Search the Community

TL/DR -- Gluetun Healthcheck directive fails, possibly because Bell is not allowing DNS queries to cloudflare. Apologies, I should be posting this, probably on the Gluetun wiki, but any help welcome. I have a new-to-me Asustor NAS that I am starting to configure as a more general purpose server deploying locally hosted docker containers/stacks. As an early step, I am working to be able run some containers behind a vpn connection. The vendor offers proprietary VPN configurations, but I am not confident in them. Consequently, I have been working to get a dockerized AIRVPN service up and running. A very common wireguard image for doing this is GLUETUN. I learned here that they now, in theory, support AIRVPN. My issue is that gluetun seems to connect to AIRVPN, but then for reasons that are unclear to me, related to the healthcheck directive, it disconnects and cycles until it eventually times out. Thanks to some users here, I have constructed what appears to my inexperienced eyes to be a viable docker compose file: services: gluetun: image: 'qmcgaw/gluetun:latest' container_name: gluetun cap_add: - NET_ADMIN devices: - '/dev/net/tun:/dev/net/tun' volumes: - /volume1/Docker/gluetun:/gluetun environment: - VPN_SERVICE_PROVIDER=airvpn - VPN_TYPE=wireguard - WIREGUARD_PUBLIC_KEY=**************** - WIREGUARD_PRIVATE_KEY=*************** - WIREGUARD_PRESHARED_KEY=************* - WIREGUARD_ADDRESSES=10.170.255.172/32 - SERVER_COUNTRIES=Canada - FIREWALL_VPN_INPUT_PORTS=**** - TZ="America/Montreal" - UPDATER_PERIOD=24h ports: - '8080:8080' - '****:****' restart: unless-stopped It seems to be almost working, but I am not sure why it is failing. BTW, I am running pihole as a local DNS server on the same machine, which got me past an earlier glitch. It seems that there is still a DNS issue, but I can't figure it out from the log. The container starts, glitches and restarts whenI run the following command: docker compose -f /volume1/Docker/media_dl/gluetun.yml run gluetun The console output below provides clues that I hope you can help me use to sort out the issue: 💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12 2025-04-13T20:29:58Z INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4 2025-04-13T20:29:58Z INFO [routing] local ethernet link found: eth0 2025-04-13T20:29:58Z INFO [routing] local ipnet found: 172.18.0.0/16 2025-04-13T20:29:58Z INFO [firewall] enabling... 2025-04-13T20:29:58Z INFO [firewall] enabled successfully 2025-04-13T20:29:59Z INFO [storage] merging by most recent 20776 hardcoded serve rs and 20776 servers read from /gluetun/servers.json 2025-04-13T20:29:59Z INFO Alpine version: 3.20.5 2025-04-13T20:29:59Z INFO OpenVPN 2.5 version: 2.5.10 2025-04-13T20:29:59Z INFO OpenVPN 2.6 version: 2.6.11 2025-04-13T20:29:59Z INFO IPtables version: v1.8.10 2025-04-13T20:29:59Z INFO Settings summary: ├── VPN settings: | ├── VPN provider settings: | | ├── Name: airvpn | | └── Server selection settings: | | ├── VPN type: wireguard | | ├── Countries: canada | | └── Wireguard selection settings: | | └── Server public key: *************** hk= | └── Wireguard settings: | ├── Private key: GJn...VI= | ├── Pre-shared key: odJ...Cc= | ├── Interface addresses: | | └── 10.170.255.172/32 | ├── Allowed IPs: | | ├── 0.0.0.0/0 | | └── ::/0 | └── Network interface: tun0 | └── MTU: 1320 ├── DNS settings: | ├── Keep existing nameserver(s): no | ├── DNS server address to use: 127.0.0.1 | └── DNS over TLS settings: | ├── Enabled: yes | ├── Update period: every 24h0m0s | ├── Upstream resolvers: | | └── cloudflare | ├── Caching: yes | ├── IPv6: no | └── DNS filtering settings: | ├── Block malicious: yes | ├── Block ads: no | ├── Block surveillance: no | └── Blocked IP networks: | ├── 127.0.0.1/8 | ├── 10.0.0.0/8 | ├── 172.16.0.0/12 | ├── 192.168.0.0/16 | ├── 169.254.0.0/16 | ├── ::1/128 | ├── fc00::/7 | ├── fe80::/10 | ├── ::ffff:127.0.0.1/104 | ├── ::ffff:10.0.0.0/104 | ├── ::ffff:169.254.0.0/112 | ├── ::ffff:172.16.0.0/108 | └── ::ffff:192.168.0.0/112 ├── Firewall settings: | ├── Enabled: yes | └── VPN input ports: | └── **** ├── Log settings: | └── Log level: info ├── Health settings: | ├── Server listening address: 127.0.0.1:9999 | ├── Target address: google.com | ├── Duration to wait after success: 5s | ├── Read header timeout: 100ms | ├── Read timeout: 500ms | └── VPN wait durations: | ├── Initial duration: 6s | └── Additional duration: 5s ├── Shadowsocks server settings: | └── Enabled: no ├── HTTP proxy settings: | └── Enabled: no ├── Control server settings: | ├── Listening address: :8000 | ├── Logging: yes | └── Authentication file path: /gluetun/auth/config.toml ├── Storage settings: | └── Filepath: /gluetun/servers.json ├── OS Alpine settings: | ├── Process UID: 1000 | ├── Process GID: 1000 | └── Timezone: america/montreal ├── Public IP settings: | ├── IP file path: /tmp/gluetun/ip | ├── Public IP data base API: ipinfo | └── Public IP data backup APIs: | ├── ifconfigco | ├── ip2location | └── cloudflare ├── Server data updater settings: | ├── Update period: 24h0m0s | ├── DNS address: 1.1.1.1:53 | ├── Minimum ratio: 0.8 | └── Providers to update: airvpn └── Version settings: └── Enabled: yes 2025-04-13T20:46:31Z INFO [routing] default route found: interface eth0, gateway 172.19.0.1, assigned IP 172.19.0.2 and family v4 2025-04-13T20:46:31Z INFO [routing] adding route for 0.0.0.0/0 2025-04-13T20:46:31Z INFO [firewall] setting allowed subnets... 2025-04-13T20:46:31Z INFO [routing] default route found: interface eth0, gateway 172.19.0.1, assigned IP 172.19.0.2 and family v4 2025-04-13T20:46:31Z INFO [dns] using plaintext DNS at address 1.1.1.1 2025-04-13T20:46:31Z INFO [http server] http server listening on [::]:8000 2025-04-13T20:46:31Z INFO [healthcheck] listening on 127.0.0.1:9999 2025-04-13T20:46:31Z INFO [firewall] allowing VPN connection... 2025-04-13T20:46:31Z INFO [wireguard] Using available kernelspace implementation 2025-04-13T20:46:31Z INFO [wireguard] Connecting to 139.28.218.234:1637 2025-04-13T20:46:31Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working. 2025-04-13T20:46:31Z INFO [firewall] setting allowed input port **** through interface tun0... 2025-04-13T20:46:31Z INFO [dns] downloading hostnames and IP block lists 2025-04-13T20:46:41Z INFO [healthcheck] program has been unhealthy for 6s: restarting VPN (healthcheck error: dialing: dial tcp4: lookup cloudflare.com: i/o timeout) 2025-04-13T20:46:41Z INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md 2025-04-13T20:46:41Z INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION 2025-04-13T20:46:41Z INFO [vpn] stopping The healthcheck directive of Gluetun uses the following command to verify that the interface is up: ping -W 1 -w 1 -q -s 8 1.1.1.1 Using the same command on the NAS, I get 100% packet loss, though on my desktop (that used the Pihole NAS I see: PS C:\Windows\system32> ./ping.exe -w 1 -s 4 1.1.1.1 Pinging 1.1.1.1 with 32 bytes of data: Reply from 1.1.1.1: bytes=32 time=201ms TTL=59 Timestamp: 10.11.10.1 : 75717118 -> 77.243.185.75 : 75717122 -> 162.158.124.1 : 75717239 -> 1.1.1.1 : 75717240 Reply from 1.1.1.1: bytes=32 time=155ms TTL=59 Timestamp: 10.11.10.1 : 75718136 -> 77.243.185.75 : 75718141 -> 162.158.124.1 : 75718219 -> 1.1.1.1 : 75718219 Reply from 1.1.1.1: bytes=32 time=117ms TTL=59 Timestamp: 10.11.10.1 : 75719155 -> 77.243.185.75 : 75719160 -> 162.158.124.1 : 75719194 -> 1.1.1.1 : 75719194 Reply from 1.1.1.1: bytes=32 time=87ms TTL=59 Timestamp: 10.11.10.1 : 75720172 -> 77.243.185.75 : 75720176 -> 162.158.124.1 : 75720192 -> 1.1.1.1 : 75720193 I suspect that Bell DNS is blocking cloudflare. I will let you know if I can find another healthcheck configuration that works. Thanks for bearing with me. This has been longer than I expected.

