Staff

That's not a problem with the Privacy Notice... that article deliberately reported false data for reasons that are not worth the time to be investigated, and not only about us (you can easily cross-check other false claims in that table). Note also how the table is a picture, to avoid indexing by search engines.
 
Kind regards

Hello,

this is a guide to prevent ANY leak on Windows 7/8 with Windows Firewall published by Omniferum. It is particularly simple to follow and well written, and it provides also a very comfortable "VPN flipper". Thank you Omniferum!
 
Warning: the setup works on Windows 7 and Windows 8 with the default Windows Firewall. It has NOT been tested on any other Windows version. It will NOT work on Windows XP (whose firewall is completely different and very limited, Windows XP users might like to use Comodo Firewall). It is NOT suitable if you have any other firewall running on your system (remember, you must never run two firewalls simultaneously).
 
Important: the VPN flipper script will NOT work if your Windows is not in English language, because the system Firewall rules names change (incredible but true!) according to the language (thanks to Esamu for the information). UPDATE 14-May-14: issue fixed.
 
 
Original thread updated on May the 14th, 2014:
https://airvpn.org/topic/9609-blocking-non-vpn-traffic-with-windows-firewall
 
Kind regards

UPDATE 01-SEP-17 Due to multiple, critical  problems in network-manager-openvpn which after years have not been solved we recommend to NOT use it. Please understand that we will not provide support to network-manager-openvpn. In GNU/Linux we recommend that you run our free and open source software "AirVPN Suite", "Eddie" or OpenVPN directly
 
 
Warning: Ubuntu 14.04 has an issue on configuration files import. At 25/04/2014 there's still no fix. Bug Report Go to Config Generator page, choose Linux and choose your preferred options. Select Advanced Mode Tick Separate certs/keys from .ovpn files
Click on any archive format. Save the downloaded archive file somewhere, say in ~/.airvpn. Extract it. Five files should be extracted. Try to make sure nobody but you can read the file user.key, because that one is secret. Install the package named network-manager-openvpn-gnome, which is a plugin to NetworkManager handling OpenVPN connections. The install will automatically include all needed packages, like openvpn etc. Click on NetworkManager icon in top-right bar, and choose Edit Connections...
Click Add, choose Import a saved VPN configuration, click Create... and choose a .ovpn file extracted from files generated by our Config Generator.
The imported information is displayed. Click Save... and close the NetworkManager Connections editor.
From now on, the imported connections are showed under VPN Connections menu. Click it to connect.

A refreshed guide is available here:


Prerequisite
 
Install DD-WRT on router go to https://www.dd-wrt.com/ Select "router database", then enter you router model number. Follow the instructions as described and install the DD-WRT *vpn*.bin.

Steps Create configuration files from our Config Generator.
Select the server location and port you want to connect to, tick "Advanced Mode", tick "Separate certs/keys from .ovpn file", then generate and download the configuration files. Under the router "setup tab" locate your router's local IP address.
Go to Specs page of AirVPN website and locate Air VPN DNS for the server you want to connect to, and enter it under Static DNS 1.
Navigate to the "Services" tab then select the "VPN" tab. Select "Enable" under OpenVPN Client. Set the Server IP/Name and Port to the Air VPN server you selected (see here to determine VPN server entry-IP address: https://airvpn.org/topic/14378-how-can-i-get-vpn-servers-entry-ip-addresses ). Set Tunnel Device to "TUN" Set Tunnel Protocol to either "UDP" or "TCP" according to the Air VPN server you selected Set Encryption Cipher to " AES-256" Set Hash Algorithm to "SHA1" Put a check mark beside "nsCertType verification" Select "Enable" Advanced Options Select "Enable" LZO Compression Select "Enable" NAT Set Local IP Address to the router's local IP address found earlier. Set TLS Cipher to "TLS-DHE-RSA-WITH-AES-256-GCM-SHA384" or "None"
Unzip the AirVPN configuration file you downloaded. Using your favorite text editor
- Open up "ca.crt" and copy all of the contents into the CA Cert window.
- Open up "user.crt" and copy only and including "----- BEGIN CERTIFICATE----- to the end of ----- END CERTIFICATE----- " into Public Client Cert.
- Open up "user.key" and copy all of the contents into Private Client Key.
- Open up "ta.key" and copy all of the contents into TLS Auth Key Select "Save" at the bottom of the page then "Apply Setting"
Select "Save" at the bottom of the page then "Apply Setting" DD-WRT firewall rules
Go to "Administration" tab then select the "Commands" tab. Copy the following firewall rules into the command window (IMPORTANT: check your tun interface name and set it accordingly - some firmware builds will have tun1 and not tun0)
  iptables -I FORWARD -i br0 -o tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o br0 -j ACCEPT iptables -I INPUT -i tun0 -j REJECT iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE Click on "Save Firewall" Verification of VPN setup
Go to https://airvpn.org and at the bottom of the screen it should show you are connected.



