while [ ! "$INIT_EXIT" = "0" ] do i="0" while [ $i -le 20 ] do RAN_SERVER_NM=$( grep -E "servers\..+\.public_name" /tmp/.airvpn_server_list.txt | shuf -n1 | cut -d "." -f 2 ) RAN_SERVER_HEALTH=$( grep "servers\.$RAN_SERVER_NM\.health" /tmp/.airvpn_server_list.txt | cut -d "=" -f 2 ) if [ "$RAN_SERVER_HEALTH" = "ok" ] then RAN_SERVER=$( grep "servers\.$RAN_SERVER_NM\.public_name" /tmp/.airvpn_server_list.txt | cut -d "=" -f 2 ) break fi (( i++ )) done if [ "$i" -eq 20 ] then break elif [ "$count" -ge 7 ] then notify-send "AirVPN" "Connection unsuccessful after $count failed attempts." break fi DOMAIN="airvpn.org" connect_server "$RAN_SERVER" (( count++ )) done fi ;; 4 ) exec 3>&1 HUM_OPTIONS=$(dialog \ --backtitle "$BACKTITLE" \ --title "Set custom Hummingbird options" \ --extra-button \ --extra-label "Make options permanent" \ --form "If you want to use custom options for hummingbird, you can enter them here.\nType them like you would in the command line, separated by a space (e. g. --proto tcp --ignore-dns-push).\nNote that the options --timeout, --network-lock and --server are already used and can't be set here.\nThese options will override the ones you might have set in configuration file and will only be used for connections you make until you close the script. You can make them permanent with the button below (navigate with <TAB>)." $HEIGHT $WIDTH 5 \ "Options:" 5 1 "$HUM_OPTIONS" 5 10 50 100 \ 2>&1 1>&3) EXIT_STATUS=$? exec 3>&- case $EXIT_STATUS in $DIALOG_CANCEL|$DIALOG_ESC) ;; $DIALOG_EXTRA) sed -i -e '/^HUM_OPTIONS/d' "$VPNCONTROL_CONFIG" echo "HUM_OPTIONS=\"$HUM_OPTIONS\"" >> "$VPNCONTROL_CONFIG" ;; $DIALOG_OK) ;; esac ;; 5 ) exec 3>&1 # adjust field lengths if necessary CONNECT_INFO=$(dialog \ --backtitle "$BACKTITLE" \ --title "VPN via openconnect" \ --insecure \ --mixedform "Please provide your login credentials to connect to a VPN via openconnect:\n(Leave unneeded fields blank and type options as in command line, separated by space.)" $HEIGHT $WIDTH 6 \ "Server:" 1 1 "" 1 21 25 0 0 \ "Group:" 2 1 "" 2 21 25 0 0 \ "User:" 3 1 "" 3 21 25 0 0 \ "Password:" 4 1 "" 4 21 25 0 1 \ "Additional Options:" 5 1 "--no-dtls" 5 21 25 0 0 \ 2>&1 1>&3) EXIT_STATUS=$? exec 3>&- case $EXIT_STATUS in $DIALOG_CANCEL|$DIALOG_ESC) ;; $DIALOG_OK) PASS_PROMPT="Establishing OpenVPN connections requires root privileges. Please enter your password:" check_sudo if [ $? = "0" ] then disconnect_server connect_openconnect fi ;; esac ;; 6 ) PASS_PROMPT="Disconnecting from AirVPN with hummingbird requires root privileges. Please enter your password:" check_sudo if [ $? = "0" ] then disconnect_server if [ "$KILLED" = "true" ] then get_userinfo else U_CONNECTED="error during disconnection" U_SERVER_FULL="--" U_TIME="--" fi fi ;; 7 ) get_userinfo ;; 8 ) if [ "$NETFILTER" = "none" ] then dialog --backtitle "$BACKTITLE" --title "Network Lock Not Available" --timeout 3 --msgbox "$LOCK_ACTIVE" 10 35 else pgrep hummingbird &> /dev/null if [ $? = 0 ] then dialog --backtitle "$BACKTITLE" --title "Check Default Network Lock" --timeout 8 --msgbox "Default network lock can only be checked when hummingbird is not running since it has it's own network lock overriding the default one." 10 35 else PASS_PROMPT="Checking network traffic rules requires root privileges. Please enter your password:" check_sudo check_lock if [ "$LOCK_ACTIVE" = "inactive" ] then dialog --backtitle "$BACKTITLE" --title "Default Network Lock Inactive" --msgbox "$MISSINGRULES" $HEIGHT $WIDTH elif [ "$LOCK_ACTIVE" = "active" ] then dialog --backtitle "$BACKTITLE" --title "Default Network Lock Active" --timeout 3 --msgbox "The default network lock is active." $HEIGHT $WIDTH else return 1 fi fi fi ;; 9 ) if [ "$NETFILTER" = "none" ] then dialog --backtitle "$BACKTITLE" --title "Network Lock Not Available" --timeout 3 --msgbox "$LOCK_ACTIVE" 10 35 else pgrep hummingbird &> /dev/null if [ $? = 0 ] then dialog --backtitle "$BACKTITLE" --title "Toggle Network Lock" --timeout 3 --msgbox "You need to be disconnected to change network traffic rules." 10 35 else check_lock if [ "$LOCK_ACTIVE" = "inactive" ] then yesno "Toggle Network Lock" "Are you sure you want to activate the default network lock and block all connections while not connected to (any) VPN?" case $EXIT_STATUS in $DIALOG_CANCEL|$DIALOG_ESC) ;; $DIALOG_OK) PASS_PROMPT="Changing network traffic rules requires root privileges. Please enter your password:" check_sudo if [ $? = "0" ] then toggle_lock "activate" fi ;; esac elif [ "$LOCK_ACTIVE" = "active" ] then yesno "Toggle Network Lock" "Are you sure you want to deactivate the default network lock and allow all connections, even when not connected to a VPN?" case $EXIT_STATUS in $DIALOG_CANCEL|$DIALOG_ESC) ;; $DIALOG_OK) PASS_PROMPT="Changing network traffic rules requires root privileges. Please enter your password:" check_sudo if [ $? = "0" ] then toggle_lock "deactivate" fi ;; esac else return 1 fi fi fi ;; esac done clear This is the script that tries to establish a connection at boot. /usr/local/bin/airvpn_boot.sh #!