Search the Community

Hello! I am trying to host dedicated game servers and would love to not have my actual IP exposed, I've read some guides and other topics with similar issues from what I am experiencing and neither of them seem to be the case for me. I currently have AirVPN on my Router (OpenWrt), I have port forwarded the ports on my router (using the external zone that is the tunnel instead of WAN- because I read that from "How to forward ports in DD-WRT & Tomato with iptables") Which assumes that I can't use the GUI to change the external zone from other than WAN. Yes- I have the port in the External + Internal port, its not shown in the screenshot but it is there. -- My firewall is allowing applications and services that I use to host the game server (in this case java/javaw) and I am using the IP the server detects (Its the public server IP [198.XXX.XXX.XXX] rather than client virtual IP [10.XXX.XXX.XXX]). I tried using the client virtual IP, but the software I use to host my minecraft server (MCSS) throws an error saying it wasn't able to bind to that port and suggests another server is using that port which is not the case on my end at least. When checking the ports to see if they are open, TCP gets a connection timed out (110). UDP is fine. I checked other forums/topics on this issue and I read through and tested their (potential) solutions and I have yet to get one that works for me. I am fully able to connect to other games and services just fine (as well as other minecraft servers), but when I try to host it, nothing seems to prevail. I believe this is as much info I can give on this- if there is anything I can do on my end to help troubleshoot this, please feel free to inform me and I'll try my best. Much appreciated in advance <3

@0range Hello! The option you used on LineageOS is a LineageOS addition, not a feature of stock Android. On stock Android, and on systems based on it such as HyperOS, a VPN app works through the Android VpnService API, which applies the VPN only to traffic generated by apps running on the phone itself. Traffic coming from tethered devices (Wi-Fi hotspot, USB or Bluetooth) is forwarded by the system directly to the mobile data connection and never enters the VPN interface. Changing that routing requires root, so no VPN app can do it on a non-rooted phone. We are not aware of an equivalent setting in HyperOS. Please note that this means that, while the VPN is connected on the phone, the devices connected to its hotspot are NOT protected: their traffic goes out with the IP address of your mobile operator. Possible solutions without root: 1. Run AirVPN on each device. Eddie is available for Windows, macOS, Linux and Android, and you can also use OpenVPN or WireGuard configuration files generated by our Config Generator. Connect the devices to the phone hotspot as usual, then connect each of them to AirVPN. Your account allows up to 5 simultaneous connections. This is the recommended solution, because every device gets full protection. 2. Use a travel router with a VPN client (for example an OpenWrt based router running WireGuard) connected to the phone through Wi-Fi or USB tethering, and connect your devices to the router. All the devices behind the router then share a single VPN connection. Kind regards

The exit IP is not assigned to any local interface, so bind the Minecraft server to the LAN IP of the hosting machine (or 0.0.0.0) instead of the 198.x exit address, since the router's port forward DNATs inbound tunnel traffic to your LAN host. Make sure the OpenWrt forward runs from your VPN tunnel zone to LAN for both TCP and UDP, and that the matching port forward exists in the AirVPN client area. Since UDP is fine but TCP times out, also confirm the hosting machine's return traffic goes back out through the tunnel, because if replies leave via WAN the TCP handshake can never complete.

Hi all, I have an older synology 1511+ under DSM 6.2 and use the synocommunity version of deluge (docker is beyond my tech skills, tried and failed a few times). When no vpn is connected in the network tab of the control panel i get my usual speeds around 30Mo/s (240mbps) but then when vpn is connected i can't for my life get over 6Mo/sec (48mbps). Could someone please review what i did and hit me on the head with some advice ? Setup : I set up the openvpn through that guidemaking sure i use a low charge server (tried 1 server, country and region without noticeable change) I opened a port on the air vpn website and reported it in deluge as describded in multiple forum threads unchecking lots of previously checked boxes

Having the VPN handled in a home router (running OpenWRT for example) could be a solution not involving an outdated OS.

