Staff

Hello!
 
We reluctantly have to announce gloomy news to you all: Spooky Halloween Deals are now available in AirVPN... 
 

 
Save up to 74% on AirVPN longer plans (*)
(*) When compared to 1 month plan price
Deal will expire on 2026-11-03 UTC  
Check all plans and discounts here: https://airvpn.org/plans

If you're already our customer and you wish to jump aboard for a longer period with this un-boo-lievable deal, any additional plan will be added on top of already existing subscriptions and you will not lose any day.

Every plan gives you all the features that made AirVPN a nightmare for snoopers and a scary service for competitors. Just check this frighteningly long list of terrific features if you dare:
a clear mission without compromises https://airvpn.org/mission exclusive and comfortable remote inbound port forwarding system flexible, opt-in block lists against malware and other hostile entities. Pick predefined lists, add exceptions or additional blocks, define your own lists, or just use our totally neutral DNS by default improved API functions to let you control and configure VPN features and account settings WireGuard integration AmneziaWG support in Eddie Android edition, with traffic mimicry of real websites (QUIC) to defeat DPI-based VPN blocking. This year our traffic wears a costume too: with AmneziaWG on Eddie Android, your connection goes trick-or-treating dressed up as an ordinary website, and DPI won't recognise who's behind the mask. Security-hardened Eddie Desktop edition Strong infrastructure growth: about 25% more total capacity in one year. Our servers grew by a ghastly 25% this year: more bandwidth to haunt the Internet at full speed. IPv6 support, including IPv6 over IPv4 and IPv4 over IPv6 refined load balancing to squeeze every last bit per second from VPN servers free and open source software for Android, Linux, Mac and Windows offering advanced features easy "Configuration Generator" web interface for access through third party software guaranteed minimum bandwidth allocation GDPR compliance and very high privacy protection standards no log and/or inspection of clients' traffic effective traffic leaks prevention by AirVPN software Tor support via AirVPN software on Linux, Mac and Windows various cryptocurrencies accepted without any intermediary no obligation to use our free and open source software to enter AirVPN infrastructure. Interoperability is an AirVPN priority. perfectly clear and easy to read Privacy Notice and Terms https://airvpn.org/privacy
No tricks, only treats!

We witch you a spooktacular Halloween
AirVPN Staff

@Nitrox

Hello!

Thank you for the report, it shows the cause. Your system has two Eddie tunnel adapters, "Eddie" and "Eddie 1". "Eddie 1" was left behind by an earlier session that did not close properly (the log starts with "Recovery. Unexpected crash?"): even after Eddie has disconnected, it is still up with a VPN address and it still holds the VPN routes 0.0.0.0/1 and 128.0.0.0/1.

When Eddie connects, the new tunnel itself works (the WireGuard handshake succeeds), but Windows answers that the VPN routes "already exist", so your traffic goes to the stale adapter instead of the new tunnel. The route check then times out, Eddie disconnects and tries the next server, which is the loop you see. After Eddie gives up, those leftover routes still capture all your traffic, which is why the internet stays blocked until you restart: the restart removes the stale adapter.

To fix it:

1. Close Eddie completely.
2. Restart Windows using Start > Power > Restart, not Shut down followed by powering on. With Windows Fast Startup enabled (the default), a shutdown does not fully reset the system, while Restart always does.
3. If the problem comes back, close Eddie, open Device Manager, select View > Show hidden devices, expand "Network adapters" and uninstall every "Eddie Tunnel" entry (for example "Eddie Tunnel" and "Eddie Tunnel #2"). Then restart Windows (Restart, as above) and start Eddie, which will create a new adapter when it connects.

If the problem persists after these steps, please attach a new system report generated right after a failed connection attempt, before closing Eddie or restarting Windows.

Kind regards

Hello!

Please ignore our previous message in this thread: it was meant for another topic. Deleted.

This error is caused by a bug of Eddie 2.26.2 (and earlier) on macOS. To check the application's integrity, Eddie stores a small file in the system folder /Library/PrivilegedHelperTools. On Macs where that folder does not exist yet, because no other application has created it, the file cannot be saved and Eddie refuses to start with exactly this message.