I am using a Firewalla Gold Plus, and I have been assigning a different VPN .conf file to each of the 5 VPN nodes on the Firewalla Gold Plus, and then selectively routing devices through these as I see fit. I was curious if anyone else is using this particular hardware, and what your .conf or .ovpn configuration files are like, and if you do anything in particular within the Firewalla itself in terms of adjusting the configuration of that too.. I am just trying to get what can hopefully be the most optimized, efficient and secure setup while using these together as I have been.. Anyone with any insight, wisdom, knowledge, experience, suggestions, etc that are willing to take the time to share, for this I would be most sincerely grateful! Thank you :)

Hello, I have purchased a glinet flint2 router on which I have installed a vpn (wireguard client).Connected to this router are a synology NAS and an old pc on which I have installed rockylinux workstation (with a mate graphic interface).On the NAS and the pc are running the torrent transmission client.The transmission listening ports are open.In short, everything seems to be working with the torrent client. For security reasons, I was just wondering if the router's firewall setting was correct (?). I haven't found much information on this subject. Thanks for any help Translated with DeepL.com (free version)

Hello, I have an issue with port forwarding and my ASUS router. I've got an ASUS route, running the latest stock firmware (3.0.0.4.388_23013) with mostly default settings. The router is directly connected to a modem in bridge mode so there's no double NAT. I imported a wireguard profile and assigned my NAS to this profile. So far everything works good and as expected, and the VPN connection is active for my NAS. Most posts in this forum seem to be about the ASUS merlin firmware, but I'd rather not install a custom firmware if not necessary. For my setup: I am running an owncloud docker instance on my synology NAS and want to access it with port forwarding on the internet. Therefore I went to https://airvpn.org/ports/ and assigned a port and DDNS entry. My owncloud docker container has the port 8080 assigned as local and container port and I can access it correctly with my local ip:port. The port entry has port X assigned and as local port I setup 8080 to match the owncloud port. If I now test the port status with "test open" on the ports page, I just get the "Connection timed out (110)" error. Afaik, there shouldn't be any custom port forwarding rules necessary in my router settings, as the FAQ says don't forward the ports you want to use in the router, as that might be a security risk (?). Also accessing the ddns:port address and checking the outgoing ip:port gives also connection timeout in my browser. For testing I also forwarded a random other port and tried to listen on it on my windows pc with openvpn active and that yielded the same results. Forwarding a random port in my router and then listening to it without vpn worked though, as some testing webpage showed that this port is open then. I tried to troubleshoot it with the help of ChatGPT, but all the ideas it had, didn't yield and results or improvements. Am I missing something? There doesn't seem to be any special settings regarding the VPN Fusion connection and any type of port forwarding etc.

Hi- I've used AirVpn for years and love it, but I connect using a single Windows computer inside my network. Canada is introducing some new draconian internet laws soon, and I wanted to know if it was possible to configure my Unifi Dream Machine Router to send all of my traffic thru one of the VPN servers. I searched for a few things and couldn't find any instructions for my router. Can anyone point me in the right direction? Or is this not possible? Thanks for any help you can provide.

Hi everyone, i have just signed up for three days to test and cant seem to connect to my router through the merlin openvpn client settings page. it says connected but in vpn status it just says connecting and never does? cant find any specific info for airvpn router setup guides either..

