Staff

Hello! We're very glad to inform your that Eddie Android edition 4.1.0 beta 3 is now available, featuring an additional update with libeddiewg that moved to amneziawg-go v0.2.19 and a relevant bug fix. The bug affected proper cleanup and compilation of Amnezia In parameters causing connection failures and other problems. If you found any issue related to AmneziaWG, please test beta 3 before reporting. If you decide to test this new beta version and you had any previous Eddie installed version, please delete all app data and cache from Android settings, uninstall the older Eddie app, and finally side load the new beta 3 apk. Please find all the details on the first message of this thread. Kind regards

It looks like the web site operators blocked access from the whole European Union. It makes sense: a service that lets users upload a face and searches for matching people online is likely processing biometric data. In the EU, that can trigger strict GDPR requirements, including lawful basis, transparency, security measures, and data subject rights, that perhaps the service can not offer at the moment. Moreover, the service might need to retrieve profile photos of many other persons from social networks or other websites without explicit permission in order to compare them with your photo, something that can lead to a quagmire of potential civil and criminal violations in the EU. After the relevant fines imposed by European Union data protection authorities against Clearview and the subsequent, additional criminal charges https://ppc.land/criminal-charges-filed-against-clearview-ai-after-regulatory-fines-fail/ blocking access from EU can be a prudential move, but let's remember that the Commission pretends that the GDPR applies to non EU companies to protect citizens of any country when they are in the EU. (EDIT: this last sentence was edited to fix a factual mistake). Kind regards

Hello! For the readers and OP: @mith_y2k had a dramatic performance boost by setting WireGuard MTU to 1280 bytes (from previous 1420 bytes) and by cherry picking servers around his/her location instead of picking a generic continent and let the domain name extract the "best" server. Support team is now considering whether suggesting to add MSS clamping too, in case PMTUD is broken somewhere, but the throughput is now consistent with the "Top 100 Users Speed" so the MTU was for sure the main problem. About server selection, always consider that if you use an entire continent domain name, you are in a sub optimal situation to find the server that can provide you with the best performance. The domain name resolution takes into account important variables to resolve into the entry IP address of an healthy server, but knows absolutely nothing about your location, routing and round trip time from your node to the VPN server. Therefore, when you select an entire continent, you shrink the likelihood of finding a server that's indeed the best for throughput to/from your node. Kind regards

@darkocean69 Hello! Good question. In 2010 we wanted an encrypted stream without HTTPS and/or certificates that looked as much as possible as plain HTTP for good reasons. We also wanted to avoid importing public keys and make the procedure immediately usable on the software. The method was good enough to survive for 16 years. Now we can also implement potentially bootstrap server access via HTTPS or more esotic ways but there's really no need at the moment, we'll see. Kind regards

Hello! Please open a ticket, each case could be unique and there are no specific problems on the infrastructure. Kind regards

Hello! Thank you very much for your tests and report. We can reproduce similar problems and we are investigating. In the meantime, please try this: from Android application settings, delete Eddie data (both data and cache) uninstall Eddie re-install Eddie and report back The above procedure can mitigate one of the problems we detected thanks to your report, but we have found other problems (when using Eddie in Amnezia mode) and a thorough investigation is going on. We will keep you posted. Kind regards

For the readers, the customer solved the problem by entering the correct access credentials. Kind regards

Hello! We're very glad to inform you that Eddie Android edition 4.1.0 beta 2 is now available. Please refer to the original message for important updates and details. Kind regards

Hello! Yes, please do it. Currently the software is in public beta testing and is already quite solid. No, we can re-assure you that it doesn't. All the vulnerabilities (including, but not limited to, the one you mention on macOS) have been fixed, see the changelog: https://airvpn.org/forums/topic/80641-eddie-desktop-edition-226-beta-released/ A stable version is expected very soon. Kind regards

Hello! Would it be possible to see the logcat? We know that you can't generate it through Eddie as it crashes as soon as you launch it, but maybe you can access it via adb (available on most systems)? https://developer.android.com/tools/logcat Kind regards