/bin/bash # script to connect to recommended AirVPN server, created to be used in systemd unit at boot # check if necessary programs are installed PROGRAMS=( hummingbird curl ) MISSING="false" for p in "${PROGRAMS[@]}" do command -v $p $> /dev/null if [ ! $? = "0" ] then MISSING="true" fi done if [ "$MISSING" = "true" ] then exit fi # check which network filter is available (determined NETFILTER will be overriden if set in config file) NETFILTERS_AVAILABLE=( iptables iptables-legacy nft ) NETFILTER="none" for n in "${NETFILTERS_AVAILABLE[@]}" do command -v $n $> /dev/null if [ $? = "0" ] then NETFILTER="$n" break fi done # source variables which are subject to change from config file source "/home/<USER>/.vpncontrol/config/vpncontrol.conf" # set network-lock argument for hummingbird depending on available backends if [ "$NETFILTER" = "nft" ] then NETFILTER_HUM="nftables" elif [ "$NETFILTER" = "iptables" -o "$NETFILTER" = "iptables-legacy" ] then NETFILTER_HUM="iptables" else NETFILTER_HUM="on" fi # in order to correctly send notifications via notify-send as root, DISPLAY variable must be set (only on X, not on Wayland) and DBUS_SESSION_BUS_ADDRESS (automatically set based on username) #DISPLAY=:0 USER_ID=$( id -u $SCRIPT_USER ) DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" function activate_lock { # use detour with cat because SELinux denies direct read/write access for iptables and nft (actually nft was only denied write access, couldn't read for other permission reason, but this way it works) if [ "$NETFILTER" = "iptables-legacy" ] then iptables-legacy-save | cat > "${NETFILTER_RULES_IPTABLES}ipv4.backup" ip6tables-legacy-save | cat > "${NETFILTER_RULES_IPTABLES}ipv6.backup" cat "${NETFILTER_RULES_IPTABLES}ipv4" | iptables-legacy-restore cat "${NETFILTER_RULES_IPTABLES}ipv6" | ip6tables-legacy-restore elif [ "$NETFILTER" = "iptables" ] then iptables-save | cat > "${NETFILTER_RULES_IPTABLES}ipv4.backup" ip6tables-save | cat > "${NETFILTER_RULES_IPTABLES}ipv6.backup" cat "${NETFILTER_RULES_IPTABLES}ipv4" | iptables-restore cat "${NETFILTER_RULES_IPTABLES}ipv6" | ip6tables-restore elif [ "$NETFILTER" = "nft" ] then # put command to flush ruleset at top of backup file, so when it is loaded to restore the old rules, all previous rules are deleted in the same transaction (would take 2 transacions otherwise) echo "flush ruleset" > "${NETFILTER_RULES_NFTABLES}.backup" nft list ruleset | cat >> "${NETFILTER_RULES_NFTABLES}.backup" cat "${NETFILTER_RULES_NFTABLES}" | nft -f - fi } function connect_server { DATE=$( date +%Y%m%d ) # names and number of currently present logs LOG_NAMES=($( ls "$LOG_PATH" | grep hummingbird.*log | sort -d )) LOG_NR=${#LOG_NAMES[@]} # if no log files should be kept, discard current logfile after process finishes, otherwise append to log file of current date if [ "$LOG_DAYS" = "0" ] then LOG_FINISH="/dev/null" else LOG_FINISH="$LOG_PATH/hummingbird_$DATE.log" fi # check if newest log file is from today and if not, increase counter, so with the upcoming logfile the file limit will be kept and create final log file as user, so the user can write to it later if [ "$LOG_NR" -gt "0" ] then if [ ! $( echo ${LOG_NAMES[-1]/#hummingbird_/} | cut -d "." -f 1 ) = "$DATE" ] then LOG_NR=$(( $LOG_NR+1 )) if [ ! "$LOG_DAYS" = "0" ] then su "$SCRIPT_USER" -c "touch $LOG_FINISH" fi fi # check if more logs (including the upcoming one) are present than there should be and if so, remove oldest ones if [ "$LOG_NR" -gt "$LOG_DAYS" ] then cd "$LOG_PATH" rm "${LOG_NAMES[@]:0:(( $LOG_NR-$LOG_DAYS ))}" cd - fi else su "$SCRIPT_USER" -c "touch $LOG_FINISH" fi su "$SCRIPT_USER" -c "notify-send 'AirVPN' 'Connecting to AirVPN ...'" # run hummingbird in background (and send notification when process finishes), pipe output to log (hummingbird $HUM_OPTIONS --network-lock "$NETFILTER_HUM" --timeout "$TIMEOUT_REC" --server "$1".vpn.airdns.org "$CONFIG_PATH" &>> "$LOG_PATH/hummingbird_current_$DATE.log"; su "$SCRIPT_USER" -c "notify-send.sh 'AirVPN' 'Hummingbird process has finished.'"; sleep 1; cat "$LOG_PATH/hummingbird_current_$DATE.log" >> "$LOG_FINISH"; rm "$LOG_PATH/hummingbird_current_$DATE.log") & # monitor log to catch sign of successful connection tail -f -n 5 "/$LOG_PATH/hummingbird_current_$DATE.log" | timeout --signal=SIGINT "$TIMEOUT_CON" grep -q -m 1 "EVENT: CONNECTED" INIT_EXIT=$? pkill -f tail.*hummingbird_current if [ "$INIT_EXIT" = "0" ] then # send notification as regular user for it to be sent and displayed correctly su "$SCRIPT_USER" -c "notify-send 'AirVPN' 'VPN connection successfully established.'" exit else pkill -2 hummingbird su "$SCRIPT_USER" -c "notify-send 'AirVPN' 'Connection attempt to an AirVPN server has failed.'" # need to wait long enough, so "current" log file is deleted before next connection attempt, otherwise file counter will be too high and delete other log files (takes around +20ms, but sometimes more, so better to add 1s) sleep 2 fi } INIT_EXIT="1" if [ "$DEFAULT_NETLOCK" = "enabled" ] then activate_lock fi # try to connect to recommended servers (first EU, then rest of the world; change order/adjust server lists if desired) connect_server "earth" if [ ! "$INIT_EXIT" = "0" ] then # count connection attempts in order to stop after certain number count="1" for s in "${SERVERS_BEST_EU[@]}" do connect_server "$s" if [ $INIT_EXIT = "0" ] then break else (( count++ )) fi if [ "$count" -ge 3 ] then break fi done fi if [ ! "$INIT_EXIT" = "0" ] then for s in "${SERVERS_BEST_REST[@]}" do connect_server "$s" if [ $INIT_EXIT = "0" ] then break else (( count++ )) fi if [ "$count" -ge 5 ] then su "$SCRIPT_USER" -c "notify-send 'AirVPN' 'Connection unsuccessful after '$count' failed attempts." break fi done fi exit This is the configuration file for both of the scripts. Most necessary adjustments can be made here, so the scripts don't have to be edited (except for correctly pointing at this file). $HOME/.vpncontrol/config/vpncontrol.conf #!