Using AirVPN with OpenWRT This guide is for users who want to set up a OpenWRT (Chaos Calmer) router and have it already up and running without modification. This guide will work with a router that has more than one network interface and at least 8 MB flash (because of the dependencies). Please backup your router first!!! 1. Set up the wan interface as a dhcp client, that way you can use your router at most of the isp boxes. 2. Set up a wireless network with the name and password of you choise, a dhcp server. (Please note that you should use WPA2-PSK). 3. Connect to your new wireless network. 4. Unbridge the LAN interface(s). Go to "Physical Settings" of the LAN interface(s) and uncheck the "creates a bridge over specified interface(s). Check the interface button of your new wireless network. 5. Connect to your router via SSH. 6. Install dependencies for the openvpn setup. First update the packages, than install openvpn and nanoopkg update opkg install openvpn-openssl opkg install nano 7. Backup the openvpn files mv /etc/config/openvpn /etc/config/openvpn_old 8. Create a new interface called airvpncat >> /etc/config/network << EOFconfig interface 'airvpn' option proto 'none' option ifname 'tun0'EOF 9. Use the "Config Generator" of Airvpn to create the openvpn files. Please select the "Advanced Mode" and check "Separate keys/certs from .ovpn file" and"Resolved hosts in .ovpn file". Save the files on your machine. 10. On the router move into the openvpn folder cd /etc/openvpn 11. Use nano to create all the required files on your router.Copy and paste the following files "AirVPN_**************.ovpn, ta.key, ca.crt, user.crt, user.key".Rename the "AirVPN_**************.ovpn" into airvpn.conf for usability.nano airvpn.conf nano ta.key nano ca.crt nano user.crt nano user.key The air.conf should look like this clientdev tunproto udpremote xxx.XXX.xxx.XXX XXXresolv-retry infinitenobindpersist-keypersist-tunremote-cert-tls servercipher AES-256-CBCcomp-lzo noroute-delay 5verb 3ca ca.crtcert user.crtkey user.keytls-auth ta.key 1 12. Create a firewall zone for the vpn.cat >> /etc/config/firewall << EOFconfig zone option name 'air_firewall' option input 'REJECT' option output 'ACCEPT' option forward 'REJECT' option masq '1' option mtu_fix '1' option network 'airvpn' config forwarding option dest 'air_firewall' option src 'lan' EOF 13. Reboot router 14. Test openvpn configurationopenvpn --cd /etc/openvpn --config /etc/openvpn/airvpn.confAt the end it should show "Initialization Sequence Completed"Stop openvpn with "Ctrl-C". 15. Use the Airvpn DNS (here Port 443 - Protocol UDP) and reboot. Please change if you use different port (https://airvpn.org/specs/)uci add_list dhcp.lan.dhcp_option="6,10.4.0.1"uci commit dhcpreboot 16. Secure against IP Leak, backup old firewall and create new firewall rules mv /etc/config/firewall /etc/config/firewall.backup cat >> /etc/config/firewall << EOF config defaults option syn_flood '1' option input 'ACCEPT' option output 'ACCEPT' option forward 'REJECT' config zone option name 'lan' option network 'lan' option input 'ACCEPT' option output 'ACCEPT' option forward 'REJECT' config zone option name 'wan' option output 'ACCEPT' option forward 'REJECT' option network 'wan' option input 'ACCEPT' config zone option name 'airvpn' option input 'REJECT' option output 'ACCEPT' option forward 'REJECT' option masq '1' option mtu_fix '1' option network 'airvpn' config rule option name 'Allow-DHCP-Renew' option src 'wan' option proto 'udp' option dest_port '68' option target 'ACCEPT' option family 'ipv4' config rule option name 'Allow-Ping' option src 'wan' option proto 'icmp' option icmp_type 'echo-request' option family 'ipv4' option target 'ACCEPT' config rule option name 'Allow-DHCPv6' option src 'wan' option proto 'udp' option src_ip 'fe80::/10' option src_port '547' option dest_ip 'fe80::/10' option dest_port '546' option family 'ipv6' option target 'ACCEPT' config rule option name 'Allow-ICMPv6-Input' option src 'wan' option proto 'icmp' list icmp_type 'echo-request' list icmp_type 'echo-reply' list icmp_type 'destination-unreachable' list icmp_type 'packet-too-big' list icmp_type 'time-exceeded' list icmp_type 'bad-header' list icmp_type 'unknown-header-type' list icmp_type 'router-solicitation' list icmp_type 'neighbour-solicitation' list icmp_type 'router-advertisement' list icmp_type 'neighbour-advertisement' option limit '1000/sec' option family 'ipv6' option target 'ACCEPT' config rule option name 'Allow-ICMPv6-Forward' option src 'wan' option dest '*' option proto 'icmp' list icmp_type 'echo-request' list icmp_type 'echo-reply' list icmp_type 'destination-unreachable' list icmp_type 'packet-too-big' list icmp_type 'time-exceeded' list icmp_type 'bad-header' list icmp_type 'unknown-header-type' option limit '1000/sec' option family 'ipv6' option target 'ACCEPT' config include option path '/etc/firewall.user' config forwarding option dest 'airvpn' option src 'lan' EOF TEST WITH ipleak.net...It worked that way with my router, i would be happy if someone else could verify my setup.