The bug is fixed in Eddie 2.27.2 beta. Please download it from here:
https://airvpn.org/forums/topic/81340-eddie-desktop-edition-227-beta-released/

Select the right package for your Mac (Apple Silicon or Intel), quit Eddie, copy the new Eddie into your Applications folder replacing the old one, then open it from Applications. Your settings are kept.

If the error still appears with 2.27.2, please post the complete message: this version also prints the reason of the failure in parentheses, which tells us what is going wrong.

Kind regards
 

@after_lunch

Hello!

Thank you for the complete report, it shows what is happening.

Your Wi-Fi adapter gets its DNS servers from your router: 194.168.4.100 and 194.168.8.100, which are your ISP's resolvers. Eddie 2.26.2 sets the AirVPN DNS (10.128.0.1) only on its own adapter, and in some circumstances its DNS leak protection fails to block queries sent to the resolvers of the other adapters. This is a known bug of 2.26.2, and your report matches it: Network Lock is active and the log says "DNS leak protection with packet filtering enabled", yet Windows still reaches your ISP's resolvers.

You can solve it in one of two ways:
1. Stay on 2.26.2 and apply a workaround: open Eddie's Preferences > DNS, enable "Force all network interfaces for DNS", save, then disconnect and reconnect.
OR
2. Upgrade to Eddie 2.27.2 beta, which contains the fix:
https://airvpn.org/forums/topic/81340-eddie-desktop-edition-227-beta-released/ 

Then repeat the test on ipleak.net while connected: only AirVPN DNS servers should be listed. If your ISP's resolvers still appear after the workaround, please switch to 2.27.2, and if they persist there too, post a new system report.

About hiding long text: the forum does not convert spoiler tags typed by hand. Use the Spoiler button in the editor toolbar and paste the text inside the box that appears, or simply attach the report as a .txt file. 

Kind regards
 

Hello!

For AirVPN WireGuard connections, the IPv4 gateway and DNS server address is 10.128.0.1. WireGuard uses a single IPv4 subnet, and this address remains the same regardless of which AirVPN server you connect to.

Please keep 10.128.0.1 as your DNS DNAT target. 10.4.0.1 is an OpenVPN DNS address, and its availability through some WireGuard connections should not be relied upon. Your observation that it works through a German endpoint does not change the address to use with WireGuard. The reported difference alone does not establish a DNS outage on Dutch servers.

You are also right about the documentation: our Specs page describes 10.4.0.1 as reachable from any virtual subnet without explicitly restricting that statement to OpenVPN. That wording is misleading for WireGuard users, and we apologize for the confusion. We will assess the situation and either clarify the Specs page or make 10.4.0.1 consistently reachable for DNS queries through WireGuard on all servers (not recommended anyway, see below).

In any case, we recommend using the VPN gateway address as the DNS server address, as AirVPN supports this configuration, with both OpenVPN and WireGuard. We recommend using 10.128.0.1 for WireGuard DNS and ensuring that DNS traffic can only leave through the VPN tunnel. Route-injection attacks on hostile networks can otherwise divert DNS queries outside the tunnel, exposing the requested domain names and potentially enabling forged DNS replies. This class of attack can also affect WireGuard deployments, depending on the operating system’s routing and firewall configuration.

For your OPNsense setup, redirect the selected clients’ DNS traffic, both UDP and TCP port 53, to 10.128.0.1, ensuring that the redirected traffic is routed through the WireGuard tunnel. Firewall rules should prevent those clients from falling back to WAN when the VPN is unavailable. Port 53 redirection alone does not control applications using DNS over HTTPS or DNS over TLS.

Your interpretation of the successful dig @10.4.0.1 test with DNAT targeting 10.128.0.1 is correct: it does not demonstrate that 10.4.0.1 itself answered.

Kind regards
 

@after_lunch

Hello!

Thank you for the complete report, it shows what is happening.

Your Wi-Fi adapter gets its DNS servers from your router: 194.168.4.100 and 194.168.8.100, which are your ISP's resolvers. Eddie 2.26.2 sets the AirVPN DNS (10.128.0.1) only on its own adapter, and in some circumstances its DNS leak protection fails to block queries sent to the resolvers of the other adapters. This is a known bug of 2.26.2, and your report matches it: Network Lock is active and the log says "DNS leak protection with packet filtering enabled", yet Windows still reaches your ISP's resolvers.