/bin/bash # This file is part of the VPNControl configuration. # settings for AirVPN control scripts (airvpn_boot.sh and VPNControl.sh) # user in whose directory all the necessary files are stored (usually you); this is just used for this configuration file to make paths easier to change, but paths can also be changed individually SCRIPT_USER="<USER>" # path to ovpn configuration file; make sure to use absolute path without variables like $HOME since boot script is run as root CONFIG_PATH="/home/$SCRIPT_USER/.vpncontrol/config/AirVPN_All-servers_UDP-443.ovpn" # path to directory for log files (don't put a trailing slash); make sure to use absolute path without variables like $HOME since boot script is run as root LOG_PATH="/home/$SCRIPT_USER/.vpncontrol/logs" # number of days for which logs are being kept (last days with connections via hummingbird, don't have to be consecutive); if "0" there will still be a log for the current connection which will be deleted after the connection ends LOG_DAYS="3" # seconds for which the connection to a server should be attempted before aborting (and when not trying to connect to a specific server moving on to the next one) TIMEOUT_CON="12" # seconds for which hummingbird should try to restore the connection in case connectivity is lost (mostly relevant after computer wakes up from sleep; this uses hummingbird's own --timeout option, but not sure how it handles it: if it applies to dropped VPN connection itself, network interface being down or only pausing the process e.g. by sleep) TIMEOUT_REC="60" # order of countries (and continents to try overall recommended server first) when trying recommended servers SERVERS_BEST_EU=( europe nl be at bg ch cz de ee es gb lv no ro rs se ua ) SERVERS_BEST_REST=( america asia ca us jp br hk sg ) # backend for default network lock, will by default use (just like hummingbird) the first available of iptables, iptables-legacy or nft; uncomment if you want to use a specific one of those #NETFILTER="nft" # uncomment if you want to lock down the system by default (applies the default network lock at boot) #DEFAULT_NETLOCK="enabled" # path to file with rules for default network lock (needs to be present only for used backend, but both can be specified) NETFILTER_RULES_IPTABLES="/home/$SCRIPT_USER/.vpncontrol/config/netfilter_iptables.rules" NETFILTER_RULES_NFTABLES="/home/$SCRIPT_USER/.vpncontrol/config/netfilter_nftables.rules" # API key to access user specific AirVPN info API_KEY="<YOUR PERSONAL API KEY>" # set custom options for hummingbird like in the commented example; will be temporarily overwritten if you enter new ones in the control script #HUM_OPTIONS="--proto tcp --ignore-dns-push" This is the systemd unit file that integrates the boot script into the system's boot process. It has to be owned by root. /etc/systemd/system/airvpn.service [Unit] Description=AirVPN Client (hummingbird) Wants=network-online.target After=network-online.target [Service] Type=forking ExecStart=/usr/bash /usr/local/bin/airvpn_boot.sh Restart=no [Install] WantedBy=multi-user.target These are the configuration files for the default network lock using iptables. These rules block all IPv4 traffic by default except some things like local traffic and traffic to airvpn.org. The rules in the second file block all IPv6 traffic. $HOME/.vpncontrol/config/netfilter_iptables.rulesipv4 # This file is part of the VPNcontrol configuration. # default network lock iptables rules for IPv4 traffic # nat table: optional masquerade rule (NAT/ports) *nat :PREROUTING ACCEPT :INPUT ACCEPT :OUTPUT ACCEPT :POSTROUTING ACCEPT -A POSTROUTING -o tun+ -j MASQUERADE COMMIT # mangle table: no rules applied *mangle :PREROUTING ACCEPT :INPUT ACCEPT :FORWARD ACCEPT :OUTPUT ACCEPT :POSTROUTING ACCEPT COMMIT # raw table: no rules applied *raw :PREROUTING ACCEPT :OUTPUT ACCEPT COMMIT # security table: no rules applied *security :INPUT ACCEPT :FORWARD ACCEPT :OUTPUT ACCEPT COMMIT # filter table: all traffic blocked with some exceptions: *filter :INPUT ACCEPT :FORWARD ACCEPT :OUTPUT ACCEPT # allow loopback IN -A INPUT -i lo -j ACCEPT # allow broadcastin/dhcp IN -A INPUT -s 255.255.255.255/32 -j ACCEPT # allow communication for established connections (that were allowed with these rules) -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # block all other incoming traffic -A INPUT -j DROP # allow tun device to communicate (so any VPN connection should be possible, also without Air, but respective DNS requests must