I purchased my first GL.Inet product and first thing I did was setup my AIRVPN OpenVPN on it - works flawlessly. My only question is Wireguard is supported and since the firmware of the router is based on openwrt, it has alot of configuration. Has anybody have success on having AirVPN on Wireguard on this router? If yes, what is the easiest setup to do?

Hello everyone, I need a recommendation for a decent/not-expensive router with OpenVpn to be used with AirVPN. I took a look at something like GL.iNet GL-MT300N... ...BUT they seem to be chinese tools with vulnerabilities and backdoors, so that is for me like bodyjumping from a plane with a very good helmet but a very bad parachute. I suppose that people here in the forum should have good answers and experience in this topic. So, could you please recommend some portable/small Routers for Airvpn with no vulnerabilities and with a decent level of security? Thanks in advance!!

Hello all, If I read and understand the forum correctly, I’m not the only one who is unable to set up a port forwarding with vpn. Because I have tried all sorts of things and cannot find a solution, I’m curious if there is someone who can help me out on this. What I want to do: I want to acces my NASserver and my Webcam from outside my network. This requires three ports. I chose Air vpn because they support port forwarding and I bought an Asus router (RT-AC66U) that has a vpn-server and that also has a vpn-client. My network configuration is set as follows: - modem / router from ISP (iprange 192.168.xxx.xxx) - behind it the Asus router (iprange 192.169.xxx.xxx) - WAN port Asus router is connected to LAN port of ISP - behind Asus router an additional router (sitecom) that serves as an "amplifier". These routers are connected by a cable between LAN. The sitecom router has a fixed IP address within the range of the Asus router. - DHCP from sitecom is switched off. Asus router controls the allocation of IP addresses and handling of internet traffic. This setup has always worked great (without VPN). After setting up a vpn-client, all computers, phones etc can acces the internet without any problems. The NASserver is able to make a backup via a built-in SSH to a server at a different location (outside LAN). It is no longer possible to access the NAS server from outside the LAN via http / ftp / sftp. I tried the following to get it working: - vpn server enabled / vpn client disabled - vpn server enabled & vpn client enabled - nasserver provided with ipadress within range of vpn-server - routes - Port forwarding set from VPN server to LAN and vice versa I don't get it working. Thanks in advance for your tips and help Kind regards, Ivo

I am running XP Pro, but would prefer to install AirVPN on my router (MikroTik hex rb750gr3). I'm finding conflicting info on whether or not this is possible, and hoping someone here can decipher this, and provide a definite answer. From what I have been able to figure out, the AirVPN client is not compatible, which leaves OpenVPN client as the only possibility. Here things become murky. According to MikroTik site (https://wiki.mikrotik.com/wiki/OpenVPN) it is supported. According to other forums, it is not supported very well. I'd like to hear opinions as to whether or not installing AirVPN on my router is likely to be successful, or more likely a waste of time. If the latter, any suggestions for a replacement router to buy? Note that I will purchase 'wired-only' routers, and my budget ends at $300. I never buy any sort of wireless, wi-fi, or bluetooth devices. So far, the only 'wired-only' routers I have found are Cisco and Ubiquiti brands.

Hello, I was curious what would happen if I used AirVPN with ASUS Merlin router and have Eddie installed on a windows 10 workstation at the same time. Obv trying to avoid IP leaking. Would using AirVPN on an ASUS router with Merlin be just as reliable as the Eddie software? Eddie has been rocksolid and as far as I know has never had a leak, the network lock works great.. But I would really love to switch things up and get a new router with AirVPN installed on it. I have concerns that the killswitch or lock on the router is not as realiable as Eddies custom client. On the ASUS router, if I use the .ovpn file from AirVPN and also configure the killswitch policy rules to only let out VPN connections would that be just as reliable as the Eddie client? Is it possible to install the client on the PC along with AIR on the router? That way most of my devices will use the router vpn and a couple workstations can use the Eddie client and connect to the VPN router, kinda like a double killswitch. Im just looking for ideas or any feedback. Which would you guys trust more... the killswitch on router or network lock on eddie? Thank you!