You can solve it in one of two ways:
1. Stay on 2.26.2 and apply a workaround: open Eddie's Preferences > DNS, enable "Force all network interfaces for DNS", save, then disconnect and reconnect.
OR
2. Upgrade to Eddie 2.27.2 beta, which contains the fix:
https://airvpn.org/forums/topic/81340-eddie-desktop-edition-227-beta-released/ 

Then repeat the test on ipleak.net while connected: only AirVPN DNS servers should be listed. If your ISP's resolvers still appear after the workaround, please switch to 2.27.2, and if they persist there too, post a new system report.

About hiding long text: the forum does not convert spoiler tags typed by hand. Use the Spoiler button in the editor toolbar and paste the text inside the box that appears, or simply attach the report as a .txt file. 

Kind regards
 

Hello!

The problem seems completely resolved.

Kind regards
 

Update: restrictions lifted

Hello!

The PHP project released the fixed versions earlier than scheduled, and we have installed them on every system of our infrastructure.

The temporary restrictions described above have now been removed: The forum is writable again: you can post new topics and replies, edit posts, upload attachments,date your profile. The support ticket area works normally: you can open new tickets and reply to existing ones from the website. Password recovery works again. The customer API (https://airvpn.org/api/) accepts multipart/form-data requests again. If you wrote to support@airvpn.org in the meantime, there is no need to open a ticket as well: we will answer you there. If any of the functions above still fails for you, please clear your browser cache and try again; if the
problem persists, open a ticket or write to support@airvpn.org.

VPN connections, Eddie and the AirVPN Suite were not affected at any time.

Thank you for your patience and understanding.

AirVPN Staff
 

Hello!

We're very glad to inform you that a new 10 Gbit/s full duplex server located in New York City, USA, is available: Hiisi.

The AirVPN client will show automatically the new server; if you use any other OpenVPN or WireGuard client you can generate all the files to access it through our configuration/certificates/key generator (menu "Client Area"->"Config generator").

The server accepts connections on ports 53, 80, 443, 1194, 2018 UDP and TCP for OpenVPN and ports 1637, 47107 and 51820 UDP for WireGuard.

Hiisi supports OpenVPN over SSL and OpenVPN over SSH, TLS 1.3, OpenVPN tls-crypt and WireGuard.
Full IPv6 support is included as well.

As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses.

You can check the status as usual in our real time servers monitor , by clicking the server name. Direct link: https://airvpn.org/servers/Hiisi

Do not hesitate to contact us for any information or issue.

Kind regards & datalove
AirVPN Staff
 

Photo by John Dillenbeck (Public Domain)
 

Update: restrictions lifted

Hello!

The PHP project released the fixed versions earlier than scheduled, and we have installed them on every system of our infrastructure.

The temporary restrictions described above have now been removed: The forum is writable again: you can post new topics and replies, edit posts, upload attachments,date your profile. The support ticket area works normally: you can open new tickets and reply to existing ones from the website. Password recovery works again. The customer API (https://airvpn.org/api/) accepts multipart/form-data requests again. If you wrote to support@airvpn.org in the meantime, there is no need to open a ticket as well: we will answer you there. If any of the functions above still fails for you, please clear your browser cache and try again; if the
problem persists, open a ticket or write to support@airvpn.org.

VPN connections, Eddie and the AirVPN Suite were not affected at any time.

Thank you for your patience and understanding.

AirVPN Staff
 

Hello!

We're very glad to inform you that a new 10 Gbit/s full duplex server located in New York City, USA, is available: Hiisi.

The AirVPN client will show automatically the new server; if you use any other OpenVPN or WireGuard client you can generate all the files to access it through our configuration/certificates/key generator (menu "Client Area"->"Config generator").

The server accepts connections on ports 53, 80, 443, 1194, 2018 UDP and TCP for OpenVPN and ports 1637, 47107 and 51820 UDP for WireGuard.

Hiisi supports OpenVPN over SSL and OpenVPN over SSH, TLS 1.3, OpenVPN tls-crypt and WireGuard.
Full IPv6 support is included as well.

As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses.

You can check the status as usual in our real time servers monitor , by clicking the server name. Direct link: https://airvpn.org/servers/Hiisi

Do not hesitate to contact us for any information or issue.