be allowed)) -A FORWARD -o tun+ -j ACCEPT -A FORWARD -i tun+ -j ACCEPT # allow loopback OUT -A OUTPUT -o lo -j ACCEPT # allow LAN OUT -A OUTPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT # allow link-local OUT -A OUTPUT -s 169.254.0.0/16 -d 169.254.0.0/16 -j ACCEPT # allow broadcastin/dhcp OUT -A OUTPUT -d 255.255.255.255/32 -j ACCEPT # allow IPv4 traffic via UDP and TCP only to airvpn.org for status update # allow DNS query to resolve hostname (hex string reads "06 airvpn 03 org" - numbers are counting bits), # restrict packet length to length of this specific request package (might change?) to avoid hijacking of query (very unlikely I guess, but who cares if we're already being paranoid for the fun of it), # whitelist destination IP for TCP handshake -A OUTPUT -p udp -m udp --dport 53 -m string --hex-string "|0661697276706e036f7267|" --algo bm --to 65535 -m length --length 0:126 -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 53 -m string --hex-string "|0661697276706e036f7267|" --algo bm --to 65535 -m length --length 0:126 -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource -j ACCEPT # allow SYN request to whitelisted IP to initiate handshake, remove IP from whitelist -A OUTPUT -p tcp -m tcp --dport 53 --tcp-flags FIN,SYN,RST,ACK SYN -m recent --remove --name DEFAULT --mask 255.255.255.255 --rsource -j ACCEPT # allow outgoing connection to Air's IP -A OUTPUT -d 5.196.64.52/32 -j ACCEPT # allow tun device to communicate (so any VPN connection should be possible, also without Air, but respective DNS requests must be allowed)) -A OUTPUT -o tun+ -j ACCEPT # block all other outgoing traffic -A OUTPUT -j DROP COMMIT $HOME/.vpncontrol/config/netfilter_iptables.rulesipv6 # This file is part of the VPNcontrol configuration. # iptables rules for IPv6 traffic # nat table: no rules applied *nat :PREROUTING ACCEPT :INPUT ACCEPT :OUTPUT ACCEPT :POSTROUTING ACCEPT COMMIT # mangle table: no rules applied *mangle :PREROUTING ACCEPT :INPUT ACCEPT :FORWARD ACCEPT :OUTPUT ACCEPT :POSTROUTING ACCEPT COMMIT # raw table: no rules applied *raw :PREROUTING ACCEPT :OUTPUT ACCEPT COMMIT # security table: no rules applied *security :INPUT ACCEPT :FORWARD ACCEPT :OUTPUT ACCEPT COMMIT # filter table: block all traffic *filter :INPUT ACCEPT :FORWARD ACCEPT :OUTPUT ACCEPT -A INPUT -j DROP -A OUTPUT -j DROP COMMIT This is the configuration file for the default network lock using nftables. These rules block all IPv4 traffic by default except some things like local traffic and traffic to airvpn.org. They also block all IPv6 traffic. $HOME/.vpncontrol/config/netfilter_nftables.rules flush ruleset table inet nat_lock { chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; } chain INPUT { type nat hook input priority 100; policy accept; } chain OUTPUT { type nat hook output priority -100; policy accept; } chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; oifname "tun*" masquerade comment "optional masquerade rule (NAT/ports)" } } table ip filter_lock { set whitelist { type ipv4_addr; flags timeout; } chain INPUT { type filter hook input priority filter; policy drop; iifname "lo" accept comment "allow loopback IN" ip saddr 255.255.255.255/32 accept comment "allow broadcastin/dhcp IN" ct state established,related accept comment "allow communication for established connections (that were allowed with these rules)" } chain FORWARD { type filter hook forward priority filter; policy drop; oifname "tun*" accept iifname "tun*" accept } chain OUTPUT { type filter hook output priority filter; policy drop; oifname "lo" accept comment "allow loopback OUT" ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 accept comment "allow LAN OUT" ip saddr 169.254.0.0/16 ip daddr 169.254.0.0/16 accept comment "allow link-local OUT" ip daddr 255.255.255.255/32 accept comment "allow broadcastin/dhcp OUT" # allow DNS query to resolve hostname (hex string reads "06 airvpn 03 org" (prefixed with 0x, suffixed with 00) - numbers are counting bits), whitelist destination IP for TCP handshake" udp dport 53 @th,160,120 0x0661697276706e036f726700 meta length 0-126 update @whitelist { ip saddr } accept comment "allow DNS query to resolve hostname" tcp dport 53 @th,160,120 0x0661697276706e036f726700 meta length 0-126 update @whitelist { ip saddr } accept comment "allow DNS query to resolve hostname" tcp dport 53 tcp flags & (fin|syn|rst|ack) == syn update @whitelist { ip saddr timeout 1s } accept comment "allow SYN request to whitelisted IP to initiate handshake, remove IP from whitelist" ip saddr @whitelist accept comment "allow outgoing traffic from addresses in whitelist" ip daddr 5.196.64.52/32 accept comment "allow outgoing connection to Air's IP" # allow tun device to communicate (so any VPN connection should be possible, also without Air, but respective DNS requests must be allowed) oifname "tun*" accept comment "allow tun device to communicate" } } table ip6 filter_lock { chain INPUT { type filter hook input priority filter; policy drop; } chain FORWARD { type filter hook forward priority filter; policy drop; } chain OUTPUT { type filter hook output priority filter; policy drop; } } VPNConrol.tar VPNControl.tar