Trouble Shooting

If you're not shown as connected wait a minute then refresh the web (it could take a minute to make a connection with the VPN and log in).
 
Go to DD-WRT configuration and navigate to the "Services" tab, then "VPN" tab. Once there go to the bottom of the page and click on "Apply Settings". Once completed wait a minute and verify your connection again.
If you're still not connected verify the server status you're trying to connect to. Go to Air VPN website and log in, then navigate to "Support" and select "Server Status". If server is down reconfigure DD-WRT to connect to another server.
If you are still have difficulties connecting, view the OpenVPN log file in DD-WRT. You can find the log by going to DD-WRT configuration and navigating to the "Status" tab and selecting "OpenVpn". Hopefully the log will give you some indication of why you can not connect.
 

Still having issues

Contact Air VPN support, they are quick at responding back to you and very knowledgeable. Another option is to ask on the Air VPN forums.

Hello,

this is a guide to prevent ANY leak on Windows 7/8 with Windows Firewall published by Omniferum. It is particularly simple to follow and well written, and it provides also a very comfortable "VPN flipper". Thank you Omniferum!
 
Warning: the setup works on Windows 7 and Windows 8 with the default Windows Firewall. It has NOT been tested on any other Windows version. It will NOT work on Windows XP (whose firewall is completely different and very limited, Windows XP users might like to use Comodo Firewall). It is NOT suitable if you have any other firewall running on your system (remember, you must never run two firewalls simultaneously).
 
Important: the VPN flipper script will NOT work if your Windows is not in English language, because the system Firewall rules names change (incredible but true!) according to the language (thanks to Esamu for the information). UPDATE 14-May-14: issue fixed.
 
 
Original thread updated on May the 14th, 2014:
https://airvpn.org/topic/9609-blocking-non-vpn-traffic-with-windows-firewall
 
Kind regards

NOTE: if you run Eddie or Hummingbird you don't need this guide, but you might need to get rid of update-systemd-resolved which, in one of its various working modes, can interfere fatally with DNS handling.

This post describes how to accept OpenVPN servers DNS push on Linux, OpenBSD, FreeBSD and some other POSIX-compliant OS when:
resolvconf package OR openresolv package is installed OpenVPN is run directly (i.e. NOT through any OpenVPN GUI/wrapper such as network-manager) OpenVPN version is 2.1 or higher Warning: the specified "update-resolv-conf" script path refers to many Linux distributions and OpenVPN package installation, but NOT to all of them. Please check the correct path of the mentioned file before proceeding (for example: it could be /usr/share/openvpn instead of /etc/openvpn). If the script is not on your system, you'll need to create it. See the typical script here: https://wiki.archlinux.org/index.php/OpenVPN#DNS
 
Important: in the same above linked page, note that if you have a system based on systemd you might need some important modifications:
 
Add to your OpenVPN configuration file(s), either in field "Custom Directives" of the Configuration Generator or by editing the configuration directly, the following lines:
script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf  
In this way update-resolv-conf will record the DNS push and through resolvconf or openresolv will modify the nameserver accordingly. When OpenVPN quits, update-resolv-conf restores the previous nameserver line(s).

