Leaderboard

Hello! We had a similar project that is now temporarily frozen for good reasons: in real life the ability of the "AI"s to guess successfully the real destination from analysis of the VPN tunnel traffic is poor (the excellent success rates you see are achieved only in a controlled environment where the victim visits only destinations pre-determined from a tiny list) AmneziaWG is quickly becoming (*) a more universal approach that may be effective and that does not require our own proprietary solution, provided that constant rate tunnel, deterministic batching and traffic morphing are not required -- safe assumptions as DAITA doesn't aim at obtaining them (*) While early AmneziaWG releases could "only" add junk packets during handshakes, making it not suitable to replace DAITA, AmneziaWG latest release is also capable to perform padding of transport messages and modification of their header range. It can do all of the above, optionally, over a faithful imitation of a different protocol (any protocol that can be built on UDP), including specific HTTP/3 web sites initial flow mimicry. While these options efficacy in fighting AI guided traffic analysis must be verified in a controlled environment when AI abilities will improve, and in spite of the fact that AmneziaWG currently lacks the important active distortion feature that DAITA offers, together with reason 1 they are sufficient to let us prioritize AmneziaWG support in the infrastructure and our software, and freeze proprietary solutions research. Once AmneziaWG is operating in the whole infrastructure, it may be considered whether adding active distortion to match this DAITA feature, or anyway building additional features to outperform DAITA (on top of the many already available in Amnezia and not from scratch), is worth the effort or not. Kind regards

Every time a VPN connection is started, there is a chance Eddie will crash, most often by the third connection attempt. Here, I just tapped on the same server (but it could be any server) three times, then Eddie quit and the VPN disconnected. This doesn't happen with Eddie 3.3.0. https://eddie.website/report/46708ecc/

finally managed to connect via my phone, thanks to New app version. If you are located in .Ru just use any free working vpn to reach airvpn server to log in, than disconnect and use airvpn. For me worked amnezia with default parameters. Thanks staff for your work.

Hello! We think that the problem is on your side. Castula is absolutely perfect just like other servers you experience this problem on. We have no complaints whatsoever about any of the servers you mention. Note that Castula, Chamukuy, and Elgafar are all connected to the same upstream in the same small subnet. Your tests have been instrumental to make us aware of the problem (SYN flood and similar events) frequently occurring on specific Canadian servers, so thank you! A good thing you can do on your side is black listing the servers that don't work well for you. You have anyway a vast range to pick from. Keep us informed if the problem suddenly appears on one or more of the servers that are perfectly fine for you now. Kind regards

I've been with AirVPN for a long, long time. I wrote the original Tomato router guide. I've never had problems like this before. The packet loss is very persistent. Kornephoros is the only node in eastern Canada where I am not having any problems. It's a meganode and that may speak to its capacity to handle large volumes of packets. I was getting the same packet loss in NYC on Muliphein, but that suddenly resolved. Still, half of the six NYC meganodes are jittery, with lots of latency spikes. I just rechecked everything. I also checked both the first and second hops off each VPN node to make sure that the packet loss is consistent and not localized to one node/router. Can anyone at AirVPN figure out what's going on? I already talked to both my ISP and carrier about this and can completely rule out any problems with my connection physically, or at layers 2 or 3. See below for the latency and packet loss numbers. Lacerta: 96 of 100 packets returned successfully : 4.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 146/0/75 Ross: 98 of 100 packets returned successfully : 2.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 166/0/58 Cephei: 95 of 100 packets returned successfully : 5.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 24/0/18 Kornephoros: 100 of 100 packets returned successfully : 0.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 32/0/18 Mintaka: 93 of 100 packets returned successfully : 7.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 76/0/21 Tejat: 86 of 100 packets returned successfully : 14.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 23/0/19 Tyl: 95 of 100 packets returned successfully : 5.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 24/0/18 Muliphein: 100 of 100 packets returned successfully : 0.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 262/0/31 Paikauhale: 100 of 100 packets returned successfully : 0.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 50/0/28 Sadalmelik: 100 of 100 packets returned successfully : 0.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 193/0/30 Terebellum: 100 of 100 packets returned successfully : 0.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 280/0/40 Unukalhai: 100 of 100 packets returned successfully : 0.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 44/0/28 Unurgunite: 100 of 100 packets returned successfully : 0.0% PACKET LOSS Round Trip Time (in milliseconds) Maximum/ Minimum/Average: 86/0/29

I checked the list of AirVPN updates and saw that there has been no update to the Windows application for a year. What's happening?