Hi, I guess your problem is that you have eddie set to start minimized to tray. If that's the case, run eddie-ui from the command line and look for a line that says "Profile path:" Something like: Profile path: /usr/lib/eddie-ui/default.profile I don't use eddie-ui now and I was used to an xml as a profile path where you could change options easily but this file seems to be binary data. Anyway, here is where your options (such as start minimized to tray) are stored. Rename it, or move it to somewhere else (as a backup and run eddie-ui again. You will have to write your credential back and set your preferred option again, just don't check in start minimized until you fix the icon showing in system tray.

The driver update/change has resolved this issue. It's been functional for almost a week now. thanks for you help.

Yes, I got to witness the same symptoms with qB v4.2.5 as you describe, Mr. Camponotus – all connections are really sluggish. I reverted to v4.1.5 from Debian stable and everything is back in working order, except that qB wants to recheck all torrents again.

I am mostly an uploader. I tried qbittorrent 3 weeks before after hearing it quite often here and on other sides. Dont know if it was the version giganerd mentioned. But with my tests, it was really unrelaiable with uploads. My BiglyBT was way faster in connecting and uploading to the same torrents (and other torrents of course to have clean connections without others knowing me already over peer exchange ect) and clients i tried with qbittorrent. BiglyBT is like BitTyrant, which was modded Azureus after his "bad" successor Vuze appeared.