Kind regards

A refreshed guide is available here:


Prerequisite
 
Install DD-WRT on router go to https://www.dd-wrt.com/ Select "router database", then enter you router model number. Follow the instructions as described and install the DD-WRT *vpn*.bin.

Steps Create configuration files from our Config Generator.
Select the server location and port you want to connect to, tick "Advanced Mode", tick "Separate certs/keys from .ovpn file", then generate and download the configuration files. Under the router "setup tab" locate your router's local IP address.
Go to Specs page of AirVPN website and locate Air VPN DNS for the server you want to connect to, and enter it under Static DNS 1.
Navigate to the "Services" tab then select the "VPN" tab. Select "Enable" under OpenVPN Client. Set the Server IP/Name and Port to the Air VPN server you selected (see here to determine VPN server entry-IP address: https://airvpn.org/topic/14378-how-can-i-get-vpn-servers-entry-ip-addresses ). Set Tunnel Device to "TUN" Set Tunnel Protocol to either "UDP" or "TCP" according to the Air VPN server you selected Set Encryption Cipher to " AES-256" Set Hash Algorithm to "SHA1" Put a check mark beside "nsCertType verification" Select "Enable" Advanced Options Select "Enable" LZO Compression Select "Enable" NAT Set Local IP Address to the router's local IP address found earlier. Set TLS Cipher to "TLS-DHE-RSA-WITH-AES-256-GCM-SHA384" or "None"
Unzip the AirVPN configuration file you downloaded. Using your favorite text editor
- Open up "ca.crt" and copy all of the contents into the CA Cert window.
- Open up "user.crt" and copy only and including "----- BEGIN CERTIFICATE----- to the end of ----- END CERTIFICATE----- " into Public Client Cert.
- Open up "user.key" and copy all of the contents into Private Client Key.
- Open up "ta.key" and copy all of the contents into TLS Auth Key Select "Save" at the bottom of the page then "Apply Setting"
Select "Save" at the bottom of the page then "Apply Setting" DD-WRT firewall rules
Go to "Administration" tab then select the "Commands" tab. Copy the following firewall rules into the command window (IMPORTANT: check your tun interface name and set it accordingly - some firmware builds will have tun1 and not tun0)
  iptables -I FORWARD -i br0 -o tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o br0 -j ACCEPT iptables -I INPUT -i tun0 -j REJECT iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE Click on "Save Firewall" Verification of VPN setup
Go to https://airvpn.org and at the bottom of the screen it should show you are connected.



Trouble Shooting

If you're not shown as connected wait a minute then refresh the web (it could take a minute to make a connection with the VPN and log in).
 
Go to DD-WRT configuration and navigate to the "Services" tab, then "VPN" tab. Once there go to the bottom of the page and click on "Apply Settings". Once completed wait a minute and verify your connection again.
If you're still not connected verify the server status you're trying to connect to. Go to Air VPN website and log in, then navigate to "Support" and select "Server Status". If server is down reconfigure DD-WRT to connect to another server.
If you are still have difficulties connecting, view the OpenVPN log file in DD-WRT. You can find the log by going to DD-WRT configuration and navigating to the "Status" tab and selecting "OpenVpn". Hopefully the log will give you some indication of why you can not connect.
 

Still having issues

Contact Air VPN support, they are quick at responding back to you and very knowledgeable. Another option is to ask on the Air VPN forums.

What is the difference between protocols?

UDP is a connectionless protocol, so during the handshake it is not always possible to do an effective error correction. As a result, when there's high ping or low quality line during the OpenVPN login, the handshake may fail, although you could see no significant problem after (if) the connection is established.
TCP is capable of handling these problems.

On the other hand, UDP is more efficient once the connection is established. OpenVPN also implements a basic packets error correction even in UDP (only after the tunnel is established).

If you experience problems with VoIP video/audio conversations when connected to the VPN through a TCP port, a typical case for which a difference may be visible (VoIP over TCP - for example UDP over TCP -  is clearly inferior to VoIP over UDP because TCP implements ARQ, UDP does not), then go for an UDP connection.

In general, you should always try an UDP connection if your ISP allows it and you don't experience any problem during the handshake.
However, TCP is mandatory if you need a proxy to reach the Internet. VPN over TOR connections require a TCP connection.