The reason there is leakage is that you'retch not NAT'ing the traffic from the Synology to AirVPN. My suggestion is to do the following: For the purposes of this guide, I'll call whatever device you're using to access the OpenWRT Web Interface as "laptop", but in reality, it can be a desktop, smartphone, tablet, or anything else with a web browser. (Topmost Menu is the Black Bar of OpenWRT LUCI, which has, by default: OpenWRT, Status, System, Network,Tools): 1. Reset your OpenWRT router to default settings(but the firmware should still be OpenWRT, not the stock firmware). 2.For now, Just plug your laptop into a LAN port so you can configure the router according to the next steps here and the WAN port to your pre-existing network, so that you can install Wireguard . 3. Install the OpenWRT Package for Wireguard 4. Download the AirVPN config file you want to use onto your laptop. 5. Disconnect the router from your pre-existing network that was attached via the WAN port, but leave your laptop plugged in. From here on out, you will not have internet access as you're configuring the OpenWRT router, but you will regain it later at the step where I tell you to reattach the cable from the network to your OpenWRT. You MUST do this, else the next step will fail. DO NOT plug your pre-existing network into any hole on the OpenWRT till you reach the step where I tell you to do so. 4. !!!VERY IMPORTANT!!! PLEASE READ THIS STEP IN FULL, INCLUDING THE EXPLANATION AT THE END Go to Network>Switch and assign 1 port to VLAN 1(We'll use this for LAN) and VLAN 2(We'll use this for your NAS). To assign a router port to a VLAN, within a single row, select "untagged" for the port you want to assign to the VLAN, "off" for very other port, and "tagged" for CPU(eth0). Your table can look like this(I'm going to write it out in JSON-style, where a JSON single object is a table row, the key is a column header, and the value is either what you write in the empty box or select from a dropdown in the empty box. I'm doing this because actually recreating a table in text is more challenging than I'd like) {VLAN ID:1, Description:"", CPU(eth0): tagged, LAN 1: untagged, LAN 2: untagged, LAN 3: off, LAN 4: off, WAN: off }, {VLAN ID:2, Description:"", CPU(eth0): tagged, LAN 1: off, LAN 2: off, LAN 3: off, LAN 4: off, WAN: untagged }, {VLAN ID:3, Description:"For NewLAN", CPU(eth0): tagged, LAN 1: off, LAN 2: off, LAN 3: untagged, LAN 4: off, WAN: off }, {VLAN ID:4, Description:"For NAS", CPU(eth0): tagged, LAN 1: off, LAN 2: off, LAN 3: off, LAN 4: untagged, WAN: off } You're free to choose different ports than what I choose here, as long as your choices are consistent between this step and the following steps. Notice that when I donate a port to NAS and to NewLAN, I remove those same ports from LAN. That is, when I mark them as untagged for the New VLANS I create, I mark them as off for the pre-existing LAN bridge. Whatever you do, DO NOT donate the port that your laptop is currently plugged into to NewLAN or to NAS. 5. Go to the Network>Interfaces Section of OpenWRT and create 3 interfaces, NewLAN, AirVPN(This is what I'll call your Wireguard Interface from now on), and NAS. 5.1.Set the Device of NewLAN to the VLAN ID 3 from earlier, then give it an IP address that is in the same subnet as your pre-existing LAN(i.e. if your pre-existing LAN's gateway is 192.168.1.1, then a potentially nice candidate is 192.168.1.254, if you don't have another device sitting there yet), but not part of the DHCP range. Set the gateway to be the address of your pre-existing router. DO NOT plug the OpenWRT into your pre-existing LAN yet. DO NOT enable DHCP Server on this interface 5.2. Set the Device of NAS to VLAN ID 4. Then, give this interface an IP address that is outside your pre-existing subnet, and also that is not in AirVPN's IP 10.0.0.0/8 range. For example, if your pre-existing LAN is 192.168.1.0/24, then make this interface have address 192.168.2.1. If you have more than 1 LAN, choose a new address that is not part of any network you have yet. Enable DHCP Server on this interface. Set the MTU to be the same as the MTU of your Wireguard conf from AirVPN. 5.3. Copy the Wireguard config file into the AirVPN interface. You will be able to select the Device to bind the new interface to in the Device: field after clicking the "Add new interface..." button in network Interfaces. Do not assign any pre-existing firewall zone to any of these new interfaces. Create a new zone for each. 6. In Network>Firewall, if these zones do not exist yet, create 3 new zones called NewLAN, NAS, and AirVPN. Enable Masquerading for all of these interfaces. Allow NAS to forward to AirVPN. Allow NewLAN to forward to NAS. Allow INPUT, OUTPUT, and Intrazone Forward for NewLan and NAS. Allow OUTPUT but block INPUT and Intrazone Forward for AirVPN. If they already exist, still configure them as I told you. 7. Go back to Network>Interfaces, then edit NewLAN, AirVPN, and NAS interfaces. For each of them go to the Firewall Settings tab (visible after clicking Edit) and set each interface to the firewall zone with the same name. 8. Plug your pre-existing router into the port you donated to NewLAN. 9. Plug your NAS into the ethernet port you donated to NAS. 10. Find out what the IP of the NAS is from Status->Overview and scrolling down. 11. Go to Network->DHCP and DNS->Static Leases and add a static lease for the NAS using the IP address you learned from step 10. Set the lease time to infinite 12. Go to Network->Firewall->Port Forwards and Add a Rule. Specify AirVPN as Source Zone and NAS as Destination Zone. Fill Internal Address with what you learned from step 10. Try your best to make the internal and external port the same. If you cannot, either remap the port from AirVPN's Port Forward page in the Client Area or here in OpenWRT's Port Forward Window. 12. Activate the Wireguard Profile 13. Test the setup 14. Please report the results back here. If there is an error in this guide, let me know so I can correct it.