Kind regards & datalove
AirVPN Staff
 

Photo by John Dillenbeck (Public Domain)
 

Update: restrictions lifted

Hello!

The PHP project released the fixed versions earlier than scheduled, and we have installed them on every system of our infrastructure.

The temporary restrictions described above have now been removed: The forum is writable again: you can post new topics and replies, edit posts, upload attachments,date your profile. The support ticket area works normally: you can open new tickets and reply to existing ones from the website. Password recovery works again. The customer API (https://airvpn.org/api/) accepts multipart/form-data requests again. If you wrote to support@airvpn.org in the meantime, there is no need to open a ticket as well: we will answer you there. If any of the functions above still fails for you, please clear your browser cache and try again; if the
problem persists, open a ticket or write to support@airvpn.org.

VPN connections, Eddie and the AirVPN Suite were not affected at any time.

Thank you for your patience and understanding.

AirVPN Staff
 

Update: restrictions lifted

Hello!

The PHP project released the fixed versions earlier than scheduled, and we have installed them on every system of our infrastructure.

The temporary restrictions described above have now been removed: The forum is writable again: you can post new topics and replies, edit posts, upload attachments,date your profile. The support ticket area works normally: you can open new tickets and reply to existing ones from the website. Password recovery works again. The customer API (https://airvpn.org/api/) accepts multipart/form-data requests again. If you wrote to support@airvpn.org in the meantime, there is no need to open a ticket as well: we will answer you there. If any of the functions above still fails for you, please clear your browser cache and try again; if the
problem persists, open a ticket or write to support@airvpn.org.

VPN connections, Eddie and the AirVPN Suite were not affected at any time.

Thank you for your patience and understanding.

AirVPN Staff
 

Update: restrictions lifted

Hello!

The PHP project released the fixed versions earlier than scheduled, and we have installed them on every system of our infrastructure.

The temporary restrictions described above have now been removed: The forum is writable again: you can post new topics and replies, edit posts, upload attachments,date your profile. The support ticket area works normally: you can open new tickets and reply to existing ones from the website. Password recovery works again. The customer API (https://airvpn.org/api/) accepts multipart/form-data requests again. If you wrote to support@airvpn.org in the meantime, there is no need to open a ticket as well: we will answer you there. If any of the functions above still fails for you, please clear your browser cache and try again; if the
problem persists, open a ticket or write to support@airvpn.org.

VPN connections, Eddie and the AirVPN Suite were not affected at any time.

Thank you for your patience and understanding.

AirVPN Staff
 

Update: restrictions lifted

Hello!

The PHP project released the fixed versions earlier than scheduled, and we have installed them on every system of our infrastructure.

The temporary restrictions described above have now been removed: The forum is writable again: you can post new topics and replies, edit posts, upload attachments,date your profile. The support ticket area works normally: you can open new tickets and reply to existing ones from the website. Password recovery works again. The customer API (https://airvpn.org/api/) accepts multipart/form-data requests again. If you wrote to support@airvpn.org in the meantime, there is no need to open a ticket as well: we will answer you there. If any of the functions above still fails for you, please clear your browser cache and try again; if the
problem persists, open a ticket or write to support@airvpn.org.

VPN connections, Eddie and the AirVPN Suite were not affected at any time.

Thank you for your patience and understanding.

AirVPN Staff
 

Hello!
 
We reluctantly have to announce gloomy news to you all: Spooky Halloween Deals are now available in AirVPN... 
 

 
Save up to 74% on AirVPN longer plans (*)
(*) When compared to 1 month plan price
Deal will expire on 2026-11-03 UTC  
Check all plans and discounts here: https://airvpn.org/plans

If you're already our customer and you wish to jump aboard for a longer period with this un-boo-lievable deal, any additional plan will be added on top of already existing subscriptions and you will not lose any day.