Hello, I was messing around with a local web page hosted on my raspberry pi for local projects, and using that web page works fine from my pc which has an ethernet cable to my router. However when I try to access the page with my android phone, I cannot connect to the web page. I can also not reach my router admin page from my android device, something that DOES work on my pc... All three devices: pc, android phone, raspberry pi are running on AirVPN. The moment I disconnect from the VPN, I can access the admin panel and the website from my phone. Is there a way to make devices connected via wifi while using the VPN able to access my router / other local machines? Thanks in advance.

Someone I might know has found recently while torrenting the download speed suddenly drops dramatically to almost zero and on many occasions the modem router suddenly loses line sync. Prior to disconnection openvpn (running in a terminal window) reports numerous possible replay attacks. Setup is Ubuntu 16.06 LTS running openvpn with ovpn files from config generator (keys separate, hosts resolved). Numerous different servers and ports have been tried. ovpn files modified to run update-resolv-conf on up / down. ipv6 disabled in grub.cfg. ufw used to deny all incoming ports except 67,68/udp 80,443/tcp and the airvpn mapped port over tcp (further restricted to tun0 interface). Are they just being paranoid or is their ISP or some other actor able to detect torrent activity and cause the router to disconnect?

This is only a solution for people in their home country willing/wanting to bypass the VPN to access their Netflix account. Does not help for out-of-country Netflix access. I was surprised to not see this in the forum, as it's very simple and works. It is a very short script added to the Custom Configuration which pulls the current IP addresses for a domain name (Netflix.com, Hulu.com) and routes those addresses "around" the VPN. allow-pull-fqdn route www.netflix.com 255.255.255.255 net_gateway So far I've been using this for a day, and had to restart things one time to get it to pick up new addresses. I would like to find a way to run this at regular intervals to add to the IP list (without duplicating addresses already in the list).

Hi. When connected to an AirVPN-server through a VPN-router... Are there any fixed IPs on the VPN-server that can be used to ping for monitoring the quality of the VPN connection (RRD graphs etc)? I used to be able to use 10.x.0.1 but they do not seem to respond to pings anymore. What is the correct IP to use for this purpose? Kind regards,