Hello all, This is collection from different tutorials which I will refer here, but usually changed since some things changed. Setting up VPN on Synology is modified neolefort tutorial from here and reconnect script if from sundi which you can find here, which probably modified this script, plus my iptables for blocking Synology on router level when VPN fails. Other contributions: foobar666 - you no longer need to enter variables manually _sinnerman_ - fixed script for DS 6.1 I'm doing this mostly because I usually forget things I managed to solve after year or two, so this is way to have constant reminder how it was solved and also help others. 1. Get your certificates from AirVPN. Go to the https://airvpn.org/generator/ page to generate the configuration file. (1) SELECT the Advanced Mode (under "Config generator" title ) (2) SELECT LINUX OS (3) Under "Protocols" section select one with protocol UDP, port 443 and tls-auth in the right column (at the time of writing, it was in middle of the list). You can choose any combination of protocol/port, but then also change iptables accordingly if you are using failsafe script. Don't choose any combination which has tls-crypt in the right column. (4) Under "Advanced - OpenVPN only" section (right part of page), toggle "Separate keys/certs from .ovpn file" button and change/leave OpenVPN version to 2.5 (This works in DSM 7.2.1. For older versions you will maybe have to select OpenVPN version 2.4). (5) SELECT 1 SERVER (refer to section "by single servers") OR COUNTRY OR ANYTHING ELSE YOU WANT In original tutorial, neolefort said to choose 1 server, because in that case you will get IP instead of xxx.airvpn.org domain. Choosing 1 server is safe because it doesn't need working DNS when you want to connect to VPN. If you choose anything else, you need working DNS on your router when establishing VPN connection. (6) Click "GENERATE" at the bottom. (7) Page will reload with links on top to your files, save them to you computer. Following files will be generated: -AirVPN_XXXXX_UDP-443.ovpn -ca.crt -user.crt -user.key -ta.key 2. Setup AirVPN on Synology. - Login as admin or with user from Administrator group. - Open Control panel. - Go "Network" and click on tab "Network Interface" - Click on button "Create" - "Create VPN profile" - Choose "OpenVPN (via importing .ovpn file)" - Click "Advanced options" so it shows all options - Profile name: anything you want, but please keep is short and if you can without spaces " ", for example "AirVPN". - User name: LEAVE EMPTY (for DSM 7+ just put anything here) - Password: LEAVE EMPTY (for DSM 7+ just put anything here) - Import .ovpn file: click button and import your AirVPN_XXXXX_UDP-443.ovpn - CA certificate: click button and import your ca.crt - Client certificate: click button and import your user.crt - Client key: click button and import your user.key - Certificate revocation: LEAVE EMPTY - TLS-auth key: click button and import your ta.key - Click "Next" - Select all options and click "Done" Now you have working OpenVPN link on your Synology. You just need to start it from "Control panel" - "Network" - "Network Interface". If you want to make your connection faster, you can remove some ciphers. Look for this line in .ovpn file: data-ciphers AES-256-GCM:AES-256-CBC:AES-192-GCM:AES-192-CBC:AES-128-GCM:AES-128-CBC And change it to this: data-ciphers AES-128-GCM Then save file and create new connection with it. After some testing I found out AES-128-GCM is fastest from all other mentioned in settings. You can also test other ciphers your self and leave one you find fastest. EXTRAS!!! 3. Setting up external access to your Synology. First what you will notice is, "I CAN'T ACCESS MY SYNOLOGY FROM OUTSIDE OF MY LAN!!!!!!! OMG OMG OMG!!!!" I will not explain port fowards on your router here, if you don't know how to make one, learn! (1) You can port forward trough AirVPN webpage and access your Syno via VPN exit IP. This sometimes works, most of times it doesn't since Syno has some ports you cannot change. Anyway, change your default HTTP / HTTPS port on Syno to your forwarded AirVPN port and you should be fine. But forget about Cloudstation and similliar things. (2) If you want to access Syno via you ISP IP (WAN), then problem is, your Syno is receiving your connection, but it's replying trough VPN. That's a security risk and those connections get droped. But there is solution! - Access "Control panel" - "Network" - "General" - Click "Advanced Settings" button - Mark "Enable multiple gateways" and click "OK" and then "Apply" You're done! It's working now (if you forwarded good ports on your router). 4. Prevent leaks when VPN connection on Synology fails. There will be time, when you VPN will fail, drop, disconnect, and your ISP IP will become visible to world. This is one of ways you can prevent it, on router level. For this you need Tomato, Merlin, DD-WRT or OpenWRT firmware on your router. I will tell you steps for Tomato router. If you are using different firmware, then you need to learn alone how to input this code into your router. Since Shibby version 129 for ARM routers, syntax of iptables changed and depending on which version of iptables you are using, apply that code. - Login to your router (usually just by entering 192.168.1.1 into your browser, if your IP is different, find out which is your gateway IP). - Click on "Administration" - Click on "Scripts" - Choose tab "Firewall" For Shibby v129 for ARM and later (iptables 1.4.x) us this: #Use this order of commands because it executes in reverse order. #This command will execute last, it kills all UDP requests. iptables -I FORWARD -p udp -s 192.168.1.100 -j REJECT #This command will execute second and will block all TCP source ports except those needed for web access or services iptables -I FORWARD -p tcp -s 192.168.1.100 -m multiport ! --sports 5000,5001,6690 -j REJECT #This command will execute first and will ACCEPT connection to your VPN on destination port 443 UDP iptables -I FORWARD -p udp -s 192.168.1.100 -m multiport --dports 443 -j ACCEPT For earlier Shibby versions and later for MIPS routers: #Use this order of commands because it executes in reverse order. #This command will execute last, it kills all UDP requests. iptables -I FORWARD -p udp -s 192.168.1.100 -j REJECT #This command will execute second and will block all TCP source ports except those needed for web access or services iptables -I FORWARD -p tcp -s 192.168.1.100 -m multiport --sports ! 