Variety of ports (53, 80, 443) is an additional option to try to bypass country or ISPs blocks, or bandwidth management. When OpenVPN connections are disrupted by your ISP (this happens for sure in China and Iran) then you need OpenVPN over SSL or OpenVPN over SSH supported by every AirVPN server and requiring, again, TCP.

You provide Remote Port Forwarding, what is it?
 
"Remote port forwarding" forwards traffic coming from the Internet to our VPN server ports to a specified local port of your client.

By default, your account has no forwarded ports, and this is good as long as you don't wish to have a service reachable from the Internet. For example, suppose that you want to run a web server behind our VPN, or that you wish to receive incoming connections to your BitTorrent client in order to improve p2p performance, or to seed a file. Without at least one remotely forwarded port, your service could not be reached from the outside, because our VPN server would reject the proper packets to your service.

Usually this is a good security measure against attacks, but it prevents your services to be reached from the Internet.

When you remotely forward an inbound port, our servers will open that port (TCP, UDP or both, according to your selection) and will properly forward incoming packets to you on that port. The service will be reachable from the exit-IP address of the VPN server your system is connected to.

You can forward up to 20 ports simultaneously. You can do that on our website, in your account "Client Area". You can't forward ports lower than 2048.

You can map a remotely forwarded port to a different local port: this is useful for a variety of cases, for example when your service listens to a port lower than 2048 or when the port is already reserved. More details about it here below.

Once you reserve an inbound remote port for your account, you have two options:

1) Leave the "Local" field empty. In this case, packets arriving to the VPN server exit-IP address port n will be forwarded to your machine IP address inbound local port with the very same number n

2) Fill in the "Local" field with a different port number x. In this case packets arriving to port n will be forwarded to your system inbound local port x.

In both cases you need to reach the service on the VPN server exit-IP address port n.


IMPORTANT: do NOT forward on your router the same ports you use on your listening services while connected to the VPN. Doing so exposes your system to correlation attacks and potentially causes unencrypted packets to be sent outside the tunnel from your client. However, if you connect a router (for example DD-WRT, Tomato based firmware router) an additional step is required, please see https://airvpn.org/topic/9270-how-to-forward-ports-in-dd-wrt-tomato-with-iptables/  
NOTE: you can't reach your listening service(s) through the VPN server exit-IP address from the very same machine that's running it/them and is connected to a VPN server, or from any other machine connected to that same VPN server.

Hello!
 
Possible explanation (without logs, only speculation is possible): if DNS in OS X are set manually, Tunnelblick does not accept the DNS push from the VPN server. As a result, you might still be using your ISP DNS, which are poisoned according to your description.
 
Our free and open source client Eddie has a much more advanced DNS handling, can you please test it and report back at your convenience? Eddie for OS X is available in the usual OS X page https://airvpn.org/macosx
 
The fact that you see in the central bottom box "Not connected" when you browse to airvpn.org, though, is a symptom of a much deeper problem: the traffic might be not tunneled at all. Again, our client Eddie performs various checks to warn you if there are problems with tunneling, and also features a "Network Lock" option which will prevent any leak.
 
Kind regards

Hello!
 
We're very glad to announce that we support the TorProject Open Observatory of Network Interference:
https://ooni.torproject.org

Our support includes, since July 2015 up to June 2016, monetary funding to aid project financial sustainability. See also https://airvpn.org/mission

Furthermore, we are sponsoring an important OONI event, Adina15 hackathon, which will be held in Rome on October the 1st and 2nd, 2015.
https://ooni.torproject.org/event/adina15
 
We'll be gladly providing all the awards and prizes to participants and winners of the Adina15 event.

Members of the AirVPN team will attend the event.
 
EDIT 27-SEP-15 - Only today it has been announced that the Adina15 hackathon event has been postponed to unknown date. https://lists.torproject.org/pipermail/ooni-dev/2015-September/000340.html
This decision is obviously outside our control (we sponsor the event, we have no role in its organization) and we regret it very much.