I just added in IPv6 support on my pfSense box, using AirVPN and a VLAN. Note that I already had the VPN VLAN setup and working correctly with IPv4, so this guide is only about what needed to be changed to add in IPv6 support. Recently, AirVPN has implemented IPv6 across their servers. Provided you are running a recent version of OpenVPN (>= 2.4), and you adjust your client configuration properly, you will be assigned an IPv6 address along with the typical IPv4 address. In my setup, I’m using pfSense as my firewall / router, and have several VLANs configured for various purposes. One of these VLANs is specifically for VPN usage. So the question becomes, how to take the single IPv6 address assigned from AirVPN and make it usable on a VLAN, for multiple hosts. This setup is severely sub-optimal, as IPv6 was designed to avoid NAT (there are what, 3.4x10^38 available addresses?). Given that the design of the protocol and AirVPN’s implementation are at odds, there are some problems that you will encounter. The most annoying being that browsers don’t want to use your IPv6 address, and you will continue to use IPv4, despite having everything setup “correctly.” It may be possible to overcome this with some per-host modifications (on Linux, look to /etc/gai.conf), but that is perhaps not maintainable in the long run. This problem stems from the fact that the address Air is providing is a Unique Local Address (ULA), which, by definition, is not globally routable. This address gets translated at Air’s servers into a normal, globally routable, address. But what the software on your machine sees is a ULA, and since that isn’t a globally routable IP address, the software will prefer the IPv4 address, where it is understood that NAT will probably be used. Given this implementation, I am not convinced it is worth it to setup IPv6 in this type of configuration. Having said all that, here is how I configured things to get IPv6 “working” with AirVPN on a pfSense VLAN: 1: Get an IPv6 address from AirVPN Assuming you are running a recent release of pfSense, you should have the necessary OpenVPN version for this to work (I’m on pfSense 2.4.4, which is using OpenVPN 2.4.6). Go into your OpenVPN client configuration and set “Protocol” to “UDP IPv4 and IPv6 on all interfaces (multihome)” scroll down to “Custom options” and make sure you have these 2 lines: push-peer-info; setenv UV_IPV6 yes; Save, and possibly restart the service. You should now have both IPv4 and IPv6 addresses assigned to your VPN connection 2: Create a new Gateway I can’t remember if the gateway was automatically created at this point. If not, Add a new gateway. If one was auto created, edit it. Then Make sure Interface is set to the VPN Address family is IPv6 Give it a name (VPN1_WAN_IPv6 in my case) I’ve left everything else at default settings, then set a description, and Save and reload 3: Modify your VPN VLAN From the “Interfaces” menu, select your VPN VLAN entry, then Set “IPv6 Configuration Type” to “Static IPv6” Scroll down to the “Static IPv6 Configuration” section and set an address and prefix. I chose a “random” ULA (FDxx:xxxx:xxxx:10::1). Obviously, choose hex characters in place of the “x”s and the “10” matches my vlan number. Set the prefix to /64 Leave the “use IPv4 connectivity” unchecked and the gateway set to “None” Save and reload 4: Configure Router Advertisements and/or DHCPv6 From the “Services” menu, select “DHCPv6 Server & RA” - then choose your VLAN. In my setup, I’m not bothering with DHCP, just using SLACC, so I go directly to the “Router Advertisements” tab. Set Router Mode to unmanaged Priority to Normal You may choose to put your IPv6 DNS server into the DNS configuration section (I believe Air’s server is fde6:7a:7d20:4::1 Leave everything else as is (blank) Save and reload 5: Set NAT Rules From the “Firewall” menu, select “NAT”, then go to the “Outbound” tab Click the second “Add” button Set “Interface” to your VPN gateway “Address Family” is “IPv6” Source type is “network” Source network is the ULA you setup earlier (“Fdxx:xxxx:xxxx:10::/64”) I did this using an alias. Note that the subnet drop down doesn’t list anything above a /32 (it’s meant for IPv4), so I left it at /32. Seems to work anyway. The Translation Address should be set to “Interface Address” Add in a description, if you wish, and Save and reload 6: Set Firewall Rules From the “Firewall” menu, select “Rules” and then the appropriate VLAN tab Click the second “Add” button “Action” is “Pass” “Interface” is your VLAN “Address Family” is “IPv6” Set the rules appropriately for your situation. In my case, just to get things working, I set “Protocol” to “Any” “Source” to “[VLAN] net” Click the “Display Advanced” button Scroll down to “Gateway” and select your previously configured VPN IPv6 gateway Save and reload NOTE: Be sure to move the rule you just created into the correct spot in your rules list! Remember, the rules are checked in order, so if you have a deny rule above your new pass rule in the list, it won’t work. At this point I rebooted pfSense and my VPN client machine. I now have an IPv6 address, assigned from the ULA block I setup. Visiting https://ipleak.net shows I have both IPv4 and IPv6 connectivity. Going to https://test-ipv6.com gives me a 10/10, but with the note that the browser is avoiding using the IPv6 address. See the note from AirVPN Staff about this: https://airvpn.org/topic/25140-the-issue-your-browser-is-avoiding-ipv6/ Hopefully this is helpful to someone out there. MrFricken

Hi. I just downloaded the teatv apk for android to my S8 but I couldn't access the app, it didn't work. I have reloaded but it still has the same problem. Does anyone know what problem I'm having and what is the way to fix it?

I strongly recommend Tixati, it have IP Filter. It works well with AirVPN.

qB and Deluge are recommended all the time around here.

One more resource re dd-wrt config for AirVPN: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321856 I wrote this as I first brought my first dd-wrt router online with AirVPN, and as a new Air user, I had not yet become familiar with these Air forums. So it is posted in the dd-wrt forum.