Every plan gives you all the features that made AirVPN a nightmare for snoopers and a scary service for competitors. Just check this frighteningly long list of terrific features if you dare:
a clear mission without compromises https://airvpn.org/mission exclusive and comfortable remote inbound port forwarding system flexible, opt-in block lists against malware and other hostile entities. Pick predefined lists, add exceptions or additional blocks, define your own lists, or just use our totally neutral DNS by default improved API functions to let you control and configure VPN features and account settings WireGuard integration AmneziaWG support in Eddie Android edition, with traffic mimicry of real websites (QUIC) to defeat DPI-based VPN blocking. This year our traffic wears a costume too: with AmneziaWG on Eddie Android, your connection goes trick-or-treating dressed up as an ordinary website, and DPI won't recognise who's behind the mask. Security-hardened Eddie Desktop edition Strong infrastructure growth: about 25% more total capacity in one year. Our servers grew by a ghastly 25% this year: more bandwidth to haunt the Internet at full speed. IPv6 support, including IPv6 over IPv4 and IPv4 over IPv6 refined load balancing to squeeze every last bit per second from VPN servers free and open source software for Android, Linux, Mac and Windows offering advanced features easy "Configuration Generator" web interface for access through third party software guaranteed minimum bandwidth allocation GDPR compliance and very high privacy protection standards no log and/or inspection of clients' traffic effective traffic leaks prevention by AirVPN software Tor support via AirVPN software on Linux, Mac and Windows various cryptocurrencies accepted without any intermediary no obligation to use our free and open source software to enter AirVPN infrastructure. Interoperability is an AirVPN priority. perfectly clear and easy to read Privacy Notice and Terms https://airvpn.org/privacy
No tricks, only treats!

We witch you a spooktacular Halloween
AirVPN Staff

Hello!

We're very glad to inform you that a new 10 Gbit/s full duplex server located in New York City, USA, is available: Hiisi.

The AirVPN client will show automatically the new server; if you use any other OpenVPN or WireGuard client you can generate all the files to access it through our configuration/certificates/key generator (menu "Client Area"->"Config generator").

The server accepts connections on ports 53, 80, 443, 1194, 2018 UDP and TCP for OpenVPN and ports 1637, 47107 and 51820 UDP for WireGuard.

Hiisi supports OpenVPN over SSL and OpenVPN over SSH, TLS 1.3, OpenVPN tls-crypt and WireGuard.
Full IPv6 support is included as well.

As usual no traffic limits, no logs, no discrimination on protocols and hardened security against various attacks with separate entry and exit-IP addresses.

You can check the status as usual in our real time servers monitor , by clicking the server name. Direct link: https://airvpn.org/servers/Hiisi

Do not hesitate to contact us for any information or issue.

Kind regards & datalove
AirVPN Staff
 

Photo by John Dillenbeck (Public Domain)
 

@gtrman

Hello!

Thank you for the detailed list of checks. The error comes from a security check in Eddie, not from netsh.exe itself. Eddie runs netsh.exe and other Windows tools with administrator privileges, so before running them it verifies that neither the executable nor its folder can be modified by an account other than SYSTEM, Administrators or TrustedInstaller. Otherwise a non-administrator could replace the tool and have it run with elevated privileges.

The empty text after "not allowed:" in your screenshot indicates that netsh.exe itself passed the check, but its folder, C:\Windows\System32, did not: some other account is allowed to create files in it. This is not the default Windows configuration. It is usually left behind by a "take ownership" or "grant full access" tweak or tool applied to system folders in the past. This also explains why sfc, DISM and reinstalling Eddie, portable or installer, did not help: they do not reset the permissions of the System32 folder.

To confirm, please open a Command Prompt and run the following command. It only displays the permissions and does not change anything:
  icacls "%SystemRoot%\System32"
Then post the output here. If you prefer, you can replace your computer name and user name with placeholders, but please leave the rest unchanged. On a default installation only NT SERVICE\TrustedInstaller, NT AUTHORITY\SYSTEM and BUILTIN\Administrators can write to that folder. An additional entry with (F), (M), (W) or (WD) for your user account, Users, Authenticated Users or Everyone is the likely cause.

Please do not take ownership of System32 or change its permissions recursively in the meantime. Once we see the output, we will tell you how to remove only the extra entry.

Kind regards
 

@gtrman

Hello!

Thank you, the output confirms the cause. This is the entry that blocks Eddie:
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(F)
It gives Full control of System32 to every Store (UWP) app on the system. On a default installation this group can only read and execute files in System32. The other entries do not need to be changed for Eddie.