Hello! Yes, 4.1.0 preview is available, but <c> tag for I parameters is still included. However, after having considered that <c> was documented a year ago but it is still (at the time of this writing) unsupported, it was decided that <c> will be not used on the next Eddie Android edition 4.1.0 beta 2. Please see here: https://airvpn.org/forums/topic/80787-eddie-android-edition-410-preview-available/ Kind regards

Hello! Eddie does use the <c> tag, only for complete QUIC mimicry of a few real web sites. However, this issue exists and is still open: https://github.com/amnezia-vpn/amneziawg-go/issues/120 Eddie used <c> in some signatures because it was documented. If it remains unimplemented, we can remove it from the next Eddie version. In the meantime you can simply delete it when you need the profile in AmneziaWG native software (by editing the configuration file with any text editor) or use only those signatures which don't include <c> tag (there are many in Eddie Android edition's CPS database). Kind regards

@justi Hello! This is exactly a specific Go-related problem triggered by Eddie that must be resolved by Eddie 4.1.0, can you please test the preview version if possible and report back at your convenience? https://airvpn.org/forums/topic/80641-eddie-desktop-edition-226-beta-released/ Kind regards

Hello! We're very glad to announce the Eddie Android edition 4.1.0 preview is available UPDATE 2026-07-18 Eddie Android edition 4.1.0 beta 2 is available UPDATE 2026-07-24 Eddie Android edition 4.1.0 beta 3 is available UPDATE 2026-07-30 Eddie Android edition 4.1.0 is available. Please move here. Eddie Android edition 4.1.0 development focuses exclusively on improving stability by introducing a new custom AirVPN library that combines wg-go and amneziawg-go into a single runtime. This architectural change addresses a fundamental constraint of the Go runtime. Go was designed with the assumption that only one runtime instance exists per process and does not support multiple independent runtimes within the same process. Consequently, the runtime assumes exclusive ownership of global resources such as the heap, scheduler, stack management, and other core runtime components. The current production version had been linked against two separate Go-based libraries since support for Amnezia WireGuard was introduced. Despite the precautions implemented, on a small subset of devices, this configuration still resulted in crashes during approximately 1% to 5% of application launches. Analysis showed that all such crashes originated from Go runtime components, most notably the garbage collector. By consolidating both libraries into a single Go runtime, Eddie Android Edition 4.1.0 is expected to eliminate these crashes across all supported devices. Furthermore, Eddie Android edition adheres more strictly to AmneziaWG protocol version 2 real implementations. Specifically: The <c> tag for I parameters has been removed. Although documented for about a year, it was never implemented in the AmneziaWG protocol and any implementation intent was dropped during February 2026. Because, regrettably, it remained in the Amnezia documentation, Eddie 4.0.x still generated this parameter in certain profiles, resulting in the well-known interoperability issues with other clients. Eddie 4.1.0 eliminates this inconsistency. See: https://github.com/amnezia-vpn/amneziawg-go/issues/120 Added support for the <rc> and <rd> tags for I parameters. J parameters must now be ≥ 1. Previous Eddie / Amnezia releases accepted values ≥ 0, making it possible to explicitly configure zero junk packets, thereby allowing users to explicitly configure a logically degenerate state in which the junk-packet mechanism remained enabled while simultaneously instructing it to emit precisely zero junk packets. This is no longer supported; to disable junk packet generation, simply omit the J parameters. WireGuard compatibility now requires the canonical header mapping (Hₙ = n), as packet header identifiers are interpreted in a strict semantic order. Earlier AmneziaWG implementations, including that used by Eddie 4.0.x, internally canonicalized header mappings, allowing any non-repeating permutation of {1, 2, 3, 4} to preserve WireGuard compatibility. Eddie