Leaderboard

Hello! We're very glad to inform you that three new 10 Gbit/s full duplex servers located in Toronto (Ontario), Canada, are available: Castula, Chamukuy and Elgafar. The AirVPN client will show automatically the new servers; if you use any other OpenVPN or WireGuard client you can generate all the files to access them through our configuration/certificates/key generator (menu "Client Area"->"Config generator"). The servers accept connections on ports 53, 80, 443, 1194, 2018 UDP and TCP for OpenVPN and ports 1637, 47107 and 51820 UDP for WireGuard. They support OpenVPN over SSL and OpenVPN over SSH, TLS 1.3, OpenVPN tls-crypt and WireGuard. Full IPv6 support is included as well. As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses. You can check the status as usual in our real time servers monitor : https://airvpn.org/servers/Castula https://airvpn.org/servers/Chamukuy https://airvpn.org/servers/Elgafar/ Do not hesitate to contact us for any information or issue. Kind regards & datalove AirVPN Staff

Hello! Interesting thread indeed, thank you. Our position is close to the EFF position you can read here: https://www.eff.org/deeplinks/2025/08/no-uks-online-safety-act-doesnt-make-children-safer-online We will keep you informed. So far, you probably know well our approach with similar, lower or higher requests from Russia, China and a few other countries, and there's no plan at the moment to change our position. In general, we think that it is impossible that those persons who advance, propose or defend such dangerous laws in so called democracies are in good faith (except in peculiar cases where they suffer from some mental illness or carry a neurological deficit). They have an hidden agenda developed on the myth of pervasive control but more importantly fueled by monetary reward. Yes, that's a motivational reason, maybe almost as strong as monetary reward and votes. Moreover, there is a real possibility that such laws lead on the short run to an increase in support (and therefore votes) which, net of dissent, is positive, even though by tiny tenths of percentage which are anyway not negligible for an embarrassingly inept ruling class that's incapable of developing serious strategies to improve the life of teenagers and children. Their total failure is proven by the official data (England and Whales police records in this case) that show a dramatic rise of sexual offenses against children in the UK in the last 5 years in spite of (and someone could even argue because of) more and more laws allegedly thought to protect children. Where does this 0.1% come from? If you want to stay real please adjust this quota (since 2025, start multiplying that percentage by 250 to begin with). Furthermore, there's no money involved to use Tor, its usage is totally free and well beyond Ofcom abilities to control it. However, it's true that people may find it boring because it's like 10 times slower than a VPN with a decent infrastructure. It would indeed. However, we seriously doubt that the ramshackle British institutions, always short of funds, can surpass the GFW designers and maintainers in efficiency, competence and grandeur of operation. And note that the GFW is routinely bypassed nowadays by the most and least skilled to connect to a wide range of VPNs. Our aggregate data show that this claim is deeply incorrect, at least for AirVPN, if we consider p2p improper usage quantified by DMCA and other warnings. It's not the majority, on the contrary it is a tiny minority. Where does this assumption come from? We would like to assess official stats to compare them with what we gather on the field. Kind regards

Congratulations on the launch. This is great news for CA which has had most of its 2 Gbit/s servers pretty saturated during peak hours. Hopefully the ghost of Wurren does not come back to haunt us.

Hello! Starting from February 1st, 2026, Debian (e.g. Trixie) enforces stricter OpenPGP policies and no longer accepts repository signatures involving SHA1-based certifications. As a result, users may see errors such as: Get:4 http://eddie.website/repository/apt stable InRelease [3,954 B] Err:4 http://eddie.website/repository/apt stable InRelease Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on C181AC89FA667E317F423998513EFC94400D7698 is not bound: No binding signature at time 2025-01-14T13:07:46Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z Warning: OpenPGP signature verification failed: http://eddie.website/repository/apt stable InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on C181AC89FA667E317F423998513EFC94400D7698 is not bound: No binding signature at time 2025-01-14T13:07:46Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z Error: The repository 'http://eddie.website/repository/apt stable InRelease' is not signed. Notice: Updating from such a repository can't be done securely, and is therefore disabled by default. Notice: See apt-secure(8) manpage for repository creation and user configuration details. This was caused by an outdated signing key certification used by the repository. Solution The repository signing key has been regenerated and the repository is now correctly signed again. To restore updates, please re-import the updated maintainer key: curl -fsSL https://eddie.website/repository/keys/eddie_maintainer_gpg.key | sudo tee /usr/share/keyrings/eddie.website-keyring.asc > /dev/null Then run: sudo apt update Sorry for the inconvenience, and thanks for your patience. Kind regards