Did everyone notice? The Kornephoros server achieved astonishing speeds today. As a 10Gbps server, it loaded over 5Gbps of bandwidth. I've never seen such speeds on any 10Gbps server before. What makes this server different from other 10Gbps servers? Is it the unprecedentedly powerful hardware, the data center's network environment, or AirVPN's optimization of the server's kernel? Staff can take a look and use this information to optimize other 10Gbps servers. Kornephoros is truly unexpected.

Hello! Eddie Android edition 4.0.0 beta 2 is now available featuring improved AmneziaWG support and strengthened logic against AirVPN bootstrap server blocks: https://airvpn.org/forums/topic/77633-eddie-android-edition-400-preview-available/ Kind regards

Hello! We're very glad to announce that Eddie Android edition 4.0.0 beta 2 is now available. New: how to use Eddie in network where the "bootstrap" servers can not be reached Eddie downloads user and infrastructure data, essential to use the service, from special "bootstrap servers" through an encrypted flow inside HTTP. If the bootstrap servers are blocked or the underlying protocol to port 80 is filtered out, Eddie is unable to proceed. Starting from Eddie 4 beta 2 version, the ability to retrieve such data locally has been added. Whenever bootstrap servers are unreachable, Eddie can read the latest available local data to connect to a VPN server. Once connected the bootstrap servers are again reachable and the local data are immediately updated for future usage. The local data remain valid as long as you don't need to change user. On top of all of the above, Eddie can now retrieve such data through the login procedure that now can be started even when a connection to a VPN server was previously established via a profile. Therefore, when you are in a restrictive network that blocks access to bootstrap servers, you can connect through a profile generated by AirVPN web site Configuration Generator. After this first connection, log your account in to the service by selecting the specific option on the left pane, enter your AirVPN account credentials as usual and make sure that Remember me checkbox is ticked: Eddie will download all the necessary files and store them locally. This procedure is "once and for all", at least as long as you don't need to change account. After this initial connection, Eddie will be able to log your account in to the infrastructure, retrieve servers data and establish connections without profiles and without bootstrap servers, offering again full AirVPN integration even when bootstrap servers are unreachable. Only If you change account you must repeat the procedure. New: "Open with..." option added to "Share" option Different Android versions allow management of files with different restrictions. Different apps may support different intents on specific Android versions. To enlarge total compatibility, now Eddie offers two different options to export and manage files, including generated profiles. You will find the usual "Share" option coupled with a new "Open with..." option. Some apps support only one intent, other apps only specific intents on specific Android versions, and so on. By adding this option Eddie enlarges considerably the amount of apps you will be able to open and/or share files with. New: AmneziaWG parameters range validity AmneziaWG parameter range validity has been documented in three different ways (official web site, GitHub documentation files, and developers comment) and the web site documentation that it's still official is in reality not aligned with the source code. The new parameters range validation adopted by Eddie 4.0.0 beta 2 is based now on GitHub latest documentation integrated by source code analysis. The original message of this thread has been updated accordingly. You will find on it the new download link and checksum, as well as detailed Amnezia description. If you decide to test, please report at your convenience any bug and problem in this thread. If possible generate a report from the app in a matter of seconds: by tapping the paper plane icon on the Log view bar rightmost side you will generate a full system report which will include both log and logcat and have it sent to our servers. Then you just need to send us the link the app shows you (open a ticket if you prefer to do it in private). Kind regards & datalove AirVPN Staff

How can the load percentage be conveyed even clearer in your opinion? Those are highly subjective things depending on your setup, and I don't want to see them as data points in a server overview showing factual data valid for everyone the same way. Load (= bandwidth usage), number of clients and RTT between the servers are factual data valid for everyone, whereas your own latency and "connection quality metrics" are the result of your client's configuration, connection type and its config, ISP, routes, etcetc. I mean, what is even the definition of "connection quality" in your own words? Preferably something that is valid for you, me and the random reader of this thread at the same time.

Kinda unrelated but this server has been going down a lot in the last few weeks.

Kornephoros is airvpns better 10gb server in canada. it almost gives me full speeds on my home server(connected via wifi) funny enough their now decommissioned wurren was a pretty crappy in my experience. i was never able to get more than 80mbit on wurren even though it was also supposedly a 10gbit server... even regular 1gbit server outperformed wurren

That's incredible! It seems the server hardware wasn't that bad; perhaps it was just maintained two days ago? Or maybe the hardware was replaced? I see that this server only has 280+ users. Could it be a user issue? More users using the Wireguard protocol can indeed bring higher bandwidth usage. If the AmneziaWG protocol becomes widespread, it would be incredible if even 10G servers could be fully utilized.😄😄😄

Maximum of 7.3 Gb/s on Terebellum. I think most users are probably not using that much bandwidth to push the 10 Gb/s servers to their max.