5000,5001,6690 -j REJECT #This command will execute first and will ACCEPT connection to your VPN on destination port 443 UDP iptables -I FORWARD -p udp -s 192.168.1.100 -m multiport --dports 443 -j ACCEPT Port TCP 5000 = HTTP for for Synology web access (change to your if it's not default) Port TCP 5001 = HTTPS for for Synology web access (change to your it's not default) Port TCP 6690 = Cloud Station port Port UDP 443 = AirVPN connection port which you defined in step 1 of this tutorial. If you are using TCP port, then you need to change "-p udp" to "-p tcp" in that line. If you need more ports, just add them separated by comma ",". If you want port range, for example 123,124,125,126,127, you can add it like this 123:127. Change IP 192.168.1.100 to your Synology LAN IP. Be careful NOT TO assign those ports to your Download Station on Synology. This isn't perfect, you can still leak your IP through UDP 443, but since torrent uses mostly TCP, those chances are minimal. If you use TCP port for VPN, then those chances increase. If you really want to be sure nothing leaks even on UDP 443 (or your custom port), you need to choose 1 (ONE) AirVPN server. You need to find that server entry IP and change last IPTABLES rule to something like this: iptables -I FORWARD -p udp -s 192.168.1.100 -d 123.456.789.123 -m multiport --dports 443 -j ACCEPT Where 123.456.789.123 is AirVPN server entry IP. This will allow UDP 443 only for that server, rest will be rejected by router. These are all my opinions, from my very limited knowledge, which may be right and may be wrong. 5. Auto reconnection when VPN is down. Since when you made your VPN connection on your Synology, you checked "Reconnect" option, Syno will try to reconnect automaticly when connection fails. But in some cases, your network will be offline long enough and Syno will stop trying to reconnect, or will hang with VPN connection established, but not working. In those cases you can use this auto reconnect script. This is reconnect script. Just select all script text and copy it. #VPN Check script modified Sep 11, 2016 #Script checks if VPN is up, and if it is, it checks if it's working or not. It provides details like VPN is up since, data #received/sent, VPN IP & WAN IP. #If VPN is not up it will report it in the log file and start it #Change LogFile path to your own location. #Save this script to file of your choosing (for example "synovpn_reconnect"). Store it in one of your Synology shared folders and chmod it: "chmod +x /volume1/shared_folder_name/your_path/synovpn_reconnect" #Edit "/etc/crontab" and add this line without quotes for starting script every 10 minutes: "*/10 * * * * root /volume1/shared_folder_name/your_path/synovpn_reconnect" #After that restart cron with: "/usr/syno/sbin/synoservicectl --restart crond" #!/bin/sh DATE=$(date +"%F") TIME=$(date +"%T") VPNID=$(grep "\[.*\]" /usr/syno/etc/synovpnclient/openvpn/ovpnclient.conf | cut -f 2 -d "[" | cut -f 1 -d "]") VPNNAME=$(grep conf_name /usr/syno/etc/synovpnclient/openvpn/ovpnclient.conf | cut -f 2 -d "=") LogFile="/volume1/filmovi/Backup/airvpn/check_airvpn_$DATE.log" PUBIP=$(curl -s -m 5 icanhazip.com) #PUBIP=$(curl -s -m 5 ipinfo.io/ip) #PUBIP=$(curl -s -m 5 ifconfig.me) CHECKIP=$(echo $PUBIP | grep -c ".") start_vpn() { echo "VPN is down. Attempting to (re)start now." >> $LogFile # /usr/syno/bin/synovpnc kill_client --protocol=openvpn --name=$VPNNAME /usr/syno/bin/synovpnc kill_client /bin/kill `cat /var/run/ovpn_client.pid` 2>/dev/null sleep 35 echo 1 > /usr/syno/etc/synovpnclient/vpnc_connecting echo conf_id=$VPNID > /usr/syno/etc/synovpnclient/vpnc_connecting echo conf_name=$VPNNAME >> /usr/syno/etc/synovpnclient/vpnc_connecting echo proto=openvpn >> /usr/syno/etc/synovpnclient/vpnc_connecting /usr/syno/bin/synovpnc reconnect --protocol=openvpn --name=$VPNNAME >> $LogFile } sleep 6 echo "======================================" >> $LogFile echo "$DATE $TIME" >> $LogFile if ifconfig tun0 | grep -q "00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00" then if [ "$CHECKIP" == 1 ] then IPADDR=$(/sbin/ifconfig tun0 | grep 'inet addr' | cut -d: -f2 | awk '{print $1}') RXDATA=$(/sbin/ifconfig tun0 | grep "bytes:" | cut -d: -f2 | awk '{print $1,$2,$3}') TXDATA=$(/sbin/ifconfig tun0 | grep "bytes:" | cut -d: -f3 | awk '{print $1,$2,$3}') UPTIME=$(cat /var/log/messages | grep "$IPADDR" | awk '{print $1}' | tail -1) UPTIME=$(date -d"$UPTIME" +"%Y/%m/%d %H:%M:%S") echo "VPN is up since: $UPTIME" >> $LogFile echo "Session Data RX: $RXDATA" >> $LogFile echo "Session Data TX: $TXDATA" >> $LogFile echo "VPN IP is: $IPADDR" >> $LogFile echo "WAN IP is: $PUBIP" >> $LogFile else start_vpn fi else start_vpn fi exit 0 (1) Login to you Synology DSM web interface as admin. - As admin go to "Control panel" - "Task Scheduler" (you need to enable advanced mode in top right corner of control panel for this) - Click "Create" button near top of page, then select "Scheduled Task" and then "User-defined script" (2) New popup window will open. - under "Task:" enter task name - under "User:" select "root" if it's not already selected - switch to "Schedule" tab and select how often you want this task to run, my settings are: - "Run of following days" - "Daily" - "First run time" - 00:00 - "Frequency" - "Every 10 minutes" - "Last run time" - 23:50 - switch to "Task settings" tab - paste script you copied into empty box under "User-defined script" title - press OK and you're done I tested this on DSM 6.2.2 and it works without problems for now. Still, I'm keeping old instructions in next post, if someone wants to do it like that. Tip: If you don't want logfile, you can comment out those lines, or remove ">> $LogFile" code from whole script. That's all. If you entered everything correctly, you should be fine and ready to go! Comments are welcome. If you find mistakes, please correct me.

