Jump to content
Not connected, Your IP:


  • Content Count

  • Joined

  • Last visited

  • Days Won


Posts posted by go558a83nk

  1. 3 minutes ago, Air4141841 said:

    Stunnel will not start for Anything 

    I've stopped/disabled any current tunnels.   I've reinstalled the package.   I;ve rebooted the pfsense box.

    I have NO other packages that could be conflicting 
    Stunnel will not start for Anything 

    I said in step 2, point 8 how to see logs for stunnel.  But you said above "there is no where to find logs either".  But there is.

    Please make sure stunnel is or is not running.

    Then you must edit your openvpn config to suit.  It's all in the steps I outlined above.

  2. 3 minutes ago, Air4141841 said:
    I've tried this.

    your saying create the tunnel using the openvpn clients page?  but use the STunnel data? 

    I've tried under services > stunnel and nothing happens.      

    I edited my post to confirm you create a stunnel tunnel in services>stunnel.  Once that's running you can edit your openvpn config to connect to the listening stunnel daemon, which is step 3.

  3. 3 minutes ago, Panja said:

    What size do you suggest?
    I'm already using 512KB.

    The problem seems to be always happening in the evening hours (CET).
    Just tried 3 of the recommended (server status page) servers in NL and all give me max 30mbit.
    On my laptop without AirVPN I'm hitting 250mbit without problems.

    quit trying the same NL datacenter. obviously your route is poor and is especially congested during peak hours (evening). 

    try other datacenters.

  4. you don't need to import any cert for stunnel to work.

    1) install stunnel package from package manager
    2) Create the stunnel tunnel here in services>stunnel.  /pkg.php?xml=stunnel.xml

    1. Select client mode
    2. use as listening IP
    3. listen on port doesn't matter but you'll just use whatever you put here in the openvpn client setup
    4. certificate is default
    5. redirect IP is found in the .ssl file that you can download for stunnel in the config generator
    6. redirect port is also found in that ssl file (in the name of the file too)
    7. save the stunnel tunnel
    8. your status_logs.php should show stunnel activity to let you know it's running
    3) Create or edit an openvpn config for AirVPN keeping everything the same as usual but changing the following
    1. protocol is TCP only
    2. interface is any
    3. server address is
    4. server port is what you setup as listening port for the stunnel tunnel
    5. in the custom options box input
      route <server IP address> net_gateway;
        where <server IP address> is the same as in point 5 above
    Now in my experience it'll connect then disconnect, perhaps a few times before finally staying connected.  Just be patient.

  5. No, it's not more secure for the actual data.  It's more resistant to hostile networks.

    It doesn't take appreciably more power to use and performance might be a little better depending on the network used.  They may not throttle it like they might other openvpn connections.

    It's not the default because some old devices may not support tls-crypt?  I'm not sure.

  6. you can create gateway groups and have multiple tiers within the gateway group.  the rule for the group can be such that when one tier is down it falls back to the next tier.

    the only problem, last I tested, is that once the higher tier gateway is back up it won't automatically fall "up" to it.

  7. Horrible routing to these new servers..

     4  [19108] [SUDDE] 173-219-233-235.suddenlink.net ( 27.6ms
     5  [19108] [SUDDE] 173-219-233-250.suddenlink.net ( 26.9ms
    **  [neglected] no reply packets received from TTL 6
     7  [6461] [ABOVENET] ae3.cs2.dfw2.us.zip.zayo.com ( 33.0ms
     8  [6461] [ABOVENET] ae28.er1.dfw2.us.zip.zayo.com ( 28.2ms
     9  [6461] [ABOVENET] zayo-comcast.dfw2.us.zip.zayo.com ( 128.5ms
    10  [7922] [COMCAST-16] be-12495-cr02.dallas.tx.ibone.comcast.net ( 125.1ms
    11  [7922] [COMCAST-16] be-12124-cr02.1601milehigh.co.ibone.comcast.net ( 144.7ms
    12  [7922] [COMCAST-16] be-10521-cr02.350ecermak.il.ibone.comcast.net ( 160.7ms
    13  [7922] [CABLE-1] be-1302-cs03.350ecermak.il.ibone.comcast.net ( 163.0ms
    14  [7922] [CABLE-1] be-2311-pe11.350ecermak.il.ibone.comcast.net ( 163.9ms
    15  [46844] [ST-CHI] comcast-100ge.3-2.19.chi.il.sharktech.net ( 160.0ms
    **  [neglected] no reply packets received from TTLs 16 through 17
    18  [11878] [TZULO] [target] static-68-235-48-107.cust.tzulo.com ( 159.8ms


  8. 17 minutes ago, ghostp said:

    Ok, that's a step forward but any idea what's going on and how to fix it?

    Usually the temporary fix is to disable the route checking in settings.  The real fix would be to find out why that's happening.  Since are running a beta it could be that you need to report this in the beta thread as a bug.

  9. 6 hours ago, jeuia3e9x74uxu6wk0r2u9kdos said:

    I'm using this topic than opening another one just to keep the topic under the same umbrella.

    I'm fully aware that AIRVPN has its own DNS servers and DNS addresses, that any request to them is protected because processed inside the tunnel (except for the leaks of course) and I know that the relationship between a user and his VPN provider is mainly a matter of trust (I'm not complaining about this).

    Recently, it has come up that DNS queries are a possible privacy issue because Internet Service Providers can eavesdrop and manipulate them; thus Mozilla and Google have looked out for a way to mitigate the problem and the solution they found is the so-called DNS-over-HTTP (DoH). Cloudflare thought this was not enough so it also proposed to encrypt the Server Name Identification that it is still in an experimental phase.

    As written here https://www.eff.org/it/deeplinks/2018/09/esni-privacy-protecting-upgrade-https "Hosting providers and CDNs (like Cloudflare) still know which sites users access when ESNI is in use" so maybe it wouldn't a great deal to implement it on AIR but it is also written that "ESNI can also potentially work over VPNs or Tor, adding another layer of privacy protections."

    Now, I know that AIRVPN does not store the DNS queries and does not eavesdrop them, but for the aforementioned reasons I wanted to ask if could it be technologically feasible to fully implement the RFC 8484 (proposed) standard and Encrypted Server Name Identification thus increasing user privacy and security by preventing "possible" eavesdropping and manipulation of DNS data? (I want to repeat it again, just to be crystal clear and not being misunderstood: I am totally happy with AIRVPN and I think the Staff is doing a great job. Period)

    I'm neither asking to implement DoH and ESNI now and here nor to implement them in the future but just to talk about the topic, think on it and understand if it could be something reasonable to implement when the Staff will believe it is the right moment, something over-killing or totally useless.

    Is this necessary if there are no logs kept anyway?

  10. Well, I'd try UDP entry IP 3 or 4 first.  If that doesn't work like it should then try TCP entry IP 3 or 4.  If that doesn't then resort to stunnel.  I'll be glad to try to help should it come to that.  But it's a last resort because it's just not going to have much speed either.  I'm really surprised you saw more than 200mbps with the SSL tunnel.  What OS was doing the testing back then?

  • Create New...