Kind regards and datalove
AirVPN Staff

Website: http://www.vvvvid.it
Italian TV Streaming

Status: OK
Routing: All servers to IT route.

Website: http://www.marcopolo.tv/
Italian TV Streaming
 
Status: OK
Routing: All servers to IT route.

Website: http://www.cbc.ca
Official CBC television site for Canada
 
Status: OK
Native: CA servers.
Routing: All other servers.

 

Website: http://www.mtv.it
 
Italian website and streaming TV

Status: OK
Routing: All servers to IT route.
 

@WinniethePooh

Hello!

There's a clear legal framework in the EU which covers duties and rights of a provider of services in the information society which is a mere conduit of data (see 2000/31/EC articles 12, 13, 14 and 15). Amongst them, there's no obligation to monitor customers traffic (on the contrary, 95/46/EC and 2002/58/EC pose precise prohibition to data monitoring and collection). We don't keep logs so we can't give away information that we do not have.

A court order can't force us to monitor traffic: even if it did, it would not be valid: no court order can force a person to commit illegal actions, as it would be active traffic monitoring, which infringes important privacy laws, secrecy of correspondence and fundamental rights. But let's admit that a collective madness suddenly infect a magistrate and all of AirVPN staff. Even if we complied to a flawed court order our data would have no relevance in a court, because there is absolutely no guarantee of their reliability and/or no manipulation, not to mention guarantees about server integrity. Your premise that we could be forced to actively cooperate with proper authorities in monitoring traffic is simply absurd, under an investigative point of view, because such cooperation would destroy the validity of the investigation itself.

That said, this admin disagrees strongly with some other premises of yours as well, for example you surreptitiously suggest that most VPN users are criminals. Do you have any data to support that? Are you aware that privacy is one of the most fundamental human rights? Do you have any scientific set of data which may support the implication that strong privacy leads to criminal behaviors? We do have scientific research and factual evidence which show, in the contrary, how strong privacy and identity protections enhance freedom of expression.

Finally, if you feel that you must face an adversary with the power to monitor all our servers in real time, you should perform partition of trust. We wrote an article about it:
https://airvpn.org/index.php?option=com_kunena&func=view&catid=3&id=54&limit=6&limitstart=6&Itemid=142#1745

Kind regards

http://www.wilmaa.com

For the best streaming television that Switzerland has to offer, there’s but one name, and that name is wilmaa.

Status: OK
Native: CH servers.
Routing: All other servers.

Website: http://www.mtv.it
 
Italian website and streaming TV

Status: OK
Routing: All servers to IT route.
 

Website: http://www.realtimetv.it
 
Italian streaming TV

Status: OK
Routing: All servers to IT route.
 
 

Website: http://www.vvvvid.it
Italian TV Streaming

Status: OK
Routing: All servers to IT route.

Why do I have to pay transaction fees on Bitcoin transfers? Why do I get the message "This transaction is over the size limit. You can still send it for a fee of 0.0005 BTC"?

For transactions which draw coins from many bitcoin addresses and therefore have a large data size, a small transaction fee is usually expected. The transaction fee is an incentive on the part of the bitcoin user to make sure that a particular transaction will get included into the next block which is generated. See also https://en.bitcoin.it/wiki/Transaction_fees

Website: http://www.leonardo.tv/
Italian TV Streaming
 
Status: OK
Routing: All servers to IT route.

Website: http://www.vvvvid.it
Italian TV Streaming

Status: OK
Routing: All servers to IT route.

Website: http://www.deezer.com/
Deezer is a web-based music streaming service. It allows users to listen to music on various devices online or offline.
 
Status: OK
Native: All server except US and NL
Routing: US and NL, to FR route.

Why do I have to pay transaction fees on Bitcoin transfers? Why do I get the message "This transaction is over the size limit. You can still send it for a fee of 0.0005 BTC"?

For transactions which draw coins from many bitcoin addresses and therefore have a large data size, a small transaction fee is usually expected. The transaction fee is an incentive on the part of the bitcoin user to make sure that a particular transaction will get included into the next block which is generated. See also https://en.bitcoin.it/wiki/Transaction_fees