It seems to me that you answer your own question. No ISP IPv6 <=> No ISP IPv6 leak. OpenWrt does not route to the default ISP route when the VPN interface goes down but this should probably vary depending on your firewall and the rules you apply.

My OpenWrt router is configured to use only IPv4 on its WAN interface (wan6 disabled : my choice, not the OpenWrt defaults). The LAN interface acts as a IPv6 DHCP and has SLAAC enabled. Routing sends everything in the WreGuard interface, IPv4 and IPv6 alike. A windows 11 PC on the LAN running qBittorrent uses both IPv4 and IPv6 local (private) addresses. I gave configuration details with screenshots in this message :

Hello, how can I successfully set up ipv6 in my case? I get ipv6 address tracked down from my ISP, so I should remove it? And next how to use ipv6? Thank you really much You don't need IPv6 from your ISP to use IPv6 from or in AirVPN. I use OpenWrt and I disabled the wan6 interface then added a ULA IPv6 server on my LAN interface. I'm sorry that I can't help you more. It took me a few weeks to be able to achieve that under OpenWrt and I'm no specialist of it. Using your ISP IPv6 is just adding a big risk of leaking it.

Hello, unfortunately the Caelum Server (Austria) went down today, so I have to use either Alderamin or Beemim. But with those two I have the frequent problem that websites are unreachable because of timeouts. This problem though only exists within AirVPN usage, the website itself is fine and reachable via my WAN route or other VPNs. I use AirVPN via WireGuard through my OpenWRT router. Just to be clear: the tunnel itself is fine, this also happened with multiple devices (this is the third OpenWRT router I use for this). This happens randomly, other websites are normally reachable and keep doing so, but a specific website not. The problem persists with this website for some time (usually a couple of days) , after this time passes it's somehow working. No changes made. I tried to comprehend the issue, but it's extremely difficult to troubleshoot. It seems like it's a combination of a DNS and route problem within AirVPN, but this is just a guess of mine. Very strict firewall rules on the OpenWRT router (no LAN to WAN forwarding, default route via VPN, strict no-leak setup) seem to make things worse, but I could not isolate this. Nowadays I use a less strict policy-routing setup. But this issue is very annoying. Together with more and more sites/services which block VPNs altogether, this problem makes AirVPN barely usable for me. I need a working server in Austria, and Alderamin/Beemim are not working so well for me. I tried searching for this problem, but did not find anything useful. Anything helpful would be appreciated. Edit: checking AirVPNs route tool, seems this time the site is not reachable from any server. So probably blocked. Maybe I jumped the gun too fast here, since the pattern was exactly the same as before. So take my description above with a grain of salt. Current example sites: jump25.at and kinder-guide.at

Little update. After i was advised to use Wireguard and that the NAS did not provide any native support i remembered i had an old tplink archer C7 lying around and wondered if i could do a middle box of it. Long story short : I flashed it for openwrt, made it a dumb ethernet access point (no WAN, no DHCP, no wifi), installed wireguard and managed to setup airvpn. I then connected the nas to it but now i have a bit of an issue : dumb AP works as even with the openwrt router between may main gateway (isp box) and the NAS i can find it and access the DSM UI fine but then when i activate the wireguard interface i loose connexion. The connexion from my PC is wifi to ISP box then ethernet to openwrt then nas. My take is that the wireguard interface tunnels all to the airvpn exit node and there is no way for me to reach the nas from the LAN with it's local IP) Is there a way to dissociate so that the WG connexion is only for outside of the actual LAN (the DSM VPN system did that perfectly) ? May be some port routing black magic (because honestly i only need the torrent to go trhough the vpn, rest not so much) BTW also noticed that with the WG interface activated, the tailscale network i use to reach the nas from outside loose trace of it when it never did it with the openvpn on DSM. EDIT : after tweaking for hours i now have access to the devices after the router but the traffic doesn't go to the router and ip leak test show my torrents on my own. I found places where they seem to think that dumb AP and vpn client just don't work as the principle of dumb AP is to be transparent.

I don't know on what OS you're trying to make this work but on OpenWrt, I've been able to have both IPv4 and Ipv6 going through the WG VPN. To avoid IPv6 leaks, I disabled the wan6 interface so the only IPv6 addresses known in my LAN are private and in theory shouldn't be routed on the Internet. I gave some more details in the following topic: https://airvpn.org/forums/topic/69197-title-ipv6-not-routing-through-airvpn-on-openwrt-wireguard/?tab=comments#comment-262564 qBittorrent is bound to "All adresses" but the number of IPv6 peers is lower compared to IPv4 (usually less than 10 % with 500 to 1500 peers connected). But this isn't probably an anomaly as discussed in the following topic: https://airvpn.org/forums/topic/80136-ratio-percentage-of-ipv4-vs-ipv6-peers-in-your-torrents/?tab=comments#comment-262646

Hi, sorry it took so long, job got in the way. But long answer short, it does not work. the main router does not see the openwrt and the openwrt does not see the nas (went on dsm and removed the static adress in the setup just in case) Tried to update the package to see if the wrt could reach internet but no. I can't access the interface any other way than plugging my laptop into lan1 port i'll recheck everything but already did 10 times, is there anything i could printscreen for you ? only noticeable difference is that i have eth0 and eth1 cpu.

I'm looking for a comprehensive guide on how to set up AirVPN on a router running OpenWRT. I've tried following various tutorials online, but I'm still running into issues. Specifically, I'm having trouble with configuring the firewall rules to ensure that all traffic is routed through the VPN. Does anyone have a reliable configuration that they could share? I'm also interested in any tips or tricks for improving performance and stability. Any help would be greatly appreciated!

I am trying to set up my new OpenWRT router with WireGuard and PBR while keeping IPv6 enabled. I found previous threads and followed some of the instructions found there, namely the ones on this page: https://openwrt.org/docs/guide-user/services/vpn/wireguard/client and this video by Dev Odyssey: https://www.youtube.com/watch?v=04q41GEPvKA The deviation from the above I made is to add the DNS servers, which are not in the OpenWRT page. I also created a "vpn" zone and added it to the default forwarder as in the video. I installed PBR and started it with IPv6 enabled. The WireGuard connection appears to be online. However, even though DNS resolution appears to work, I have no IPv4 connectivity and can only connect to IPv6 sites with my ISP's IPv6 address. So basically even though the WireGuard connection is established and has a small amount of TX and RX I don't appear to be able to use the tunnel at all (except for DNS resolution so I can reach AirVPN's DNS). I'm at a loss how to troubleshoot this. Anybody able to assist?