I open a support request https://airvpn.org/contact/

Hello! We had a similar project that is now temporarily frozen for good reasons: in real life the ability of the "AI"s to guess successfully the real destination from analysis of the VPN tunnel traffic is poor (the excellent success rates you see are achieved only in a controlled environment where the victim visits only destinations pre-determined from a tiny list) AmneziaWG is quickly becoming (*) a more universal approach that may be effective and that does not require our own proprietary solution, provided that constant rate tunnel, deterministic batching and traffic morphing are not required -- safe assumptions as DAITA doesn't aim at obtaining them (*) While early AmneziaWG releases could "only" add junk packets during handshakes, making it not suitable to replace DAITA, AmneziaWG latest release is also capable to perform padding of transport messages and modification of their header range. It can do all of the above, optionally, over a faithful imitation of a different protocol (any protocol that can be built on UDP), including specific HTTP/3 web sites initial flow mimicry. While these options efficacy in fighting AI guided traffic analysis must be verified in a controlled environment when AI abilities will improve, and in spite of the fact that AmneziaWG currently lacks the important active distortion feature that DAITA offers, together with reason 1 they are sufficient to let us prioritize AmneziaWG support in the infrastructure and our software, and freeze proprietary solutions research. Once AmneziaWG is operating in the whole infrastructure, it may be considered whether adding active distortion to match this DAITA feature, or anyway building additional features to outperform DAITA (on top of the many already available in Amnezia and not from scratch), is worth the effort or not. Kind regards

Hello! Please see here: https://airvpn.org/forums/topic/79065-eddie-desktop-apt-repository-signing-key-update/ Kind regards

Hello! We're very glad to announce that Eddie Android edition 4.0.0 beta 2 is now available. New: how to use Eddie in network where the "bootstrap" servers can not be reached Eddie downloads user and infrastructure data, essential to use the service, from special "bootstrap servers" through an encrypted flow inside HTTP. If the bootstrap servers are blocked or the underlying protocol to port 80 is filtered out, Eddie is unable to proceed. Starting from Eddie 4 beta 2 version, the ability to retrieve such data locally has been added. Whenever bootstrap servers are unreachable, Eddie can read the latest available local data to connect to a VPN server. Once connected the bootstrap servers are again reachable and the local data are immediately updated for future usage. The local data remain valid as long as you don't need to change user. On top of all of the above, Eddie can now retrieve such data through the login procedure that now can be started even when a connection to a VPN server was previously established via a profile. Therefore, when you are in a restrictive network that blocks access to bootstrap servers, you can connect through a profile generated by AirVPN web site Configuration Generator. After this first connection, log your account in to the service by selecting the specific option on the left pane, enter your AirVPN account credentials as usual and make sure that Remember me checkbox is ticked: Eddie will download all the necessary files and store them locally. This procedure is "once and for all", at least as long as you don't need to change account. After this initial connection, Eddie will be able to log your account in to the infrastructure, retrieve servers data and establish connections without profiles and without bootstrap servers, offering again full AirVPN integration even when bootstrap servers are unreachable. Only If you change account you must repeat the procedure. New: "Open with..." option added to "Share" option Different Android versions allow management of files with different restrictions. Different apps may support different intents on specific Android versions. To enlarge total compatibility, now Eddie offers two different options to export and manage files, including generated profiles. You will find the usual "Share" option coupled with a new "Open with..." option. Some apps support only one intent, other apps only specific intents on specific Android versions, and so on. By adding this option Eddie enlarges considerably the amount of apps you will be able to open and/or share files with. New: AmneziaWG parameters range validity AmneziaWG parameter range validity has been documented in three different ways (official web site, GitHub documentation files, and developers comment) and the web site documentation that it's still official is in reality not aligned with the source code. The new parameters range validation adopted by Eddie 4.0.0 beta 2 is based now on GitHub latest documentation integrated by source code analysis. The original message of this thread has been updated accordingly. You will find on it the new download link and checksum, as well as detailed Amnezia description. If you decide to test, please report at your convenience any bug and problem in this thread. If possible generate a report from the app in a matter of seconds: by tapping the paper plane icon on the Log view bar rightmost side you will generate a full system report which will include both log and logcat and have it sent to our servers. Then you just need to send us the link the app shows you (open a ticket if you prefer to do it in private). Kind regards & datalove AirVPN Staff