Please open a Command Prompt as administrator (right-click Command Prompt, then "Run as administrator") and run the following commands.
1. Save a backup of the current permissions of the folder: icacls "%SystemRoot%\System32" /save "%USERPROFILE%\system32-acl-backup.txt" 2. Replace the Full control entry with the default read and execute permission: icacls "%SystemRoot%\System32" /grant:r "*S-1-15-2-1:(OI)(CI)(RX)" S-1-15-2-1 is the fixed identifier of ALL APPLICATION PACKAGES, so the command works with any Windows language. Please do not simply remove the entry: Store apps, including parts of the Start menu and Settings, need read access to System32. Windows also applies the change to the files and subfolders that inherit from System32, so the command may take a minute. Wait until it reports "Successfully processed 1 files".

3. Run icacls "%SystemRoot%\System32" again. The ALL APPLICATION PACKAGES line should now end with (OI)(CI)(RX). Then start Eddie.

If Eddie still shows the same error, please open system32-acl-backup.txt in your user folder with Notepad and post its content here. It is a single line that shows the exact permission values, which the normal icacls output does not show. If you ever need to undo the change, this command restores the saved permissions: icacls "%SystemRoot%" /restore "%USERPROFILE%\system32-acl-backup.txt"
Eddie does not check wuauclt.exe and wuaueng.dll, so the ownership change on those two files is not related to this error. And when you move to Linux, Eddie is available there as well.

Kind regards
 

@gtrman

Hello!

Thank you, the backup file shows the remaining cause. The backup was saved before step 2, so it still shows the old ALL APPLICATION PACKAGES entry (AC) with FA; that is expected.
The second entry that blocks Eddie is this one:
(A;OICIIO;FA;;;CO)

It is the CREATOR OWNER entry, which the normal icacls output shows as CREATOR OWNER:(OI)(CI)(IO)(F). On a default installation it is stored as (A;OICIIO;GA;;;CO). GA (generic all) and FA (explicit full access) grant the same permissions in practice, but Eddie's check reads the stored value as it is: it accepts GA and rejects FA. Because icacls displays both as (F), the difference was not visible in the first output. This entry does not give anyone access to System32 itself, only to files created there later, and only for their owner. Eddie's check does not make this distinction yet, and we will report it to the developers.

Please open a Command Prompt as administrator again and run the following commands.
1. Save a backup of the current permissions: icacls "%SystemRoot%\System32" /save "%USERPROFILE%\system32-acl-backup2.txt"
2. Store the CREATOR OWNER entry in its default form: icacls "%SystemRoot%\System32" /grant:r "*S-1-3-0:(OI)(CI)(IO)(GA)" S-1-3-0 is the fixed identifier of CREATOR OWNER, so the command works with any Windows language. As before, it may take a minute; wait until it reports "Successfully processed 1 files".

3. Save the new permissions to a second file, to check them:Open icacls "%SystemRoot%\System32" /save "%USERPROFILE%\system32-acl-check.txt" system32-acl-check.txt with your favorite text editor. It should contain (A;OICIIO;GA;;;CO) and (A;OICI;0x1200a9;;;AC), and no entry ending with FA;;;CO or FA;;;AC.

Then start Eddie. If it still shows the same error, please post the content of system32-acl-check.txt here.

To undo only today's change, you can run: icacls "%SystemRoot%" /restore "%USERPROFILE%\system32-acl-backup2.txt"
Kind regards
 

Been a happy member for about 5 years! Thank you for reliable and private service! You guys are a godsend!!! 😁

Hi AirVPN team,
First of all, congratulations on the excellent service and on remaining a truly independent VPN, still faithful to its original values. That is becoming increasingly rare and deserves to be appreciated.
The current three-year offer is great!
But since some of us are planning to stay aboard for a very long time, how about a five-year package with an extra-special discount for your most loyal customers?
Then I could pay now and not think about renewing again until after 2030! :-)
Just asking on behalf of the AirVPN faithful… you never know!
Thanks again for the excellent service. Keep up the great work!
Kind regards & datalove
 

That would be great. Even a 10 year plan 😂
  You could do that even now. Just stack up the subscription. 
  I agree. Thank you devs!

Thank AirVPN team for cheap, stable VPN, another 3 years from me 😉

New here, just got my subscription. Thank you!