EDIT (new question): Which IP address is OK to be pinged every 50 seconds and is still privacy/no log OK ? Thanks! I customized the AirVPN Openwrt config to have the reconnect.sh script point to a specific IP address. The IP address stopped responding to pings 2 days ago. For now, I changed the IP to google, all working again like charm. But I don't like Google ... So looking for an alternative. Original question "troubleshoot airvpn Interrupted system call (code=4)": Can anyone please help me troubleshoot my routers? OpenVPN is disconnecting after ±1 minute and reloading. I think the issue is: event_wait : Interrupted system call (code=4) Conscious of issue since 2-3 days, before with exact same config all seemed to be OK. Happens on OpenWrt 21.02.1 and on OpenWrt 21.02.0 Openwrt configured using ulmwind's guide Airvpn config generator specifics: using generator for "router" connect with ip layer ipv4 ip layer exit ipv4 only Log section: Sat Dec 11 09:48:07 2021 daemon.notice openvpn(OpenWRT)[1620]: Initialization Sequence Completed Sat Dec 11 09:48:40 2021 kern.info kernel: [ 91.160539] rt3050-esw 10110000.esw: link changed 0x00 Sat Dec 11 09:48:54 2021 daemon.err openvpn(OpenWRT)[1620]: event_wait : Interrupted system call (code=4) Sat Dec 11 09:48:54 2021 daemon.notice openvpn(OpenWRT)[1620]: SIGTERM received, sending exit notification to peer Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[1620]: net_route_v4_del: 213.152.161.248/32 via 192.168.1.1 dev [NULL] table 0 metric -1 Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[1620]: net_route_v4_del: 0.0.0.0/1 via 10.24.168.1 dev [NULL] table 0 metric -1 Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[1620]: net_route_v4_del: 128.0.0.0/1 via 10.24.168.1 dev [NULL] table 0 metric -1 Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[1620]: Closing TUN/TAP interface Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[1620]: net_addr_v4_del: 10.24.168.174 dev tun0 Sat Dec 11 09:48:59 2021 daemon.notice netifd: Network device 'tun0' link is down Sat Dec 11 09:48:59 2021 daemon.notice netifd: Interface 'OpenWRT' has link connectivity loss Sat Dec 11 09:48:59 2021 daemon.notice netifd: Interface 'OpenWRT' is now down Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[1620]: /usr/libexec/openvpn-hotplug down OpenWRT tun0 1500 1538 10.24.168.174 255.255.255.0 init Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[1620]: SIGTERM[soft,exit-with-notification] received, process exiting Sat Dec 11 09:48:59 2021 daemon.notice netifd: Interface 'OpenWRT' is disabled Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[2454]: OpenVPN 2.5.3 mipsel-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[2454]: library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10 Sat Dec 11 09:48:59 2021 daemon.warn openvpn(OpenWRT)[2454]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[2454]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Sat Dec 11 09:48:59 2021 daemon.notice openvpn(OpenWRT)[2454]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: TCP/UDP: Preserving recently used remote address: [AF_INET]141.98.102.242:443 Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: Socket Buffers: R=[180224->180224] S=[180224->180224] Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: UDP link local: (not bound) Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: UDP link remote: [AF_INET]141.98.102.242:443 Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: TLS: Initial packet from [AF_INET]141.98.102.242:443, sid=2fbf3630 b63934b8 Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: VERIFY KU OK Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: Validating certificate extended key usage Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: VERIFY EKU OK Sat Dec 11 09:49:02 2021 daemon.notice openvpn(OpenWRT)[2454]: VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=Dubhe, emailAddress=info@airvpn.org Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 4096 bit RSA, signature: RSA-SHA512 Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: [Dubhe] Peer Connection Initiated with [AF_INET]141.98.102.242:443 Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: PUSH: Received control message: 'PUSH_REPLY,comp-lzo no,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.26.8.1,route-gateway 10.26.8.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.26.8.74 255.255.255.0,peer-id 5,cipher CHACHA20-POLY1305' Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: timers and/or timeouts modified Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: compression parms modified Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: --ifconfig/up options modified Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: route options modified Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: route-related options modified Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: peer-id set Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: adjusting link_mtu to 1625 Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: OPTIONS IMPORT: data channel crypto options modified Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: Data Channel: using negotiated cipher 'CHACHA20-POLY1305' Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: Outgoing Data Channel: Cipher 'CHACHA20-POLY1305' initialized with 256 bit key Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: Incoming Data Channel: Cipher 'CHACHA20-POLY1305' initialized with 256 bit key Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: net_route_v4_best_gw query: dst 0.0.0.0 Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: net_route_v4_best_gw result: via 192.168.1.1 dev wlan0 Sat Dec 11 09:49:03 2021 daemon.notice netifd: Interface 'OpenWRT' is enabled Sat Dec 11 09:49:03 2021 daemon.notice netifd: Network device 'tun0' link is up Sat Dec 11 09:49:03 2021 daemon.notice netifd: Interface 'OpenWRT' has link connectivity Sat Dec 11 09:49:03 2021 daemon.notice netifd: Interface 'OpenWRT' is setting up now Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: TUN/TAP device tun0 opened Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: net_iface_mtu_set: mtu 1500 for tun0 Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: net_iface_up: set tun0 up Sat Dec 11 09:49:03 2021 daemon.notice netifd: Interface 'OpenWRT' is now up Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: net_addr_v4_add: 10.26.8.74/24 dev tun0 Sat Dec 11 09:49:03 2021 daemon.notice openvpn(OpenWRT)[2454]: /usr/libexec/openvpn-hotplug up OpenWRT tun0 1500 1538 10.26.8.74 255.255.255.0 init Sat Dec 11 09:49:03 2021 user.notice firewall: Reloading firewall due to ifup of OpenWRT (tun0) Sat Dec 11 09:49:08 2021 daemon.notice openvpn(OpenWRT)[2454]: net_route_v4_add: 141.98.102.242/32 via 192.168.1.1 dev [NULL] table 0 metric -1 Sat Dec 11 09:49:08 2021 daemon.notice openvpn(OpenWRT)[2454]: net_route_v4_add: 0.0.0.0/1 via 10.26.8.1 dev [NULL] table 0 metric -1 Sat Dec 11 09:49:08 2021 daemon.notice openvpn(OpenWRT)[2454]: net_route_v4_add: 128.0.0.0/1 via 10.26.8.1 dev [NULL] table 0 metric -1 Sat Dec 11 09:49:08 2021 daemon.notice openvpn(OpenWRT)[2454]: Initialization Sequence Completed