How can the load percentage be conveyed even clearer in your opinion? Those are highly subjective things depending on your setup, and I don't want to see them as data points in a server overview showing factual data valid for everyone the same way. Load (= bandwidth usage), number of clients and RTT between the servers are factual data valid for everyone, whereas your own latency and "connection quality metrics" are the result of your client's configuration, connection type and its config, ISP, routes, etcetc. I mean, what is even the definition of "connection quality" in your own words? Preferably something that is valid for you, me and the random reader of this thread at the same time.

Hello! We're very glad to inform you that a new 10 Gbit/s full duplex server located in Los Angeles, California, is available: Revati. The AirVPN client will show automatically the new server; if you use any other OpenVPN or WireGuard client you can generate all the files to access it through our configuration/certificates/key generator (menu "Client Area"->"Config generator"). The server accepts connections on ports 53, 80, 443, 1194, 2018 UDP and TCP for OpenVPN and ports 1637, 47107 and 51820 UDP for WireGuard. Revati supports OpenVPN over SSL and OpenVPN over SSH, TLS 1.3, OpenVPN tls-crypt and WireGuard. Full IPv6 support is included as well. As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses. You can check the status as usual in our real time servers monitor , by clicking the server name. Direct link: https://airvpn.org/servers/Revati Do not hesitate to contact us for any information or issue. Kind regards & datalove AirVPN Staff

Did everyone notice? The Kornephoros server achieved astonishing speeds today. As a 10Gbps server, it loaded over 5Gbps of bandwidth. I've never seen such speeds on any 10Gbps server before. What makes this server different from other 10Gbps servers? Is it the unprecedentedly powerful hardware, the data center's network environment, or AirVPN's optimization of the server's kernel? Staff can take a look and use this information to optimize other 10Gbps servers. Kornephoros is truly unexpected.

Hello! The "range" is specified by mask /32, so it's this single unique address. Yes, it's plausible that some past event flagged the IP address. We don't know the internals of Tailscale but definitely this behavior should be investigated. Why an attempted connection to this specific IP address and why this port? Kind regards

Hello! There's nothing listening to port 54037 on any AirVPN server. We can't see why Tailscale seeks a connection to it, anyway we are sure now that there's no malware there as there's nothing. Probably Malwarebytes behavior comes from some past event or it's yet another over-blocking case. Kind regards

@Zack Hello! The IP address you mention is assigned to AirVPN server Asellus in the Netherlands. Please mention explicitly port Y, we want and must verify what your app (mention the app too if possible) will find on that port, it's important. Kind regards

I'm seeing the same issue. For now you can still download from Eddie's own website. I know it looks kind of sketchy but this is a real website by AirVPN and is linked to in the FAQ. https://eddie.website/

Thanks a lot for the quick fix and the clear instructions! I removed my temporary Sequoia policy workaround, re-imported the updated maintainer key as posted, and apt update is working again on Debian Trixie. Much appreciated.

Hi, since 2026-02-01 my Debian Trixie system can’t update the Eddie APT repo. Debian repos are fine, only eddie.website fails. Error: http://eddie.website/repository/apt stable InRelease sqv: Policy rejected signature because SHA1 is not considered secure since 2026-02-01T00:00:00Z Key: C181AC89FA667E317F423998513EFC94400D7698 Is there an updated repo signing key / re-signed InRelease available (SHA256+), or a recommended fix/workaround until it’s updated? Thanks!

