Staff

@clebretonfr Hello! We might, but it's not planned for the current version, we're sorry. Those options must be approached with care because, as you probably know, they are an attack surface remarkable enlargement for a library and a daemon, as they allow execution of external scripts and binaries. As usual external execution of anything by a daemon must be minimized. We could consider a surrogate implementation into the client (Goldcrest at the moment) so that the external binary or script runs with the privileges of the user running the client. up and down directives are comfortable for very many purposes, hands down. Kind regards

Hello! We're glad to know it! Maybe you mean that you have added a specific user to group airvpn ? If so: yes, the superuser decides who can access Bluetit (via Goldcrest, in this case) by adding any user to that group. It can be done even during the installation since the script will ask you about that. Of course you can later modify your choices by adding and removing users to/from airvpn group. Therefore you, the superuser, can decide whether users authorized to access Goldcrest can also gain other privileges or not, for additional security. If that was not what you meant, please feel free to elaborate. Kind regards

@Flx The first message was approved by some moderator in the wrong thread, not a big deal. Then we moved the message on its own thread, this one. Then user "wireguard" posted more messages which were all approved by some moderator. @Brainbleach Of course. We were replying to "wireguard" who invites surreptitiously to punish AirVPN because AirVPN uses and develops actively OpenVPN: "Needless to say, investing in AirVPN means investing in OpenVPN, and that's not acceptable to me at this point," . He/she also kept claiming that "it's time to retire OpenVPN" (sic), that OpenVPN is a "truly disgusting hack" (sic) and so on,. showing his/her embarrassing ignorance and lack of good faith. Nothing to do with your messages. Funny how bogus account writers are so eager to become from time to time AirVPN software lead developers, general managers for AirVPN strategies, marketing directors and more. 😀 We wanted to prove beyond any reasonable doubt that his/her claim are unreasonable and based on wrong assumptions and terrible omissions, showing how Wireguard can not replace OpenVPN for a significant percentage of our customers and how our OpenVPN development has been beneficial for many users around the world. That said, we claimed that Wireguard needed to be developed and tested further years ago, so at the time our claim was totally reasonable. We also claimed years ago that the problem was not with CHACHA20 which to the best of nowadays knowledge is a very robust and secure cipher. Now the problems are different because Wireguard is asked to offer something which it was not designed for, i.e. providing some kind of anonymity layer. Such problems include lack of DNS push, lack of dynamic IP address assignment (with subsequent problems with client key-private address static correspondence, a very tough legal problem for us but above all for our customers), need of keeping client real IP address stored in a file. We have resolved them one by one with external software and internal work around. Once the problems are resolved in a robust way, which means testing thoroughly the adopted work-around, we can offer Wireguard, not earlier. Kind regards

@wireguard User "wireguard" is not an account with a valid AirVPN plan If you really wanted to show your support to AirVPN and prove that you are a customer, you would have written from an account with a valid plan. In reality, accounts like "wireguard" seem to be created with the only purpose to pump something and defame something else. From now on, write only from an account that has valid plan, to show that you are in good faith. Our plans about putting Wireguard into production in the near future have been published with a lot of details, albeit without a precise release date (and we have thoroughly explained why), so we will not write again for the nth time about them. About performance, please provide details as we do frequently. Currently we outperform Wireguard with our setup in AES-NI supporting systems, as you can see from our and our customers' tests, while Wireguard can outperform OpenVPN in CHACHA20 in non-AES-NI supporting systems. . When we put Wireguard into production, OpenVPN will stay, so investing in our own OpenVPN development is perfectly fine. Just a few reasons that make OpenVPN superior to Wireguard for many, different needs: it's faster than Wireguard in AES-NI supporting systems when it uses AES. Have a look here! it can be connected over stunnel, SSH, SOCKS5 and HTTP proxies, and Tor swiftly even for the above reason, for an ISP it's not so easy to block OpenVPN, while it's trivial to block Wireguard it supports TCP it supports dynamic IP address assignment it supports DNS push it does not hold in a file your real IP address when a connection is closed a significant part of our customers will not be able to use Wireguard effectively, simply because UDP is totally blocked in their countries or by their ISPs UDP blocking and heavy shaping are becoming more and more widespread among mobile ISPs, making Wireguard slower than OpenVPN in TCP even in mobile devices, or not working at all in mobility About Torvalds and Linux kernel, you only tell a part of the story. Wireguard was first put in some Linux kernel line when Wireguard was still in beta testing and no serious audit was performed, and not put in a kernel milestone release. A further note about battery draining you mentioned in one of your previous messages: our app Eddie Android edition and Wireguard, when used with the SAME bandwidth and the SAME cipher (CHACHA20-POLY1305), consume battery approximately in the same way, so that's yet another inessential point that does not support your arguments and show once more that our investments have been wise. Finally, let's spread a veil on your embarrassing considerations on ciphers, security, privacy and NSA. Let's underline only that CHACHA20.-POLY1305 is very strong, the cipher algorithm in itself (if implemented correctly) is not a Wireguard problem in any way. It would be a reason of deep concern if Wireguard needed OpenVPN defamation to convince us that it's a good software. Unfortunately various bogus accounts have been created with such assumption and purpose, and the hidden agenda is no more hidden. Kind regards