Hi everyone, I'm using AirVPN through WireGuard on my OpenWrt router (latest stable version), but I'm having trouble getting IPv6 to work properly. IPv4 traffic goes through the VPN just fine, but IPv6 traffic does not. Here are my relevant settings and config: // network: config interface 'loopback' option device 'lo' option proto 'static' option ipaddr '127.0.0.1' option netmask '255.0.0.0' config globals 'globals' option ula_prefix 'fdef:xxxx:xxxx::/48' option packet_steering '1' config device option name 'br-lan' option type 'bridge' list ports 'lan1' list ports 'lan2' list ports 'lan3' list ports 'lan4' config interface 'lan' option device 'br-lan' option proto 'static' option ipaddr '192.168.1.1' option netmask '255.255.255.0' option ip6assign '60' config interface 'wan' option device 'wan.10' option proto 'dhcp' option peerdns '0' list dns '1.1.1.2' config interface 'wan6' option device 'wan.10' option proto 'dhcpv6' option reqaddress 'try' option reqprefix 'auto' option peerdns '0' list dns '2606:4700:4700::1112' config device option type '8021q' option ifname 'wan' option vid '10' option name 'wan.10' config interface 'vpn' option proto 'wireguard' option private_key '***REDACTED***' list addresses '10.x.x.x/32' list addresses 'fdxx:xxxx:xxxx:xxxx::xxxx/128' config wireguard_vpn 'wgserver' option public_key '***REDACTED***' option preshared_key '***REDACTED***' option endpoint_host 'xxx.xxx.xxx.xxx' option endpoint_port '1637' option persistent_keepalive '15' option route_allowed_ips '1' list allowed_ips '0.0.0.0/0' list allowed_ips '::/0' // firewall config defaults option syn_flood '1' option input 'REJECT' option output 'ACCEPT' option forward 'REJECT' config zone 'lan' option name 'lan' list network 'lan' option input 'ACCEPT' option output 'ACCEPT' option forward 'ACCEPT' config zone 'wan' option name 'wan' list network 'wan' list network 'wan6' list network 'vpn' option input 'REJECT' option output 'ACCEPT' option forward 'REJECT' option masq '1' option mtu_fix '1' config forwarding option src 'lan' option dest 'wan' # IPv6-related firewall rules omitted for brevity but mostly default ICMPv6 & DHCPv6 Despite ::/0 being in the allowed_ips for the WireGuard interface, my IPv6 traffic still seems to go out through the regular WAN or not at all. Does anyone know what I'm missing or how to properly force all IPv6 traffic through the VPN tunnel like IPv4? Thanks in advance!

Hi Forum, A couple of days ago I switched from my previous VPN supplier, Perfect Privacy, to AirVPN. I am not making use of Eddie, but am relying on a dedicated VPN router instead (a four port Protectli VP2420 with a Celeron J6412 processor). Connected to the switch downstream of this router are two desktops and a laptop. Since I was already using said VPN router when I was still making use of Perfect Privacy, reconfiguring it for AirVPN was a breeze: I uploaded the OpenVPN configuration files for a number of countries (Belgium, Germany, the Netherlands, Norway and Sweden), and I was good to go 👍. However, I do still have an issue now I am with AirVPN that I have not yet sorted out. This has to do with the fact that I’d like my two desktops to connect to a server in the Netherlands, whereas my laptop should connect to a server in Sweden. Previously, I managed to do this under OpenWrt by making the connection with the server in the Netherlands my default gateway, such, by adding the following two lines to the OpenVPN configuration file for the Dutch server: 1. redirect-gateway def1 2. redirect-gateway ipv6 At the same time, traffic from my laptop was routed to a server in Sweden - this, by making use of the ‘policy based routing’ package of OpenWrt, and by adding the following two lines to the OpenVPN configuration files for the Swedish server: 3. pull-filter ignore "redirect-gateway" 4. pull-filter ignore "redirect-gateway ipv6” Having switched to AirVPN, I have been trying to reach the same result by adding lines 1 and 2 to the configuration file for the Netherlands ('remote nl3.vpn.airdns.org 443’), and lines 3 and 4 to the file for Sweden (‘remote se3.vpn.airdns.org 443’). Although it would have been nice if the solution were as simple as this 😎, unfortunately it doesn’t work. The server in the Netherlands doesn’t become my default gateway, and my laptop doesn’t connect to a server in Sweden as my routing policy tells it to. My question is hence what I should change in the OpenVPN configuration file to make the connection to a server in the Netherlands my default gateway, and also, what needs to be changed in the configuration file for Sweden to make OpenWrt understand that a connection to a server in the latter country should be seen as ‘secondary gateway’, through which traffic is routed only when it is generated by the laptop for which my routing policy is in place. Any suggestions you may have will be warmly welcomed 🙏!