Had this Problem yesterday too and found a Workaround. Treat this as a temporary workaround. apt uses "Sequoia PGP" to verify signatures. By default, sqv is configured to accept the SHA1 hash algorithm only until Feb 1st 2026. To Resolve this for a period of Time, reconfigure sqv, copy /usr/share/apt/default-sequoia.config to /etc/crypto-policies/back-ends/apt-sequoia.config, and change the date from 2026.02.01 to 2026.06.01 in the line the Repo should Update again until 2026.06.01, better Solution would be an updated signing Key.

Its a shame. These were among the absolute fastest (especially Chumukay) when they came on board. They smoked the high powered Chicago servers but they are not reliable for the past week or two. Right across the border in Chicago apparently nobody is attacking those servers.

Yes, works for me too.

Yes, no problem on my end. For all intents and purposes:For all intents and purposes: For all intents and purposes: - UnifiOS 5.0.10 - Network 10.0.162

Every time a VPN connection is started, there is a chance Eddie will crash, most often by the third connection attempt. Here, I just tapped on the same server (but it could be any server) three times, then Eddie quit and the VPN disconnected. This doesn't happen with Eddie 3.3.0. https://eddie.website/report/46708ecc/

I checked the list of AirVPN updates and saw that there has been no update to the Windows application for a year. What's happening?

Hello! As noted the claimed vulnerability and PoC was/were not filed through the proper channels. According to the report we could finally access, the vulnerability affects macOS (not Windows or Linux), only in case the user checks "Preferences->UI->CLI" in order to have "eddie-cli <options>" available in a command line interface. macOS is the only system for which the stand alone Eddie CLI version is not offered. While the report is being investigated please do not enable that option and run Hummingbird if you need a CLI based program to connect. We will update this thread and of course, should the problem be confirmed, the devs will release a new version. Kind regards

Hello! Eddie Android edition 4.0.0 beta 2 is now available featuring improved AmneziaWG support and strengthened logic against AirVPN bootstrap server blocks: https://airvpn.org/forums/topic/77633-eddie-android-edition-400-preview-available/ Kind regards

Hi, This may be the case. Regardless, the question stands: are the Eddie developers looking into this? Development of Eddie seems really lacking at present, there are several open issues on Github, particularly on Mac, that have not been fixed in spite of being reported over a year ago. The issues have not even been replied to. This really isn't filling me with confidence. Please can a member of staff assure us customers that this issue is being looked in to? And when can we expect a fix for the macOS permissions issue? Thank you.

Hello! On Eddie 2.22 and higher versions you can "fix" the interface name by setting it on Eddie's "Preferences" > "Networking" window (make sure you pick an interface name that's valid in your system). Kind regards

I don't understand. Except adding IP in Network route out of VPN, I don't have any solution.

Hello! The AirVPN integration is kindly maintained by GlueTun developer. In brief, servers information is retrieved from the servers,json file which is updated several times a year. When starting up, Gluetun merges the hardcoded list and the contents of servers.json, preferring newer data and including any custom entries marked to be kept. For more details and a more accurate description please see here: https://deepwiki.com/qdm12/gluetun/6-server-management At this moment, while we're writing this message, the servers in Amsterdam have not yet been added. You can wait for the next update, or you may add them manually, by abiding to the json format. Alternatively you can point directly, through the proper environment variable, to the correct entry-IP address of the server you wish to connect to. In such cases you find all the information you need on the server status page https://airvpn.org/status and by generating a configuration file with the Configuration Generator. Here's an example for Vindemiatrix, only for WireGuard connections. This sub-block must be inserted in the correct position inside the airvpn block: study the file structure to quickly understand. Make sure to edit the file while no container is running. { "vpn": "wireguard", "country": "Netherlands", "region": "Europe", "city": "Amsterdam", "server_name": "Vindemiatrix", "hostname": "nl3.vpn.airdns.org", "wgpubkey": "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=", "keep": true, "ips": [ "94.228.209.212" ] }, You then need to restart the container(s) in order to merge the current list with the edited one. The "Keep": true line/flag (inside the server definition) ensures that the server will not be wiped out if you rebuild the server list. Kind regards