@sooprtruffaut Hello and thank you! Watch out! Source code is not available during beta testing. As usual we will make it available with the stable release. Raspberry Pi OS 64 bit actually has old libraries and the suite will not run in it, we're sorry. When Raspberry OS 64 bit beta testing is over, we plan to support it as well. Kind regards

@colorman Hello! For that you will need to wait for the client software with a Qt based GUI (Firecrest) which will interact with Bluetit as well, or the ncurses based TUI of Goldcrest will be fine for you, perhaps. Stay tuned. Kind regards

@colorman Hello! Please note that Goldcrest commands are a superset of Hummingbird commands, so potentially you can use Goldcrest as it were Hummingbird, but in a more robust architecture (just remember that Golcrest must be run by a user in airvpn group, of course). Hummingbird is anyway included in the suite. In general, using Goldcrest and Bluetit is way simpler because you don't need to have pre-generated profiles (you can bypass the Configuration Generator completely) and much more secure because you don't need to run Goldcrest from a user that must be able to gain superuser privileges. Which issues did you experience exactly, if you don't mind? An uninstall script will be provided in the near future. In order to delete the programs and disable everything in a systemd based system enter the following commands (have root privileges): systemctl stop bluetit.service systemctl disable bluetit.service rm /etc/systemd/system/bluetit.service rm (/usr/local/bin|/usr/bin)/goldcrest rm /sbin/bluetit rm /etc/airvpn/* rm /etc/dbus-1/systemd/org.airvpn.* systemctl reload dbus.service Kind regards

Hello! Yes, of course, it's plausible. OpenVPN runs in a single core so you will see load on one core only AES New Instructions are nowadays well implemented in all desktop CPUs and SSL libraries such as OpenSSL are built to fully use them whenever possible. We hope so! 😎 On the server side we mitigate OpenVPN multi-threading lack by running multiple daemons. Each daemon "runs in a core" and our servers balance with a round robin algorithm the incoming client connections. Therefore a server can use all the cores.. Although each client connects to a single daemon (except in special configurations such as https://nguvu.org/pfsense/pfsense-multi-vpn-wan/ ), of course, load balancing provides remarkable "distributed benefits" anyway. Kind regards