From the AirVpn Generator I configured as follows: OS: Router -> protocol: WireGuard -> By continents (recommended): Europe -> Generate I use Wireguard via my OpenWrt router. According to my understanding, once the Wireguard interface from my router first connects, a server from Europe is chosen that doesn't have too much load. However, afterwards the server isn't change anymore. It stays there, until either the router or the interface is restarted. My question is, if /usr/bin/wireguard_watchdog is the solution? I changed the script so that it re-resolves endpoint hostname every time. I run the script every 15mins. So this way when the server becomes too loaded a different server should be resolved to, right? Custom script based on wireguard_watchdog: #!/bin/sh # SPDX-License-Identifier: GPL-2.0 # # Copyright (C) 2018 Aleksandr V. Piskunov <aleksandr.v.piskunov@gmail.com>. # Copyright (C) 2015-2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. # # This watchdog script tries to re-resolve hostnames for inactive WireGuard peers. # Use it for peers with a frequently changing dynamic IP. # persistent_keepalive must be set, recommended value is 25 seconds. # # Run this script from cron every 15th minute: # echo '*/15 * * * * /usr/bin/wireguard_watchdog_custom' >> /etc/crontabs/root . /lib/functions.sh check_peer_activity() { local cfg=$1 local iface=$2 local disabled local public_key local endpoint_host local endpoint_port local persistent_keepalive local last_handshake local idle_seconds config_get_bool disabled "${cfg}" "disabled" 0 config_get public_key "${cfg}" "public_key" config_get endpoint_host "${cfg}" "endpoint_host" config_get endpoint_port "${cfg}" "endpoint_port" if [ "${disabled}" -eq 1 ]; then # skip disabled peers return 0 fi persistent_keepalive=$(wg show ${iface} persistent-keepalive | grep ${public_key} | awk '{print $2}') # only process peers with endpoints and keepalive set [ -z ${endpoint_host} ] && return 0; [ -z ${persistent_keepalive} -o ${persistent_keepalive} = "off" ] && return 0; # skip IP addresses # check taken from packages/net/ddns-scripts/files/dynamic_dns_functions.sh local IPV4_REGEX="[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}" local IPV6_REGEX="\(\([0-9A-Fa-f]\{1,4\}:\)\{1,\}\)\(\([0-9A-Fa-f]\{1,4\}\)\{0,1\}\)\(\(:[0-9A-Fa-f]\{1,4\}\)\{1,\}\)" local IPV4=$(echo ${endpoint_host} | grep -m 1 -o "$IPV4_REGEX$") # do not detect ip in 0.0.0.0.example.com local IPV6=$(echo ${endpoint_host} | grep -m 1 -o "$IPV6_REGEX") [ -n "${IPV4}" -o -n "${IPV6}" ] && return 0; # re-resolve endpoint hostname if not responding for too long logger -t "wireguard_monitor" "trying to re-resolve hostname: wg set ${iface} peer ${public_key} endpoint ${endpoint_host}:${endpoint_port}" echo "wireguard_monitor: trying to re-resolve hostname: wg set ${iface} peer ${public_key} endpoint ${endpoint_host}:${endpoint_port}" wg set ${iface} peer ${public_key} endpoint "${endpoint_host}:${endpoint_port}" } # query ubus for all active wireguard interfaces wg_ifaces=$(ubus -S call network.interface dump | jsonfilter -e '@.interface[@.up=true]' | jsonfilter -a -e '@[@.proto="wireguard"].interface' | tr "\n" " ") # check every peer in every active wireguard interface config_load network for iface in $wg_ifaces; do config_foreach check_peer_activity "wireguard_${iface}" "${iface}" done

I'm new here and it took me a few weeks to find "the best server" (in my case, one with the fastest upload speed) and it is among the new 10G I found it. I noticed too that with short speed tests, most of the time, upload appeared to be way lower than download. But in the long run, several days or weeks, I could observe very good upload speed in the range 500 Mbps to 800 Mbps. That is torrent traffic mostly and the VPN part works on a home router under OpenWrt and in this case, I rarely change the server it connects to. As a conclusion, I didn't try to find why most servers gave ma a lower upload speed and I stopped searching when my average upload speed was near the maximum capability of my router and fiber speed.

I'm glad (if) I could help. On OpenWrt I use Policy Based Routing for IPv4 only. And the AirVPN WireGuard tunnel for IPv6 because I have no other use for IPv6 yet and I don't use the IPv6 from my Internet provider (I tried before and it worked in relay mode but I received a threatening e-mail from ZOG because they didn't like me sharing all those Linux ISOs). When I got that 1 / 2 Gbps fiber plan, I discovered that it was close to a nightmare : CG-NAT for IPv4 and a /64 for IPv6. It couldn't be worse. But now, thanks to AirVPN, I can have incoming port forwarding with IPv4 and incoming IPv6 without using a public IPv6. I have already been a few times in the Top User Speed and now in Top User Session Traffic and this with a Flint 2 (GL-MT6000) home router. I believe that it couldn't be better.

Hi, I have created an OpenWRT router on my Proxmox server, the wireguard connection is working. I can use ping and ping6, traceroute and traceroute6 all works well, also from the LAN. Except … incoming port forwarding on IPv6 keeps failing, IPv4 is working perfectly. Any got a pointer? I am not an expert with OpenWRT, but got some basic knowledge.

I have recently been able to add IPv6 to my LAN (but ULA only to avoid IPv6 leaks) and add a port forward in my OpenWrt router that acts as a Wireguard client for a Windows qBittorrent client in my Ethernet LAN. Everything seems to work fine and I've been able to reach the "Top User Speed" a few times while seeding to around 800 peers. But the one thing that annoys me is that IPv6 traffic appears way too low compared to IPv4, usually between 5 to 10 % (90 % or more for IPv4). I have tried some online speed tests that can do both IPv4 and IPv6 and I saw no huge difference between the two. Then I tried to select IPv6 only in qBittorrent and restarted it. After a few minutes, I got only 80 peers (instead of 800; look at the graph). The AirVPN, forwarded ports, test open, confirms that both IPv4 and IPv6 port I selected for torrents are "Open!". I can't believe that only 5% of torrent users have IPv6 so there must be a problem in my installation. For those who use a computer as a seed-box with both IPv4 and IPv6, how many peers do you see connected in IPv6 (compared to IPv4) ?

In the AirVPN router setups, there are guides for DD-WRT, Tomato, AsusWRT and pfSense, but there's nothing for OpenWrt, which I find unusual because it's the custom firmware with the largest community. Do the current router guides work similarly for OpenWrt? Are there any differences worth knowing about? Also, isn't the Tomato firmware on the AirVPN download page deprecated? I believe the current up to date fork is called FreshTomato.