@Stalinium Yes, the packets you obtain yourself are better suited to your network environment. If you find that troublesome, you can also try other people's parameters. Here are my parameters. Jc = 8 Jmin = 86 Jmax = 892 S1 = 0 S2 = 0 H1 = 2 H2 = 3 H3 = 4 H4 = 1 I1 = ... I2 = ... I3 = ... I4 = ... I5 = ... CPS I1-I5(bing.com-initial QUIC).txt

Jc = 10 Jmin = 53 Jmax = 488 S1 = 0 S2 = 0 H1 = 2 H2 = 4 H3 = 1 H4 = 3 I1 = <b 0xc800000001142041eb35d428321d4c7b5a54f4a25b2eb42b1473144d6f82c2a7fb72748e0ec1cb05dbee502b24ad1f008000047c54b2c6fd1b8d38cc5b2898ffb4ab45a98e34500df11f17d7a00e6feee8b1689e65d3de8267c53ab147353c33bb36072efc65b807af56031e5531651e06f604b15a2cffe4ac57a2611c5b4ed0de39c051de95ad48ca096859db12be3164a2b4c4780c20889a6d9f592cb30b7c0de1636492f9c708ba5ef94c62ff52355782fdc80a7cb7c271004b31164f17ae1164b2a6879182d4e43c06cc29803ee6817da5f08a2c43757cc0f1748ef45fd8b69559b96ecc22828bf5eb9c5796db363da6cd1e675808ff1fa60ed2f226ea9347b6aead0a77419dbea8c03053c6c78e98652faa8b3d7c266d508586f2bc642b55adadbfbeae7d36bf1555e5769b8bf21f81908da3418882937d394e73284fa254926373aeb3d9093f837281c533688e29dacf3d798a36e32ae5d06683b4fba6031652f3abd817d4e585dc8682d2fc661d58242f9148cf051ecd0bfc4d3d1ebbd5db752567389710d3f39d963e01d39240e79a83e5043455609733b00cf2abec95270125882327c93bb2702d2beb03fcf8e5df1234e10f28768d76458f5380a256c27d6623774deabcd327c845e1398006bf288fd3732ea36d13a661ee551d024403283bfde1213ff4e767fefac1db3a2555ae0ffc5ab72251c269bc5115cf4bb65280ffa35c62468801e191131d35ad081659abb97a8fbe26049556ffe87f4d7f592a6f4423133e79661a26928511288cf98e54e34a4e8ecdd4d8c6e1af469ded38a159d625e45e549b3a711ef293f7930040c72b7cd975045ed7e629b60104cced6cb5afb75712eefd60bd705c040bf2143de63d2f637f825c69e53034e183aadb94858d63f2506d42d4faed810ba98172d2340b9d2eb63a4665a5480124f6ce5369cccf2bf18d512fc1b52c0ae7f64ca4380a17d19882b69bcda00277f73b8e02160cddfd913b807149e8519cfbdcb216b80a377a735ad31b87b41c7fb966ebcaae7213e6d4915beb845f926f6e29a284ea11a4f3a63ed22a61d0110cd33b1c31a8a0538b312e9266b773621cdeb9aa862db0d99e04b3cfa1e9ab03ff35cf6a6d3b72be1a6e039104547f9041e007d02c3769510d507f07ea3ebf38a326a9d82977a1cd32b25af02ccf1ddac08389dfb0a30932161f20b53b7a19b6fa8850d86f67b4420eb65f5ed45ba282ad1b82bf341cb9ad3b36437a1f007ad98ce2058fef118a650c908ac9c8cfaffc6eb37f203946a05b1d1698a0e325fc25594d41df81e5984486209aaf3ec854bea023663a7b8c63d31aea21921dcfca5d828b10fca0dd0855ffcaf4e9f0ae83372ff1674f2229954b7dd5dedff81a34aea41537f4536a86a746fa1e28c06985bc029e76df04d383fa7559679d67aa53e153663653ea75cc29a400e20f7ec5c55d13669d08eb9a5615b6871f51c08fde02ddb3bdaa0cc28ef207c6ff51f52bbd3cd49fab6708db0ccda23c7cfd6bd7aae5143b4a88aedf4d232ef39645ddb5bfe794b3e7175cb0b355c4f44df07b53bc48c11e80c3b62319f6a26f8a9b300306c2077b3c0a06028ed9cc2ffabb9984500cd98420b58a6649be2ac1969c3cc2b2fe62dae03c4e48b080ae812c7e105f45fc4ad3544e46d38e25662177644d6ea87e99a892> It is highly preferred that you get your own QUIC packet for I1. You could do that with Wireshark and "curl --http3-only (possibly any Russian website that is whitelisted)" . Select first QUIC Initial packet, right click "QUIC IETF" below -> Copy -> Copy as a Hex Stream. (Mozilla Firefox QUIC packets did not work for 16 kbyte blocked subnets for me)