Hello! We're very glad to inform you that two new 10 Gbit/s full duplex servers located in Amsterdam, the Netherlands, are available: Taiyangshou and Vindemiatrix. The AirVPN client will show automatically the new servers; if you use any other OpenVPN or WireGuard client you can generate all the files to access them through our configuration/certificates/key generator (menu "Client Area"->"Config generator"). The servers accept connections on ports 53, 80, 443, 1194, 2018 UDP and TCP for OpenVPN and ports 1637, 47107 and 51820 UDP for WireGuard. They support OpenVPN over SSL and OpenVPN over SSH, TLS 1.3, OpenVPN tls-crypt and WireGuard. Full IPv6 support is included as well. As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses. You can check the status as usual in our real time servers monitor : https://airvpn.org/servers/Taiyangshou https://airvpn.org/servers/Vindemiatrix Do not hesitate to contact us for any information or issue. Kind regards & datalove AirVPN Staff

Hello! Hold on @Tech Jedi Alex, you hit the mark. You were just misled by this: 0777 is for a directory, but for data files the default is 0666, here's why the user ends up with 644: For the reader, if the umask is 022, the newly created file by root will get 644 (rw-r--r--) (the complement of 666 with 022 in octal) which causes the first problem. So that's why /sbin/bluetit doesn't have x even though it does in the extracted package. It doesn't matter that the original bluetit file has 755, the umask starts from 666. cp in the original script lacks the -p option so this problem should get resolved by your change with install (it should be solved even by adding "-p" to the cp command, or an additional chmod of course). It looks like a long time installation script issue that went strangely unnoticed. Noted down for a fix in the next release or a package hot fix, we'll see. Apparently there is another problem too but maybe it's not related to Suite's installation, we'll keep following the thread. Kind regards

Should be Elgafar, right? Was briefly confused that eldafar had no IP.

I'm running Linux Mint with a VM of Windows 7. Both have Eddie and going through the same physical Ethernet cable over Cable Internet. The latency on Linux start in the 40s whereas on the VM of Windows 7 running in that Linux start in the low 20s which. Included is the Linux on left and windows 7 VM on the right. Linux is a new install with Eddie 2.24.6 whereas the Win7 is running on Eddie 2.18.9.

Kornephoros is airvpns better 10gb server in canada. it almost gives me full speeds on my home server(connected via wifi) funny enough their now decommissioned wurren was a pretty crappy in my experience. i was never able to get more than 80mbit on wurren even though it was also supposedly a 10gbit server... even regular 1gbit server outperformed wurren

That's incredible! It seems the server hardware wasn't that bad; perhaps it was just maintained two days ago? Or maybe the hardware was replaced? I see that this server only has 280+ users. Could it be a user issue? More users using the Wireguard protocol can indeed bring higher bandwidth usage. If the AmneziaWG protocol becomes widespread, it would be incredible if even 10G servers could be fully utilized.😄😄😄

Maximum of 7.3 Gb/s on Terebellum. I think most users are probably not using that much bandwidth to push the 10 Gb/s servers to their max.

@Stalinium Yes, the packets you obtain yourself are better suited to your network environment. If you find that troublesome, you can also try other people's parameters. Here are my parameters. Jc = 8 Jmin = 86 Jmax = 892 S1 = 0 S2 = 0 H1 = 2 H2 = 3 H3 = 4 H4 = 1 I1 = ... I2 = ... I3 = ... I4 = ... I5 = ... CPS I1-I5(bing.com-initial QUIC).txt