Hello! We're very glad to introduce a new software suite for Linux which is ready for public beta testing. The suite includes the well known Hummingbird software, updated to the latest OpenVPN AirVPN library, and introduces for the first time a D-Bus controlled, real daemon, Bluetit, as well as a command line client, Goldcrest, to interact with Bluetit. UPDATE 11-Dec-2020: version 1.0.0 Beta 3 has been released. UPDATE 23-Dec-2020: version 1.0.0 RC 1 has been released New architecture The client-daemon architecture we introduce for the first time in our software offers a more robust security model and provides system administrators with a fine-grained, very flexible access control. Bluetit is fully integrated with AirVPN. The daemon is accessed through a D-Bus interface by providing specific methods and interface in order to give full support to OpenVPN connection and AirVPN functionality, including - but not limited to - quick automatic connection to the best AirVPN server for any specific location as well as any AirVPN server or country. New OpenVPN 3 library features Starting from version 1.0 beta 2, Hummingbird and Bluetit are linked against a new version of our OpenVPN 3 library which supports directive data-ciphers: it can be used consistently with OpenVPN 2.5 syntax in OpenVPN profiles. The directive allows OpenVPN 3 based software to negotiate a common Data Channel cipher with the OpenVPN server,, updating therefore our library to ncp-like negotiation with OpenVPN 2 branch. Hummingbird and Bluetit are already linked against the new library version, while Eddie Android edition will be updated in the near future. The new library also includes a different handling of IV_CIPHERS variable, fixing OpenVPN main branch issues causing a plethora of problems with OpenVPN 2.5. The implementation, at the same time, takes care of full backward compatibility with OpenVPN versions older than 2.5. ncp-disable directive, which to date has never been implemented in the main branch, is still supported, in order to further enhance backward compatibility with both OpenVPN profiles and servers, as well as connection flexibility with servers running older than 2.5 OpenVPN versions. Please note that if you enforce a specific Data Channel cipher by means of Bluetit configuration file, Hummingbird line option, or Goldcrest configuration file and/or line option, the enforced Data Channel cipher will override data-ciphers profile directive. Changelog 3.6.6 AirVPN by ProMIND - [ProMIND] [2020/11/02] openvpn/ssl/proto.hpp: IV_CIPHERS is set to the overridden cipher only (both from client and/or OpenVPN profile) in order to properly work with OpenVPN 2.5 IV_CIPHERS specifications. The old method of cipher overriding by means of negotiable crypto parameters is still supported in order to maintain compatibility with OpenVPN < 2.5.0 - [ProMIND] [2020/11/24] added "data-ciphers" directive to profile config .ovpn files in order to comply to OpenVPN 2.5 negotiable data cipher specifications. In case "data-ciphers" is found in the .ovpn files IV_CIPHERS is assigned to the algorithms found in "data-ciphers". In this specific case, "cipher" directive is used as a fallback cipher and, if not already specified in "data-ciphers", is appended to IV_CIPHERS Coming soon When we get out of the beta testing, we plan to document Bluetit interface to let anyone write a custom client and talk with the daemon. Furthermore, Goldcrest will evolve in the near future and will include an ncurses based TUI which will be very comfortable when you don't want to rely on command line options while a new Bluetit client, based on Qt, will be developed in the future, for those who prefer a GUI. Notes on systemd-resolved Version 1.0.0 beta 2 and subsequent versions fix a serious issue on systemd based systems running concurrently systemd-resolved and network-manager, for example Fedora 33 in its default configuration. In Fedora 33 systemd-resolved comes pre-configured to work in "on-link" mode and network-manager works together with it. This very peculiar, Windows-like setup finally kills Linux global DNS handling, adding to it those so far missing DNS leaks which made every Windows user nightmares more colorful. Any Microsoft system lacking the very concept of global DNS is now emulated, for an outstanding 30 years back time travel.. However, Hummingbird and Bluetit take care of preventing the brand new DNS leaks potentially caused by such smart setup, giving back Fedora + VPN users more peaceful nights. Also note that systemd-resolved comes pre-configured with fallback DNS (Google DNS is a systemd-resolved default fallback DNS, smart choices pile up!) which will be queried if each interface DNS server fails some resolution. In such a case, if and only if you have Network Lock enabled DNS leaks will be prevented. Supported systems The suite is currently available for Linux x86-64, i686 (32 bit distributions), arm7l (for example Raspbian and other ARM 32 bit based systems) and aarch64 (ARM 64 bit). Please note that the source code will be published with the stable release as usual. The software will be licensed under GPLv3. Overview and main features AirVPN’s free and open source OpenVPN 3 suite based on AirVPN’s OpenVPN 3 library fork Version 1.0.0 Beta 2 - Relase date 27 November 2020 Bluetit: lightweight D-Bus controlled system daemon providing full connectivity to AirVPN servers and generic OpenVPN servers Goldcrest: Bluetit client, allowing full integration with AirVPN servers, users, keys, profiles as well as generic OpenVPN servers Hummingbird: lightweight and standalone client for generic OpenVPN server connection Linux i686, x86-64, arm7l and arm64 (Raspberry) support Full integration with systemd, SysVStyle-init and chkconfig No heavy framework required, no GUI Tiny RAM footprint Lightning fast Based on OpenVPN 3 library fork by AirVPN version 3.6.6 with tons of critical bug fixes from the main branch, new cipher support and never seen before features ChaCha20-Poly1305 cipher support on both Control and Data Channel providing great performance boost on ARM, Raspberry PI and any Linux based platform not supporting AES-NI. Note: ChaCha20 support for Android had been already implemented in our free and open source Eddie Android edition Robust leaks prevention through Network Lock based either on iptables, nftables or pf through automatic detection Proper handling of DNS push by VPN servers, working with resolv.conf as well as any operational mode of systemd-resolved additional features Full documentation: README.md Download links: Linux x86-64: https://eddie.website/repository/AirVPN-Suite/1.0-RC1/AirVPN-Suite-x86_64-1.0.0-RC-1.tar.gz Linux x-86-64 sha512 check file: https://eddie.website/repository/AirVPN-Suite/1.0-RC1/AirVPN-Suite-x86_64-1.0.0-RC-1.tar.gz.sha512 Linux i686: https://eddie.website/repository/AirVPN-Suite/1.0-RC1/AirVPN-Suite-i686-1.0.0-RC-1.tar.gz Linux i686 sha512 check file: https://eddie.website/repository/AirVPN-Suite/1.0-RC1/AirVPN-Suite-i686-1.0.0-RC-1.tar.gz.sha512 Linux arm7l: https://eddie.website/repository/AirVPN-Suite/1.0-RC1/AirVPN-Suite-armv7l-1.0.0-RC-1.tar.gz Linux arm7l sha512 check file: https://eddie.website/repository/AirVPN-Suite/1.0-RC1/AirVPN-Suite-armv7l-1.0.0-RC-1.tar.gz.sha512 Linux aarch64: https://eddie.website/repository/AirVPN-Suite/1.0-RC1/AirVPN-Suite-aarch64-1.0.0-RC-1.tar.gz Linux aarch64 sha512 check file: https://eddie.website/repository/AirVPN-Suite/1.0-RC1/AirVPN-Suite-aarch64-1.0.0-RC-1.tar.gz.sha512 Please report bugs and any problem in this thread, thank you! Kind regards AirVPN Staff