I'm also confused. Perhaps the hardware isn't powerful enough? A 1Gbps server can handle 100+ users with 80% bandwidth utilization. This means a 10Gbps server would need 1000+ users to achieve the same 80% bandwidth utilization. However, in reality, a 10Gbps server experiences a significant speed drop when handling 300+ users, seemingly unable to keep up. It would be better to label it as a 3Gbps or 5Gbps server, as the actual speed difference from the advertised 10Gbps is substantial. If that's the case, it would be better to replace one 10Gbps server with ten 1Gbps servers. Maybe that's the case? I think AirVPN may have leased a 10Gbps network in the data center, but the servers can't handle that 10Gbps network. Isn't that a waste of resources? I think AirVPN can increase the number of 1Gbps servers as much as possible to make full use of network bandwidth, which would also save on server costs for AirVPN, wouldn't it?

I've seen this happen on Vindemiatrix, and I think it happened on Taiyangshou today as well (maximum is 4.8 Gb/s but that is average so likely it did surpass 5 Gb/s). I still wonder why overall bandwidth utilization of 10 Gbps servers are low (<50%), is this just due to scaling?

less than 100GB

Hey there, Taiwan is a provincial administrative region of China, an inalienable part of China’s territory. But when I checked my IP on ipleak.net, I saw Taiwan was shown with those outdated flags, which is totally wrong. These flags don’t reflect the fact that Taiwan belongs to China. Using them misrepresents Taiwan’s status and goes against the One - China principle. It’s really important to fix this mistake. Please correct the display and stop using such wrong flags. Let’s make sure the info about Taiwan is right, in line with the One - China principle. Thanks for handling this!

Hello! Thank you for the feedback! That's our contribution to cover the expenses. Just check the price for each 10 Gbit/s full duplex unmetered dedicated line for 1 year to get an idea of expenses for the network traffic, then also consider the depreciation of 20 servers and their maintenance (hardware replacements, manpower maintenance hours...) over the years. It's not like managing a VPS with a few TB per month and a few Mbit/s shared line, and we're talking about exit nodes. Kind regards

Let me just add the observation that only a few percent of domains you might be looking up in a DNS system are going to be DNSSEC signed anyway. While it's nice to have DNSSEC functioning as a sort of future proofing and for the rare cases when it matters now, becoming alarmed at its absence in a DNS system at this stage is seriously inappropriate. Example: in the US the only major financial institution that I can find that signs its DNS entries with DNSSEC is the Internal Revenue Service! Yes, irs.gov is signed, as are some other US-gov't agency sites. But the big banks do not use DNSSEC, and neither do the well-known large brokerage houses. (Every site foo.bank is a DNSSEC-signed bank site, but see https://www.register.bank/dotBANKers/# to see which banks have bothered. They're all small.) In the VPN world, AirVPN.org is signed, mullvad.net is signed, and privateinternetaccess.com is signed. Every other well-known VPN service that I've tried depends on unsigned DNS entries. So basically at present, DNSSEC from the consumer point of view is little more than a cute toy.

You're on fiber, right? Because if so, you are not the first with this, and you won't be the last. I can't wrap my head around it myself because I don't know anyone who is on fiber to test anything (I'm in Germany, after all), but all the people before you suggest that OpenVPN is problematic with fiber connections.

NOTE: if you run Eddie or Hummingbird you don't need this guide, but you might need to get rid of update-systemd-resolved which, in one of its various working modes, can interfere fatally with DNS handling. This post describes how to accept OpenVPN servers DNS push on Linux, OpenBSD, FreeBSD and some other POSIX-compliant OS when: resolvconf package OR openresolv package is installed OpenVPN is run directly (i.e. NOT through any OpenVPN GUI/wrapper such as network-manager) OpenVPN version is 2.1 or higher Warning: the specified "update-resolv-conf" script path refers to many Linux distributions and OpenVPN package installation, but NOT to all of them. Please check the correct path of the mentioned file before proceeding (for example: it could be /usr/share/openvpn instead of /etc/openvpn). If the script is not on your system, you'll need to create it. See the typical script here: https://wiki.archlinux.org/index.php/OpenVPN#DNS Important: in the same above linked page, note that if you have a system based on systemd you might need some important modifications: Add to your OpenVPN configuration file(s), either in field "Custom Directives" of the Configuration Generator or by editing the configuration directly, the following lines: script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf In this way update-resolv-conf will record the DNS push and through resolvconf or openresolv will modify the nameserver accordingly. When OpenVPN quits, update-resolv-conf restores the previous nameserver line(s). Kind regards