Hello! When you enter suspension state systemd sends SIGHUP to processes.Hummingbird reacts with "restart connection" when it receives SIGHUP. Core dump is unexpected and under investigation. @eburom The systemd unit is formally correct. Kind regards

Does it work without a VPN connection? Anyway, if you really want to talk about qBittorrent here, make sure you're doing it exactly like this. Hell of a bug report, I cry out of joy

All fixed with AV support. Steps: reset Firewall rules netsh advfirewall reset Then reset my tap-9 adapter default gateway Hope this help others! Thanks for the super fast support! V

This provides me with an opportunity to say Thank you to AirVPN as well. I've been on this ride for nearly seven years now and I've seriously grown to fully trust AirVPN with whatever I do on the internet, in terms of both tech and ideology and the stability of both. Doesn't matter if I'm downloading with BitTorrent, playing a game or two or simply browsing the internet, it feels like nothing changed in terms of throughput or latency, while knowing that those activites are safer to use from a privacy point of view and that AirVPN will not sell me out. Now, I know that experiences vary and someone somewhere in the world don't enjoy the same quality of the service as I do – I live in Central Europe, after all. Problems are there to be solved, and that is what the AirVPN community does, which I personally see among the strong points of AirVPN: Despite the efforts of everyone to stay private and anonymous, even to the point of complete paranoia and exaggeration, there's still something I'd describe as the "AirVPN community spirit". When I started using AirVPN in 2013, and a short while after also spontaneously deciding to contribute to the forums, I didn't think how far this dedication would go. Well, here we are. Even though I was trying to help others, it would be a lie to say that I didn't learn anything myself. Through the forums I was able to pick up bits and pieces, read further manuals and how-tos, try things out myself, then pick up some more bits, read further, test deeper. The AirVPN community gave me some interesting hints and insights I wouldn't have gotten any other way and also influenced me on some of the more incisive decisions of mine. A humble example would be the decision to ditch Windows altogether, something that largely came from the community, and from the day I did that I not only learned more about the finer things of I.T., I was even able to directly translate what I learned into my job. Knowledge earned me respect, respect earned me.. well, nothing bad, you can be sure of that. Did I say that I never expected the decision to get involved here to turn out this way? As of today, AirVPN is the reference I compare the rest of the VPN providers to. Thank you again for the great service and may the next ten years be as good as the last and better!

Maybe I can help you with this. To be clear, are you on 1803 or 1909? If you are currently on 1803, you need to update it since 1803 is two years ago. and 1909 is the current version. The warning I would assumed you are talking about Windows Defender SmartScreen? If that is the case, then I am curious why Windows Defender is throwing the warning every time you open? Possible there is an issue with Windows Defenders that is likely causing problem with the newest version of Eddie? Did you check Windows Defenders to see if something is amiss? Can you check Event Viewer to see if there is something that it logged the issue? Press Start button, then type and click on Event Viewer. When the Event Viewer is open, expand Windows Logs then click Application. Give it a moment to load all of the events, do not worry if the app suddenly non-responsive. Just give it a time to load them all. It can take up to 10 minutes. Once it loaded, scan through the list to see if you have errors. If you know the date and time when this problem occurred, it will be easier to find the error than scanning through the list because Application views have all the programs in one list. You can use the Filter options in Actions sidebar. Click on Filter Current Log... then in that dialog, tick Critical, Warning and Error then click ok. The list will be shorter and easy for you to find. You should be looking for something related to Eddie, check the description that included Eddie-UI.exe. Hopefully it is logged that it would give a hint of what is going on. Can you find the report? Did you turn on the network lock before connecting? If you did, try to connect without the network lock enabled. It is likely that it need the server list to for it to know which to connect. Once it connected, you can disconnect the VPN then re-enable Network Lock, then it should be working normally. If that is not the case, then you need to post Eddie log which will provide us the clue of what is happening with Eddie.

Dear Staff - That was it! As always, many thanks for your prompt attention. Best Regards from Exie.

Hi to all, the latest Eddie 2.18.8 experimental released today, works with wintun, please test if interested. Go to https://openvpn.net/community-downloads/, at bottom "OpenVPN 2.5_git wintun technology preview", click the "here" link and install. If you already have the right "openvpn.exe", use it directly: Eddie will install the wintun driver when needed, and also create the adapter. Eddie -> Settings -> Advanced -> OpenVPN Custom Path -> choose your "openvpn.exe" from 2.5, if already installed probably it is "C:\Program Files\OpenVPN\bin\openvpn.exe". At this point, Eddie will use OpenVPN 2.5 (but still with standard TUN driver). Eddie -> Settings -> OVPN directives -> Custom directives, add "windows-driver wintun". At this point, Eddie will use the OpenVPN 2.5 with the newest Wintun driver.

@ctri Please try to delete completely everything in /etc/airvpn and start again Hummingbird. Kind regards

Has anyone successfully managed to configure AirVPN with Unifi USG? I have followed quite a few tutorials and I've been successful is getting some other competing VPN services (Astrill, PIA) to work, I just cannot get AirVPN to work. Is there a particular configuration that needs to be created and set up for it to work on USG?