@Shiver Me Whiskers Hello! The previous record did not last long, apparently. If you don't mind, which connection protocol, cipher and port did you pick? Kind regards

@jeuia3e9x74uxu6wk0r2u9kdos @korsko @Overkill Hello! Both AirVPN software for macOS, Eddie and Hummingbird, enforce Network Lock via pf rules, therefore nothing changes and leaks prevention stays as effective as usual even in macOS Big Sur. Kind regards

@zsam288 Thanks, fixed. Kind regards

Version 2.19.6 (Thu, 12 Nov 2020 13:01:54 +0000) [change] Windows 7/8: OpenVPN 2.5.0 in bundle [change] Absence of SSH or SSL log level from Warning to Info [bugfix] Fixed an elevation issue with sudo in CLI mode [bugfix] Windows: Error VCRUNTIME140_1.dll in some environment.

@mith_y2k Hello! You can simply re-start Hummingbird with the option you mention. Enjoy CHACHA20! Kind regards

@sooprtruffaut Hello! It is implemented already on all servers supporting CHACHA20-POLY1305 on Data Channel, i.e. all servers running OpenVPN 2.5. Please check the schedule in the first message. Kind regards

@mazeman23 Hello! OpenVPN 2.5_git you're running seems to not support data-ciphers, or the directive argument(s) is/are missing or illegal. Changing basic options on the run between beta , RC and stable versions seems not infrequent in OpenVPN development. Can you please re-check the OpenVPN version you're running? If it's really OpenVPN 2.5 stable, check the configuration file that Eddie generates (in "Stats" window double click the item pertaining to the generated OpenVPN profile), and examine the "data-ciphers" line (send the config to us as well if in doubt, cut certificates and keys). @harold.lewis "SSL not available" is what Eddie prints when it can't find stunnel (yes, it's a weird way to say it ). Kind regards

@dragoworld235 Hello! Yes, please open an issue in our git. Do you want to open an issue for OpenVPN3 main branch too because you see the very same problem with latest "OpenVPN for Android" when it is configured to work with OpenVPN3? Kind regards

@buthowcome Hello! Yes, correct: if your CPU and system support AES-NI, you will have higher performance with AES. Kind regards

@buthowcome Hello! We can't be sure and we can't rule it out. Try to switch to TCP and check whether performance improves or not. For the quick connection, open "Settings" > "AirVPN" > "Default protocol" and set it to "TCP". Then set "Quick connection mode" to "Use default options only". If you don't use quick connection, in order to force TCP on the server specific connections, tap the gearbox, open "Protocol" and select "TCP". Kind regards

@Bilru Hello! A month ago a long time customer of us from Egypt told us that protocol TCP to port 443 of entry-IP address three is the quickest way he found to bypass Egypt ISP blocks. Worth a try, probably that connection mode is still effective. It would save you the overhead caused by an additional tunnel. Kind regards

@dragoworld235 Hello! Changing Eddie to make it run OpenVPN 2 is a problematic matter, because OpeNVPN 2 is not a library, while OpenVPN3 is. By avoiding to run an external binary Eddie Android edition complies to security best practices as well as Google requirements in latest API. Anyway OpenVPN3-AirVPN library is not OpenVPN3. It's a fork which is 90 commits ahead of OpenVPN:master and had many important bugs fixed. An updated Eddie Android edition using our latest library version might be a Christmas present to you all, while you will see very soon an updated Hummingbird (which also calls OpenVPN3-AirVPN library) for Linux and macOS. Kind regards

@samaw80 Hello! We apologize for the inconvenience, which has been caused by Apple notarization. You can quickly resolve the issue by downloading and running Eddie 2.19.5. To do that, in Mac download page https://airvpn.org/macos click the button "Click here" just under the sentence: If you run older than macOS Catalina systems, please download latest Eddie 2.19 beta version You will be brought back to the download page, pointing to Eddie 2.19.5 and its specific notarization for systems older than Catalina. Kind regards

@sooprtruffaut Thank you! In which system do you need CHACHA20 for performance improvement? Kind regards

Hello! We're sorry, it's not yet implemented. You can already test CHACHA20 from Eddie Android edition and Hummingbird, anyway, not only from OpenVPN 2.5. If you have any issue please let us know. Kind regards

@Shiver Me Whiskers Hello! Yes, today Eddie 2.19.5 with wintun support for Windows was also released. 😎 Thank you, enjoy AirVPN! Kind regards