Search the Community

Hello, After doing the reading on DNS leaks and using the ipleak.net site (nice tool), I found that one of my computers using a Windows 7 OS was subject to DNS leaks. I also found that the firewall I am using is not the most popular on these forums. I am using the Norton Smart Firewall which is part of the NIS package. After reviewing several pages and articles (with https://airvpn.org/topic/1713-win-mac-bsd-block-traffic-when-vpn-disconnects/?p=10343 being the most helpful, though slightly dated due to the new NIS interface), I was able to set up two rules. One for when the VPN was connected to only allow TCP/UDP traffic from a range of 10.4.0.0->10.9.255.255. The other to block traffic from the address of my LAN for when the VPN was not connected. With this set up, the computer checks out fine in ipleak.net. (Of course also had to make adjustments for WebRTC). However, I have one resulting issues I was wonder if anyone might be able to comment on. When I first turn on my computer, I have to disable my firewall before OpenVPN can establish the VPN connection. (I do not use EDDIE.) Once I am connected to the VPN, I can then re-enable the firewall and all works fine. Not the hardest step, but was trying to find a more seemless way to do this. Also as an aside, I only chose to allow TCP/UDP traffic when connected to the VPN, vice also allowing ICMP/ICMPv6. Are their any significant problems with the choice? I have playing with the settings for a bit, but have noticed any issue, but then definitely would not call myself the most savvy. Thanks for any comments.

I have set up AirVPN on my pfSense router with the help of the instructions I found here on this forum. Unfortunately I experience some DNS problems with the AirVPN DNS server 10.4.0.1. The AirVPN server is the first DNS (use VPN tunnel) and the other two OpenDNS server. Also the strict order option is set so se they are queried sequentially. I connect to german servers (UDP 443) but the problem not seems to be related to one certain server and may occur immediately after connecting to it or even after a day or two. Restarting the tunnel or the router itself fixes the problem, often needs a few tries. Surprisingly it is only a few websites that are affected and cannot resolve properly. Those are for example (ironically) airvpn.org, windowscentral.com, pandawill.com just to mention a few. If I omit AirVPN's DNS completely and only rely on the OpenDNS servers I not experience this issue at all and no DNS problems for weeks! I attached some information and would appreciate any help on this.

OS: Windows 7 32 bits I get a DNS checking failed when activating "Check if tunnel use Airvpn DNS" in Eddie 2.8.8 Eddie won't connect and try again and again...untill i cancel the connection and deactivate that DNS check it of course connects correctly. Is it an Eddie bug or Airvpn issue ? See a part of the log below that repeats when Eddie Disconnects, reconnects... . 2015.02.01 12:08:37 - OpenVPN > Initialization Sequence Completed I 2015.02.01 12:08:37 - Flushing DNS I 2015.02.01 12:08:37 - Checking route I 2015.02.01 12:08:37 - Checking DNS E 2015.02.01 12:08:37 - DNS checking failed. . 2015.02.01 12:08:37 - OpenVPN > MANAGEMENT: Client connected from [AF_INET]127.0.0.1:3100 ! 2015.02.01 12:08:37 - Disconnecting . 2015.02.01 12:08:37 - Management - Send 'signal SIGTERM'

I connect to AirVPN using the network-manager applet on Fedora 20 x64. I have a couple of ports forwarded, which are manually allowed in Fedora's firewall and entered into qBittorrent (latest v3.1.9-2). I have just noticed that while the connection never leaks DNS when used normally, as soon as qBittorrent is running my DNS leaks almost every time I test. Here is what happens once qBittorrent is open: Once qBittorrent is closed, the leaks stop. Does anyone have any ideas? As far as I knew DNS leaks were basically a Windows problem. Currently qBittorrent is set to use the tun0 interface only, and my network-manager settings are as follows: Ethernet: Connect automatically, IPv4 only, connect to AirVPN as soon as interface is up. AirVPN: Port 443 over UDP, no special settings after importing config files from Air's generator. The whole machine connects through an IPFire (Linux hardware firewall/router distro) box. Can anyone help shed some light on this please? Thanks in advance.