About DD-WRT DD-WRT is Linux-based firmware for wireless routers and wireless access points. It is compatible with several models of routers and access points, for example, the Linksys WRT54G series (including the WRT54GL and WRT54GS). DD-WRT is one of the third-party firmware projects, which are designed to replace the original firmware on some commercial routers. Alternative firmware may offer features and functionality sets that differ from the original firmware it is replacing. Official website: https://www.dd-wrt.com/. Prerequisite Install DD-WRT on routergo to https://www.dd-wrt.com/Select "router database", then enter you router model number. Follow the instructions as described and install the DD-WRT *vpn*.bin. StepsCreate configuration files from our Config Generator. Select the server location and port you want to connect to, tick "Advanced Mode", tick "Separate certs/keys from .ovpn file", then generate and download the configuration files.Under the router "setup tab" locate your router's local IP address. Go to Specs page of AirVPN website and locate Air VPN DNS for the server you want to connect to, and enter it under Static DNS 1. Navigate to the "Services" tab then select the "VPN" tab.Select "Enable" under OpenVPN Client.Set the Server IP/Name and Port to the Air VPN server you selected (see here to determine VPN server entry-IP address: https://airvpn.org/topic/14378-how-can-i-get-vpn-servers-entry-ip-addresses ).Set Tunnel Device to "TUN"Set Tunnel Protocol to either "UDP" or "TCP" according to the Air VPN server you selected Set Encryption Cipher to " AES-256"Set Hash Algorithm to "SHA1"Put a check mark beside "nsCertType verification"Select "Enable" Advanced OptionsSelect "Enable" LZO CompressionSelect "Enable" NATSet Local IP Address to the router's local IP address found earlier.Set TLS Cipher to "TLS-DHE-RSA-WITH-AES-256-GCM-SHA384" or "None" Unzip the AirVPN configuration file you downloaded.Using your favorite text editor - Open up "ca.crt" and copy all of the contents into the CA Cert window. - Open up "user.crt" and copy only and including "----- BEGIN CERTIFICATE----- to the end of ----- END CERTIFICATE----- " into Public Client Cert. - Open up "user.key" and copy all of the contents into Private Client Key. - Open up "ta.key" and copy all of the contents into TLS Auth KeySelect "Save" at the bottom of the page then "Apply Setting" Select "Save" at the bottom of the page then "Apply Setting"DD-WRT firewall rules Go to "Administration" tab then select the "Commands" tab.Copy the following firewall rules into the command window (IMPORTANT: check your tun interface name and set it accordingly - some firmware builds will have tun1 and not tun0) iptables -I FORWARD -i br0 -o tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o br0 -j ACCEPT iptables -I INPUT -i tun0 -j REJECT iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE Click on "Save Firewall"Verification of VPN setup Go to https://airvpn.org and at the bottom of the screen it should show you are connected. Trouble Shooting If you're not shown as connected wait a minute then refresh the web (it could take a minute to make a connection with the VPN and log in). Go to DD-WRT configuration and navigate to the "Services" tab, then "VPN" tab. Once there go to the bottom of the page and click on "Apply Settings". Once completed wait a minute and verify your connection again. If you're still not connected verify the server status you're trying to connect to. Go to Air VPN website and log in, then navigate to "Support" and select "Server Status". If server is down reconfigure DD-WRT to connect to another server. If you are still have difficulties connecting, view the OpenVPN log file in DD-WRT. You can find the log by going to DD-WRT configuration and navigating to the "Status" tab and selecting "OpenVpn". Hopefully the log will give you some indication of why you can not connect. Still having issues Contact Air VPN support, they are quick at responding back to you and very knowledgeable. Another option is to ask on the Air VPN forums.

Yes, it's annoying. I know your thinking, unknown TOR exit runners, you want to help the TOR network by providing one more exit node, because kind of I am afraid of possible legal consequences running a TOR exit node over my ISP line but now I'm behind a VPN and I want to help; it's okay so far. But it's not okay to not take into consideration that some of us use services and websites which constantly try to prevent TOR exit IPs from viewing them (not limited to TOR, some try to block all anonymizer services). A TOR server will be listed on a TOR exit servers list even after you shut it down and as long as it's there we suffer from blocks. Blocks we are trying to circumvent; that's what a proxy service is good for, right? In addition, AirVPN run two exits themselves. Given the bandwidth of these servers (100 MBit/s) I don't think your contribution is a great gain in overall TOR performance as your internet connection is most probably not that fast and not that stable (I assume you use your internet to watch Netflix, play games online and the like, creating traffic which lowers performance of the node). Third, you expose AirVPN and yourself to attacks from the internet by those who want to literally destroy TOR. Attacks on AirVPN's servers will cause line problems, line problems harm the user's experience. You as a TOR exit runner (although behind a VPN) expose yourself to attacks, too: It's not the AirVPN server who gets infected because a vulnerability in the TOR software is being abused; it's your computer. Your computer gets infected, and it's most probably your personal computer with your personal information on it. Your antivirus software is just a bunch of algorithms, too, it's not supposed to detect 100% of vulnerabilites in software and prevent their abuse. And: It's you who will be marked an extremist. If you think it's easy these days to help TOR you are mistaken. Maybe installation and setup is easy, to preserve your own security by running this piece of software sadly is not. So, before you start that TOR software again, think twice. Thank you.

I did a new install in pfsense 2.4.5 following this guide. Everything looks good, but I cant seem to get ip from DHCP server on VLAN20 (VPN). This is from the log: Jul 4 14:22:09 dhcpd DHCPOFFER on 10.0.20.100 to 94:de:80:f8:59:d4 (VPN-PC) via igb2.20 Jul 4 14:22:09 dhcpd DHCPDISCOVER from 94:de:80:f8:59:d4 (VPN-PC) via igb2.20 So it seems like the DHCP server sees the client and offer an IP in the correct subnet, but there is no DHCPACK from the client afterwards. I tried with different machines also. Other VLANs works fine. Clients gets IPs. Something I forgot for VLAN20? Some firewall rule?