You are making absolutely zero sense with that comparison. It's 98% of people who don't bother changing profile settings. Which also means, 98% of profiles will be hidden, as the default visibility setting of the profile is Hide for all. Now, you could, of course, change that setting for you yourself, open up to the community, and provide that info, especially to explicitly provide your gender as to foster correct referrals to your person. I sincerely believe, that's what this is all about: Reducing the risk of hurting someone in a conversation. But, let's explore this situation a little. Suppose someone wants to find out how to refer to some other poster around here. First hurdle: 98% of profiles are hidden. Means, one in fifty is open. So the profile is clicked to find out "so, do I say him, do I say them?" and, oh darn, hidden profile. Then that person answers another person, clicks the profile, oh darn, hidden again. And a third, hidden. And a fourth, hidden. That person quickly learns: "Why bother, all the profiles are hidden, anyway", and defaults to "he", "he/she" or "them". Or even "per". So even if you sincerely wanted to do so, correctly referring to another person without the chance of having the necessary info left of every post gets tedious and downright impossible to do with all the profiles being hidden. Hence why the gender info might provide the choices for many genders, but what's the point if no one can look at it? Even if one of those profiles was opened, it doesn't mean all the fields were filled. The probability of finding a correct pronoun for referral gets even lower. As I wrote, we are here for discussions around AirVPN and VPN technology in general (actually, tech support for AirVPN), with some related topics around it. It would be a first for me to find out that gender is important in discussions about VPN tech. You are right that, in the past, I mostly defaulted to the masculine form when referring to any one poster (I prepended a Mr. to every username when referring to that user) but am shifting to @ mentions instead, those are neutral and even cause notifications. That's probably the most scandalous thing in regard to genders one can accuse me of. Homophobia… just really isn't. And, please, do not start the race thing. There is a good, tangible reason to publish pronouns. There is absolutely no reason to publish race, so it's incomparable. A little bit of warning: I will move this discussion to off-topic as, while it refers to the forums software of AirVPN, it does not relate to AirVPN tech directly. Don't think anything bad about the move, it is not an attempt to silence you. Simple moderator chore: Every post to the correct subforum. I am futhermore happy to continue discussing this matter with you (and everyone may join, I might add). But, should your tone of discussion not shift to be more constructive, with less baseless slander against any one person here, I'm putting a warning point on the table. This will come with being put on moderator queue which will see all your posts being screened before publication (as is actually the case right now as you're a new poster). Thank your for your understanding in this matter, and to a good, fruitful discussion. 🍷

I've seen this happen on Vindemiatrix, and I think it happened on Taiyangshou today as well (maximum is 4.8 Gb/s but that is average so likely it did surpass 5 Gb/s). I still wonder why overall bandwidth utilization of 10 Gbps servers are low (<50%), is this just due to scaling?

less than 100GB

Hey there, Taiwan is a provincial administrative region of China, an inalienable part of China’s territory. But when I checked my IP on ipleak.net, I saw Taiwan was shown with those outdated flags, which is totally wrong. These flags don’t reflect the fact that Taiwan belongs to China. Using them misrepresents Taiwan’s status and goes against the One - China principle. It’s really important to fix this mistake. Please correct the display and stop using such wrong flags. Let’s make sure the info about Taiwan is right, in line with the One - China principle. Thanks for handling this!

Hello! Thank you for the feedback! That's our contribution to cover the expenses. Just check the price for each 10 Gbit/s full duplex unmetered dedicated line for 1 year to get an idea of expenses for the network traffic, then also consider the depreciation of 20 servers and their maintenance (hardware replacements, manpower maintenance hours...) over the years. It's not like managing a VPS with a few TB per month and a few Mbit/s shared line, and we're talking about exit nodes. Kind regards

Hello! Starting from version 2.3, firewalld by default owns exclusively nftables tables generated by itself, thus preventing Eddie, Bluetit and Hummingbird Network Lock related operations. If you want to have Network Lock enabled and firewalld running at the same time, then you must configure firewalld by setting the following option: NftablesTableOwner=no in firewalld's configuration file, usually /etc/firewalld/firewalld.conf . After you have edited the configuration file with any text editor with root privileges, reload firewalld configuration or restart firewalld, and only then (re)start Bluetit, Hummingbird or Eddie. Additional insights: https://discussion.fedoraproject.org/t/firewalld-add-flags-owner-persist-in-fedora-42/148835 https://forums.rockylinux.org/t/rocky-9-5-breaks-netfilter/16551 Kind regards