Hello! The idea of bringing this up is a result of many questions lately, that some devices or clients override OS settings and query their own DNS servers without the users permission. I would like to suggest a small enhancement, which will potentially prevent all user mistakes in the future, and will allow an even better VPN experience with less configuration. The idea is to have 2 additional options in the config generator section of the Client Area, where the user would be able to "opt-in" in case he wants the feature. One is something like "Force all applications use Air's VPN server", in which case you will have to add something like this: iptables -t nat -A PREROUTING -s 10.4.12.34 -p udp --dport 53 -j DNAT --to 10.4.0.1 iptables -t nat -A PREROUTING -s 10.4.12.34 -p tcp --dport 53 -j DNAT --to 10.4.0.1 The internal IP of the client is known to you, here is just examples of how I assume it should look on the server side. The second option in the Client Area, can be called something like "Prevent all potential DNS leaks, I will configure Air's DNS manually" Then, a rule like this can come in place: iptables -A OUTPUT -p udp -s 10.4.12.34 -d 10.0.0.0/8 --dport 53 -j ACCEPT iptables -A OUTPUT -p tcp -s 10.4.12.34 -d 10.0.0.0/8 --dport 53 -j ACCEPT iptables -A OUTPUT -p udp -s 10.4.12.34 --dport 53 -j DROP iptables -A OUTPUT -p tcp -s 10.4.12.34 --dport 53 -j DROP All the examples are made up, I am sure that a more elegant way of achieving this can take place, such as a special subnet for all users of each group. Today these methods are used in corporate VPNs mainly to enforce whitelisting/blacklisting of URLs, but I don't see a reason why we can't do the same here. Please share your comments zhang888

All: My TunnelBlick client is not starting properly, and I cannot import the .ovpn or .tblk files into TunnelBlick. So, I have resorted to using Viscosity. The problem with Viscosity is that it is not updating my /etc/resolv.conf once the VPN client takes over. Does anyone use Viscosity out there? Is airdns.org acceptable to use for all my AirVPN connections?

I installed openvpn on FreeBSD 10.1 and the DNS isn't working. I put these lines in rc.conf: openvpn_enable="YES" openvpn_if="tun" openvpn_configfile="/usr/local/etc/openvpn/[whatever].ovpn" I copied the .ovpn file to /usr/local/etc/openvpn. When I reboot, openvpn starts fine. I don't have a firewall on the system. Did I forget to do something?

Hey I got a problem. When i connect to a vpn server, it says connected. but im still using my ISP IP instead of the IP of the VPN Server... How do i fix this? These are my machine details: Operating System Version: Microsoft Windows Server 2012 Datacenter Hardware information: HP ProLiant ML110 G6 Processors: Intel® Xeon® CPU X3430 @2.40GHz Installed Memory (RAM): 24GB Installed Roles: AD DSDHCPDNSFile and Storage ServicesHyper-VIIS 8.0IPAMNAPRemote AccessWDSLog: http://pastebin.com/43UnP5Ci SOLVED: This message is the answer!: Awesome StaffAdvanced Member Staff5013 postsPosted Yesterday, 11:40 PM Hello! The tun/tap interface (the virtual network card used by OpenVPN) does not come up. Please try to run our client Eddie, which includes some additional code which tries to force the interface up. If the client attempt does not work, please follow all the steps described here: https://airvpn.org/t...2012/#entry8321 Kind regards

Hi guys, I set up Comodo Firewall in the way you descriped it on this tutorial https://airvpn.org/index.php?option=com_kunena&func=view&catid=3&id=3405&Itemid=142 I did everything correctly (I think so) but I'm still leaking DNS. When I access AirVPN homepage via VPNClient it says at the bottom "not connected" Any ideas how to fix this?? I can see my own IP address

I've been using this service for some time, here I have a few questions to the admins 1. Do you plan to enable DNSSEC on your DNS service (10.4.0.1)? 2. Do you plan to enable IPv6 at exits and inside the tunnel? And as transport protocol? I think recent versions of OpenVPN can do that easier than before (but I haven't tested myself). 3. Can you make it possible to disable/renew user keys and certificates and have 3 of them at a time, one for every allowed device? Now I don't know how to act if I leak my key.