now enforces the canonical mapping whenever interoperability with standard WireGuard peers is required, including connections to AirVPN servers using the default Amnezia configuration. Eddie Android Edition 4.1.0 also includes updated libraries and dependencies. Please refer to the changelog below for additional details. Download link, checksum and changelog https://eddie.website/repository/Android/4.1.0-Beta3/EddieAndroid-4.1.0-beta-3.apk This is a build debug package and side load is mandatory. If you decide to test this new preview version and you had any previous Eddie installed version, please delete all app data and cache from Android settings, uninstall the older Eddie app, and finally side load the new apk. If you decide to test, please report at your convenience any bug and problem in this thread. If possible generate a report from the app in a matter of seconds: by tapping the paper plane icon on the Log view bar rightmost side you will generate a full system report which will include both log and logcat and have it sent to our servers. Then you just need to send us the link the app shows you (open a ticket if you prefer to do it in private). $ sha256sum EddieAndroid-4.1.0-beta-3.apk 1605f596c433ecf6ef81d5a6e97c1d5e4ae3408c358678ff9c808438c4acc179 EddieAndroid-4.1.0-beta-3.apk Changelog 4.1.0 beta 3 (VC 39) - Release date: 24 July 2026 by ProMIND Native Library [ProMIND] libeddiewg: moved to amneziawg-go v0.2.19 AmneziaCPSDatabase.java [ProMIND] loadData(): clear I* values [ProMIND] loadData(): Activity is now sent to the Logger [ProMIND] loadData(): check CPS items with validateCpsSignature() [ProMIND] validateCpsSignature(): new method. Formal check for AmneziaWG CPS signature EddieLogger.java [ProMIND] added methods escapeHtml(), unescapeHtml() and decodeEntity() [ProMIND] log(): convert logMessage to HTML entities with escapeHtml() LogActivity.java [ProMIND] createExportLog(): convert Logger's HTML escaped messages into plain text SettingsManager.java [ProMIND] SYSTEM_OPTION_VPN_RECONNECTION_RETRIES_DEFAULT is now set to 10 VPNProfileDatabase.java [ProMIND] checkWireGuardProfile(): removed CpsPattern. Cps signature check is now done with AmneziaCPSDatabase.validateCpsSignature() VPNService.java [ProMIND] handleConnectionError(): added overloading with VPNEvent type WireGuardClient.java [ProMIND] start(): in case AmneziaWG CPS signature is bad, throw Exception Changelog 4.1.0 beta 2 (VC 39) - Release date: 17 July 2026 by ProMIND Native Library [ProMIND] libeddiewg: moved to amneziawg-go v0.2.18 SettingsActivity.java [ProMIND] ameziaSettingsDialog(): Jc, Jmin and Jmax minimum value is now 1 (awg protocol 2.0) WireGuardClient.java [ProMIND] createCpsQuicInitialSignature(): removed amnezia <c> meta tag, added random <r>, <rc> and <rd> (awg protocol 2.0) [ProMIND] createCpsQuic0RTTSignature(): removed amnezia <c> meta tag, added random <r>, <rc> and <rd> (awg protocol 2.0) [ProMIND] createCpsDnsQuerySignature(): removed amnezia <c> meta tag, added random <r>, <rc> and <rd> (awg protocol 2.0) [ProMIND] createCpsJunkSignature(): removed amnezia <c> meta tag, added random <r>, <rc> and <rd> (awg protocol 2.0) [ProMIND] generateRamdonAmneziaSettingsForWireguard(): Values for H1 H4 are now 1-4 respectively (awg protocol 2.0) [ProMIND] added createRandomAmneziaRTags() method Changelog 4.1.0 beta 1 (VC 39) - Release date: 14 July 2026 by ProMIND Native library [ProMIND] updated to OpenVPN-AirVPN 3.12 (20260714) [ProMIND] updated to OpenSSL version 3.6.3 [ProMIND] Updated to version 4.1.0, API 11 [ProMIND] Removed library libwg-go dependecy [ProMIND] Removed library libamneziawg-go dependency [ProMIND] Introduced library libeddiewg. Custom AirVPN Go library combining wg-go and amneziawg-go [ProMIND] api.h, api.cpp: added functions eddiewgLibraryName, eddiewgLibraryQualifiedName, eddiewgLibraryVersion and eddiewgLibraryReleaseDate, implementing the corresponding calls to libeddiewg, both C and JNI EddieApplication.java [ProMIND] onCreate(): call eddiewgLibraryQualifiedName and log output EddieLibrary.java [ProMIND] Added definitions for native library calls eddiewgLibraryName, eddiewgLibraryQualifiedName, eddiewgLibraryVersion and eddiewgLibraryReleaseDate Kind regards & datalove AirVPN Staff