Step 1: First configure the Tomato VPN client (I am using Shibby's AIO build 134, but any of the recent VPN builds that have policy based routing included should work) so that all traffic is sent through the VPN and ensure that works. Once that is working, you can continue. Getting that working is outside the scope of this guide, and a good guide can be found here. Step 2: On the 'Advanced' tab of the VPN client, check the Ignore Redirect Gateway (route-nopull) option and on the Routing Policy tab, check the Redirect Through VPN option, and add the devices you want to redirect through the VPN. In my case, I added Source IP 192.168.1.120, as this is the only client on my LAN I want to be routed through the VPN. Once that's done, ensure the VPN client is running and see if you have internet access through the tunnel for the specified client. I use ipleak.net to test. You will likely notice that while your IP address is that of the VPN, DNS is still being served by whichever DNS servers your router has configured. This is normal, and is solved in step 3. Step 3: On the Advanced -> DHCP/DNS tab, in the advanced configuration: # Create a tag for clients to use a specific DNS server dhcp-option=tag:vpn,option:dns-server,10.30.0.1 # Tell these clients when they connect to use the VPN tag dhcp-host=XX:XX:XX:XX:XX:XX,set:vpn,hostnameyouwanttouse,192.168.1.120 The XX:XX:XX:XX:XX:XX above is the MAC address of your device's network interface. You can find this easily on the Status -> Device List tab. This line is essentially assigning static DHCP for the client with the MAC address specified. This tells all clients tagged as 'vpn' to use 10.30.0.1 as their DNS server. Disconnect your client that you wish to route through the VPN and reconnect it so that it renews the DHCP lease. You may also need to flush the DNS on the client. On Windows this is done from a command prompt run as administrator and typing: ipconfig /flushdnsNote: I am connecting to air on port 2018 to make QoS rules easier, so that's why you see 10.30.0.1 for the DNS server. Use whichever Air DNS server is appropriate for your connection. Step 4: Now, in Administration -> Scripts -> Firewall add the following: iptables -t nat -I PREROUTING -i br0 -s 192.168.1.120 -p udp --dport 53 -j DNAT --to 10.30.0.1 iptables -t nat -I PREROUTING -i br0 -s 192.168.1.120 -p tcp --dport 53 -j DNAT --to 10.30.0.1 iptables -I FORWARD ! -o tun11 -s 192.168.1.120 -j DROP The first two lines prevent the specified client from specifying their own DNS servers, so if this is an issue for you, these rules will make sure the client always uses Air's DNS server. The third line prevents ANY traffic from that client using anything other than the VPN interface "tun11". Note: tun11 is the interface Tomato creates for VPN Client 1. If you use VPN Client 2 use tun12 instead. Routing an entire bridge: To take this a step further I also created an entire bridge (br1) on a different subnet (172.16.0.1/24), and a virtual wireless network on that bridge that 100% uses the VPN tunnel. The rules for an entire subnet are a little different. Configuring additional bridges and virtual wireless access points in Tomato is outside the scope of this guide. Again, in the VPN Client Policy Routing tab, add the "Source IP" and enter 172.16.0.0/24, then in Advanced -> DHCP/DNS: dhcp-option=tag:br1,option:dns-server,10.30.0.1 This tells all clients that connect to br1 to use 10.30.0.1 as their DNS server. Tomato, by default, tags the clients with the bridge they are connected to, so that's all that is required to tell clients on that bridge to use a different DNS server. Then in the Firewall: iptables -t nat -I PREROUTING -i br1 -p udp --dport 53 -j DNAT --to 10.30.0.1 iptables -t nat -I PREROUTING -i br1 -p tcp --dport 53 -j DNAT --to 10.30.0.1 iptables -t nat -I POSTROUTING -s 172.16.0.1/255.255.255.0 -o tun11 -j MASQUERADE iptables -I FORWARD -i br1 -o tun11 -j ACCEPT iptables -I FORWARD -i tun11 -o br1 -j ACCEPT iptables -I FORWARD ! -o tun11 -s 172.16.0.1/255.255.255.0 -j DROP Again, the first two lines prevent clients from specifying their own DNS servers. The next three lines are required, as Tomato's VPN client doesn't automatically add them for bridges other than br0. Without these, no traffic will move between br3 and tun11 (and hence, you will not get a connection). The last line prevents all traffic on br1 if the VPN is down. Port Forwarding: This is straight from AirVPN's FAQ, copied here for completeness. To forward ports to clients, four firewall rules are required for each port you wish to forward. Here I am forwarding port 12345 (both UDP and TCP) to my one VPN'd client on my main LAN.: iptables -I FORWARD -i tun11 -p udp -d 192.168.1.120 --dport 12345 -j ACCEPT iptables -I FORWARD -i tun11 -p tcp -d 192.168.1.120 --dport 12345 -j ACCEPT iptables -t nat -I PREROUTING -i tun11 -p tcp --dport 12345 -j DNAT --to-destination 192.168.1.120 iptables -t nat -I PREROUTING -i tun11 -p udp --dport 12345 -j DNAT --to-destination 192.168.1.120 Preventing leaks on the main LAN when not using policy routing: If you are not interested in policy based routing, and just want to prevent leaks while routing all traffic through the VPN, make sure you check Redirect Internet traffic in the VPN Client Advanced tab and then the following firewall rules: iptables -t nat -I PREROUTING -i br0 -p udp --dport 53 -j DNAT --to 10.30.0.1 iptables -t nat -I PREROUTING -i br0 -p tcp --dport 53 -j DNAT --to 10.30.0.1 iptables -I FORWARD ! -o tun11 -s 192.168.1.1/255.255.255.0 -j DROP The above is completely untested by me as I don't want to route my main LAN (other than a single client) over the VPN. It may cause connectivity issues with the router itself if the tunnel goes down. If someone does test, please come back here and report your results! I hope this guide helps anyone wishing to use Tomato's VPN client to get connected and if you run in to any trouble, I am happy to try and help solve the issue. Troubleshooting: If something isn't working and you've entered everything correctly, I've found that rebooting the client you want routed through the VPN or restarting the VPN client can help. Also, rebooting the router will flush out anything left over between configuration steps and can sometimes solve problems. You can also rebuild the firewall rules in Tomato by going to the Tools->System Commands tab in the interface, and sending service firewall restart. If these don't help, double check that everything is configured appropriately.