Well the things in THIS (https://airvpn.org/index.php?option=com_kunena&func=view&catid=3&id=2353&limit=6&limitstart=6&Itemid=142) posting did not work as far as I can tell. So I did some more work and: FIRST THIS APPLIES to an OpenVPN client on a DD_WRT router NOT to the client on a PC. It is helpful to be able to telnet to the router and issue commands in this way. The notes below are done by telnet. EDIT: Please note if you use the last entry above in the firewall (iptables -I OUTPUT -o br0 ! --dst a.b.c.d -j DROP) you will lose access to the router. Thus if the tunnel goes down ...well you know. So you may want to leave this entry off the GUI and if/when you are set up properly and then run it from the telnet prompt. That way if you need router access you can reboot and be OK. First determine the router interface(s). the command is netstat -r On the far right of the output interfaces are listed. In my case I was using iptables for the tun0 interface .... the interface on the router is tun1 .. !! so the firewall commands needed to look like this: iptables -I FORWARD -i br0 -o tun1 -j ACCEPT iptables -I FORWARD -i tun1 -o br0 -j ACCEPT iptables -I INPUT -i tun1 -j REJECT iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE iptables -I OUTPUT -o br0 ! --dst a.b.c.d -j DROP # if destination for outgoing packet on eth+ is NOT a.b.c.d, drop the packet, so that nothing leaks if VPN disconnects # the above line can be duplicated for as many Air servers as you wish to connect to, just insert the appropriate Air server entry-IP Fill a.b.c.d with the remote server ip in your air.ovpn file After running these (you may want to run iptables -F first to flush previous) with YOUR interfaces determined from above, save the firewall and REBOOT. Then after reboot telnet again and run the command ps This will tell if Openvpn started .. in my case the start is unreliable. If OpenVPN is not running try this command (sleep 30 && (ps | grep openvpn | grep -v grep || openvpn --config /tmp/openvpncl/openvpn.conf --route-up /tmp/openvpncl/route-up.sh --down /tmp/openvpncl/route-down.sh --daemon))& This will check if it is running and if not will start the client. Now you can use the ps command to check and after then check your connection to AirVPN. You can also check the iptables with the command netstat -vnL. Hope this is helpful to some and saves some work/head scratching. Comments on the above very welcome, Cheers EDIT: Please note if you use the last entry above in the firewall (iptables -I OUTPUT -o br0 ! --dst a.b.c.d -j DROP) you will lose access to the router. Thus if the tunnel goes down ...well you know. So you may want to leave this entry off the GUI and if/when you are set up properly and then run it from the telnet prompt. That way if you need router access you can reboot and be OK. Also this start-up command (enter in Admin>Command window and save start-up) seems to insure the client runs .. sleep 60 (sleep 30 && (ps | grep openvpn | grep -v grep || openvpn --config /tmp/openvpncl/openvpn.conf --route-up /tmp/openvpncl/route-up.sh --down /tmp/openvpncl/route-down.sh --daemon))& It takes longer to connect but seems to do so each time correctly.

Hi I think I have a dns leak, when I try to connect to kickass.to I get an "Error - site blocked". When I checked with ipleak it shows: AirVPN Server exit node but also a BT DNS address. I get the same results, ip exit node and dns, when I check with dnsleaktest. I connect with: sudo openvpn AirVPN_Europe_UDP-443.ovpn I think the BT DNS is a leak, not sure why this is happening.

How do you configure the firewall (I'm wondering about both Comodo (Windows) and GUFW (Linux)) when using Air VPN over TOR? Or, are the firewall settings to prevent leaks the same as if I were just using Air VPN? Assuming I was fine with my ISP seeing that I'm using TOR, is there any reason to choose TOR over VPN instead of VPN over TOR? I read the TOR page on this site, but I just want to be sure there aren't cases in which I shouldn't choose VPN over TOR. I've heard some people talk about wanting to hide from their ISP the fact that they are using TOR. Why is this? Do some ISPs not tolerate their customers using TOR?