Hello! The infrastructure is upgrading to OpenVPN 2.7 with DCO (Data Channel Offload) support. However, this upgrade doesn't break compatibility with OpenVPN 2.4 and higher versions, and you're running OpenVPN 2.5. Try to upgrade to OpenVPN 2.6 or 2.7 just in case and check whether the problem gets resolved. Also test WireGuard, which has not been modified (the kernel module gets upgraded with the kernel upgrade of course). To see the list of upgraded servers, you can go to your AirVPN account "Client Area", enter the "Config Generator", turn on the "Advanced" switch, and select "2.6 DCO" in the "OpenVPN profile" combo box. The CG will show only the servers running OpenVPN 2.7 and DCO module. Kind regards

@robertoohoho Hello! You have set either a Master Password or system key wallet password protection to encrypt Eddie's configuration file. If you can't remember the password, you have no choice but to delete Eddie's configuration file while Eddie is not running. At the next run Eddie will create a new configuration file with default settings and no password-led encryption. To delete Eddie's configuration file on macOS, from a terminal opened by the same account that installed Eddie: rm ~/.config/eddie/* Kind regards

Version 2.26.2 (Thu, 09 Jul 2026 11:19:55 +0000) [fix] [linux] Fix elevated startup on distros without systemctl (e.g. Devuan/sysvinit) [fix] [all] Emit disable-dco in generated OpenVPN config when startup options are incompatible with data channel offload [fix] [windows] Harden elevated named pipe against pipe-name squatting (FIRST_PIPE_INSTANCE, single instance) [change] [all] Misc fixes and general cleanup

Hello! Black list enabled: all traffic inside the VPN tunnel except the traffic of the black listed applications which goes outside the tunnel. White list enabled: all traffic outside the VPN tunnel except the traffic of the white listed applications which goes inside the tunnel. When you define a whitelist with a single app for per-app traffic splitting purposes, only that app traffic will be tunneled. The system process traffic will not be tunneled, and any other non-white listed app traffic will not be tunneled. So the behavior you observe seems just fine, but please feel free to elaborate if we misunderstood. Kind regards

@moejoe Hello! Configuring DNS blocks through the app is currently not possible, we're sorry, but you can have different profiles by using the option to link specific DNS block settings to each key ("device"). Then you can easily switch between devices to switch DNS blocks, although a re-connection is required for each switch. Kind regards

For now, we ask you to ignore that message. It is caused by the fact that the current macOS UI is written in Xamarin, which does not support arm64 compilation. One of our goals is to release a new modern UI, natively compiled for arm64, before this restriction becomes a problem.

Version 2.26.1 (Sat, 04 Jul 2026 17:30:39 +0000) [fix] [linux] Fix nftables netlock ipv4 mangle OUTPUT chain priority typo [change] [linux] Store network lock rule backups in root-only state directory [fix] [all] Fix TOCTOU race [fix] [linux] Sanitize VPN DNS addresses written to /etc/resolv.conf [change] [all] Misc fixes and general cleanup [fix] [linux] Fixed connection on Arch (no SysV service command) [change] [all] Improved security of how the VPN configuration is handled by the privileged helper [fix] [all] Block OpenVPN directives that write files as root

Hello! Let's investigate it on a new thread. Kind regards

@taikeru Hello! We're glad to know that terminal=true solves the problem. fuzzel and rofi honor the Terminal=true field in .desktop files but they manage it according to their own settings. Please check. For stdout - but a future version can be tty-aware, stay tuned. Kind regards

@taikeru Hello! Thank you for your great feedback about the Suite software, much appreciated by the development guys too. Provided that the desktop user is in the airvpn group, the usage you mention should be possible with some caveat, as cuckoo needs a tty. Can you please add the following line to the .desktop file: terminal=true and test again? Kind regards