Some differences between yours and mine are: I also use Wireguard and I have "- WIREGUARD_PUBLIC_KEY=[redacted]" and you don't; I don't have any volumes set up, everything in the docker compose; You aren't specifying the latest image, consider using "qmcgaw/gluetun:latest"; I do not use CIDR notation for the "WIREGUARD_ADDRESSES" and you do, consider trying it without the "/32"; Are you sure your forwarded port is in AirVPN's pool #1? For P2P it has to be. For qBittorrent: again use the latest: "lscr.io/linuxserver/qbittorrent:latest" consider adding the following for robustness: "depends_on: gluetun: condition: service_healthy restart: true" You don't have "TORRENTING_PORT=[your pool #1 port number]"; Its usually best to have these in the same stack, not separate containers. Keep trying, it DOES work.

Let me just add the observation that only a few percent of domains you might be looking up in a DNS system are going to be DNSSEC signed anyway. While it's nice to have DNSSEC functioning as a sort of future proofing and for the rare cases when it matters now, becoming alarmed at its absence in a DNS system at this stage is seriously inappropriate. Example: in the US the only major financial institution that I can find that signs its DNS entries with DNSSEC is the Internal Revenue Service! Yes, irs.gov is signed, as are some other US-gov't agency sites. But the big banks do not use DNSSEC, and neither do the well-known large brokerage houses. (Every site foo.bank is a DNSSEC-signed bank site, but see https://www.register.bank/dotBANKers/# to see which banks have bothered. They're all small.) In the VPN world, AirVPN.org is signed, mullvad.net is signed, and privateinternetaccess.com is signed. Every other well-known VPN service that I've tried depends on unsigned DNS entries. So basically at present, DNSSEC from the consumer point of view is little more than a cute toy.

You're on fiber, right? Because if so, you are not the first with this, and you won't be the last. I can't wrap my head around it myself because I don't know anyone who is on fiber to test anything (I'm in Germany, after all), but all the people before you suggest that OpenVPN is problematic with fiber connections.

Hello, could you please make a tutorial? I tried this but Im doing something wrong, because the client cant connect to the AIR servers after I set the firewall rules ... A permanent network locker is for other vpn providers normal, but here? Why you dont just make a option in the Eddie client? Anyway a tutorial would be great

hello people, i have a question because of the network lock in airvpn, i activated it but 1 problem: its only working when the AIRVPN client is started, i chose airvpn auto windows start but the problem is that still with ssd its taking maybe 5 seconds to start (it starts with loading beam). the question is how can if fix that? example: the airvpn client eddie crashes (latest version ofc) -> my internet IS UNPROTECTED! thanks for any help regards

NOTE: if you run Eddie or Hummingbird you don't need this guide, but you might need to get rid of update-systemd-resolved which, in one of its various working modes, can interfere fatally with DNS handling. This post describes how to accept OpenVPN servers DNS push on Linux, OpenBSD, FreeBSD and some other POSIX-compliant OS when: resolvconf package OR openresolv package is installed OpenVPN is run directly (i.e. NOT through any OpenVPN GUI/wrapper such as network-manager) OpenVPN version is 2.1 or higher Warning: the specified "update-resolv-conf" script path refers to many Linux distributions and OpenVPN package installation, but NOT to all of them. Please check the correct path of the mentioned file before proceeding (for example: it could be /usr/share/openvpn instead of /etc/openvpn). If the script is not on your system, you'll need to create it. See the typical script here: https://wiki.archlinux.org/index.php/OpenVPN#DNS Important: in the same above linked page, note that if you have a system based on systemd you might need some important modifications: Add to your OpenVPN configuration file(s), either in field "Custom Directives" of the Configuration Generator or by editing the configuration directly, the following lines: script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf In this way update-resolv-conf will record the DNS push and through resolvconf or openresolv will modify the nameserver accordingly. When OpenVPN quits, update-resolv-conf restores the previous nameserver line(s). Kind regards