Hi AirVPN, I would like to make a suggestion for a DNS only geolocation bypass like usunblock and other similar services as a extra or complimentary service to go with your VPN service. I suggest this because devices like Chromecast don't work when you for example connect your iPhone to the US VPN and try and cast it doesn't work as the iPhone no longer sees the Chromecast on the network. I think this feature would also be good for other devices that don't provide VPN support or for people that just want to access content their not able too just because they live in a different country. Corey

I use OpenVPN GUI instead of AirVPN software because I use OpenVPN in other ways, so I use the AirVPN Config Generator. The generated configuration files work well except for the lack of DNS configuration. As a result, to use AirVPN DNS I have to add the following line to each generated configuration: dhcp-option DNS 10.4.0.1 Please enhance the Config Generator to do this automatically. Ideally this would be a DNS choice of: AirVPN DNS (default)User specified DNS (2)No DNS settingThanks for listening.

Forgive me for asking the obvious.... what is air's DNS address ? This sites tech specs page https://airvpn.org/specs/ gives an address of 10.4.0.1 for UDP over port 443 When I test my DNS I don't see this address. Does each server have it's own DNS or is there 1 DNS address for all air servers ? I need to manually set the DNS to prevent leaks in openSUSE any help much appreciated.

Hi, Thanks for a great VPN service. I've been using the Windows client so far with no problems. However, I recently bought an Asus RT-N16 router for the purpose of bridging with the router upstairs, in order to get a wired Internet connection downstairs. This worked out well. I also wanted to use openVPN on the router downstairs using tomato (shibby), but I've run into a problem. In the howto article it says I have to change the DNS servers under basic/networking, but the problem is as the router is bridged to the router upstairs, the gateway and first DNS address is the LAN address to the router upstairs. I've tried setting up openVPN without changing the DNS settings, but it didn't seem to work very well (at all). Is it possible to use openVPN on a tomato router that is bridged to another router that it gets the internet access from?

Hello, For me Tunnelblick (MacOS) will not connect to AirVPN servers when I have DNSCrypted enabled - and works like a charm when i disable it. Is it possible to use DNSCrypt and be connected to AirVPN servers via Tunnelblick at the sametime and if so, how ? Thank you

help !! i've set up pfsense to work with airvpn. my ip address shows as the desired location and it makes me think everything is set up correctly. but . . . when i do a dns test it shows my true ip address from the internet company. also, when i log on to this web site it indicates "not connected" and shows the same ip address. i have tried various combinations for the dns settings of general setup. for the dns server i have 10.0.5.1 and 10.0.4.1. i've tried various combinations of the "allow dns server list" box and the "do not use the dns forwarder" box. what am i missing? what settings do i need to mask my ip address with no dns leaks??? this noob appreciates any assistance.

Hi This isn't fully an AirVPN problem, but since I installed a patch fixing a DNS leak, it's been a nuisance. You can find the fix here: https://www.dnsleaktest.com/how-to-fix-a-dns-leak.php Basically, I was on Riseup VPN at the time. I took a DNS leak test at dns-oarc.net and it gave results for both Riseup's VPN and an IP belonging to my ISP near where I live. Apparently DNS leaks are a common problem for users of OpenVPN on Windows. I'm on Windows Vista. I installed a fix, and it worked. However, since then I've had to manually reset my IPv4 and DNS settings to "obtain automatically" in the Network and Sharing Centre in Control Panel every time I switch on my computer. Otherwise, it doesn't connect to the internet, only "local only". So I got AirVPN today and the problem is persisting. Not only that, but every time I want to switch server I need to reset the IPv4 and DNS settings again. I also had to re-run the DNS leak fix because it was leaking with AirVPN as well. It leaked in both OpenVPN and the AirVPN client. I've chosen to use OpenVPN because it allows me to use the fix, which has worked apart from the frustrating problem described here. Anyone know how to fix this?

Yesterday, within 10 minutes, IPTABLES blocked more than 200 outbound packets on port 88 on tun0, with SRC=10.50.0.106 (AirVPN DNS through SSL tunnel) and DST= three IP addresses: 184.75.214.162 (amanah.com), 184.75.221.2 (amanah.com), and 46.19.137.114 (regika.com). I understand these are both AirVPN servers. At the time, I was connected to Carinae through an SSL tunnel. A little googling suggests the traffic was connected to recursive AirVPN DNS servers. Would the fact that the packets were blocked cause any problems? It didn't seem to, but would it be advisable to add an IPTABLES rule allowing outbound traffic on tun0 port 88 where SRC=10.50.0.0/24?

Hi there, Just installed AirVPN. I can connect to airvpn.org without any issues, but not to any other site. I have tried both with UDP and TCP. I'm using Bodhi Linux. If I ping 10.4.0.1 everything seems to be fine: PING 10.4.0.1 (10.4.0.1) 56(84) bytes of data. 64 bytes from 10.4.0.1: icmp_req=1 ttl=64 time=226 ms 64 bytes from 10.4.0.1: icmp_req=2 ttl=64 time=136 ms 64 bytes from 10.4.0.1: icmp_req=3 ttl=64 time=137 ms 64 bytes from 10.4.0.1: icmp_req=4 ttl=64 time=136 ms 64 bytes from 10.4.0.1: icmp_req=5 ttl=64 time=136 ms 64 bytes from 10.4.0.1: icmp_req=6 ttl=64 time=252 ms 64 bytes from 10.4.0.1: icmp_req=7 ttl=64 time=141 ms 64 bytes from 10.4.0.1: icmp_req=8 ttl=64 time=258 ms 64 bytes from 10.4.0.1: icmp_req=9 ttl=64 time=244 ms 64 bytes from 10.4.0.1: icmp_req=10 ttl=64 time=230 ms 64 bytes from 10.4.0.1: icmp_req=11 ttl=64 time=205 ms 64 bytes from 10.4.0.1: icmp_req=12 ttl=64 time=137 ms 64 bytes from 10.4.0.1: icmp_req=13 ttl=64 time=137 ms 64 bytes from 10.4.0.1: icmp_req=14 ttl=64 time=136 ms ^C --- 10.4.0.1 ping statistics --- 14 packets transmitted, 14 received, 0% packet loss, time 13054ms rtt min/avg/max/mdev = 136.783/179.914/258.041/50.208 ms Same if I ping 8.8.8.8: PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_req=1 ttl=48 time=178 ms 64 bytes from 8.8.8.8: icmp_req=2 ttl=48 time=178 ms 64 bytes from 8.8.8.8: icmp_req=3 ttl=48 time=178 ms 64 bytes from 8.8.8.8: icmp_req=4 ttl=48 time=178 ms 64 bytes from 8.8.8.8: icmp_req=5 ttl=48 time=178 ms 64 bytes from 8.8.8.8: icmp_req=6 ttl=48 time=178 ms 64 bytes from 8.8.8.8: icmp_req=7 ttl=48 time=178 ms ^C --- 8.8.8.8 ping statistics --- 7 packets transmitted, 7 received, 0% packet loss, time 6026ms rtt min/avg/max/mdev = 178.244/178.580/178.917/0.377 ms traceroute google.com doesn't produce any results, it just hangs in there forever. Thanks!

EDIT 20:04 CET+1 06-May-13 Problem solved Hello! We regret to inform you that we are currently experiencing DNS problems on the following servers in the Netherlands: Ophiuchi LeporisLyncisOrionisCastorCorviThe problem affects DNS resolution. You might be unable to resolve some (and only some) names with our internal DNS (10.4.0.1, 10.5.0.1, ... , 10.9.0.1). The problem is external: it is not caused by our DNS or configuration. We're anyway working to solve it as soon as possible. In the meantime, as a momentary work-around (not compromising security): on Linux, OpenBSD and FreeBSD, just set a public DNS on your nameservers list after the connection. Example: in /etc/resolv.conf add the line "nameserver "on Windows, on your TAP-Win32 network interface (NOT on your physical network card) after the connection set preferred and alternate DNS IP addressalternatively, simply connect to any of our servers not included in the above list We will update this post as soon as the problem is solved. We apologize for the inconvenience not caused by us. Kind regards

Hi, I use the standard DNS 10.4.0.1. but it gives me troubles when in web development. The problem is that I run a certain amount of websites which I maintain. When I change DNS settings on those websites, within a few minutes I can use those settings when running on my ISP's DNS servers. When i change to the AirVPN DNS, it sometimes takes more than a day to see those changes. Is there a possibility to speed up that process? How often do you retrieve new DNS information? To be honest, it is not always like that, sometimes you do the change within the hour, but it is always slower than my ISP's one. Regards, 0fficer