Hi, I'm trying to use a NetGear R6300v1 as a VPN Router with the latest DD-WRT build I could find (dd-wrt.v24-36330_NEWD-2_K3.x_mega-R6300). I can establish a TCP/443 connection to AirVPN (using DE or NL servers) and everything is fine in my opinion: There seem to be no DNS leaks and when the VPN goes down the R6300v1 stops traffic over the WAN interface, just as I want it to. With my 100/40 MBit/s NetCologne DSL @ home I see about 15/13 MBit/s VPN Performance on the R6300v1 with TCP, I have not yet seen more than 30% CPU usage on the R6300v1 during Speedtests. Streaming 1080p YouTube videos in a browser window on a PC connected via LAN to the R6300v1 the CPU usage stays below 15%. Streaming 4K video to an iPad connected via 5 GHz WLAN results in 25% to 35% CPU usage on the R6300v1. This is using a TCP connection - I wonder if UDP would give me more performance and if I should strive further to get that up and running? My problem is: With the very same settings - AFAIK I don't have anything TCP exclusive in there - just switching to UDP for connecting to AirVPN I cannot browse anything anymore. DNS resolution still works with UDP, I can ping for example www.heise.de both in Windows and via SSH directly on the R6300v1, I just cannot browse to www.heise.de. On a sidenote, the same is true if I use 'OpenVPN connect' on an iPad (iOS 11.4.1) - when I generate a .ovpn config for TCP/443 to German servers all is well, same config just with UDP/443 not so much on the iPad, too. On a second sidenote, I can get the latest Tomato build I could find for the R6300v1 (tomato-Netgear-R6300V1_RT-AC6x--140-AIO-64K) to do the same and have the same UDP issue as with the DD-WRT load ... I settled for DD-WRT for now because it seems to me the hardware support, especially WLAN AC, is better in the more recent DD-WRT build I'm using. I think I'm either missing something obvious or UDP simply cannot work on the R6300v1 (and an iPad). If anybody has an idea what I should try differently with the settings, I'd very much appreciate the information. Thanks in advance, Kyle

Hello guys, I was wondering if there is a speed limitation while using OpenVPN with Router, technically it's AsusWRT, using Asus AC68. I saw some threads in AirVPN before, but I think they were dragged down to the bottom of the forum, since it's been quite some time. I'm upgrading to get better bandwidth, and I was wondering if this happens. Should it happen, does it have any fixes? Thank you in advance. Best Regards, J.Smith

Hello, I am not sure this is the right section for posting
. As a newb of VPN, I would like to know if anybody has setup a CISCO RV325 router for working with AirVPN and if he could share method and settings...I am currently using ASUS DD-WRT firmware with AirVPN but I had a look at the CISCO emulator and at first sight it does not look so friendly :-( so any help is really appreciated :-) .
 I searched in the forum and I did not find any reference to this device
. Do you think an appliance with pfsense would be more "safe", known the US approach to privacy matter? Thank you

Dear Team, I have installed stunnel on my linksys1900acs ddwrt router. now i am using the airvpn configurations to connect with i am getting following error daemon.err openvpn[28841]: Connection reset, restarting [0] Logs: Jun 11 00:47:08 DD-WRT daemon.notice stunnel: LOG5[ui]: stunnel 5.20 on arm-openwrt-linux-gnueabi platform Jun 11 00:47:08 DD-WRT daemon.notice stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.0.2d 9 Jul 2015 Jun 11 00:47:08 DD-WRT daemon.notice stunnel: LOG5[ui]: Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Jun 11 00:47:08 DD-WRT daemon.notice stunnel: LOG5[ui]: Reading configuration from file /opt/etc/stunnel/stunnel.conf Jun 11 00:47:08 DD-WRT daemon.notice stunnel: LOG5[ui]: UTF-8 byte order mark detected Jun 11 00:47:08 DD-WRT daemon.notice stunnel: LOG5[ui]: FIPS mode disabled Jun 11 00:47:08 DD-WRT daemon.info stunnel: LOG6[ui]: Initializing service [openvpn] Jun 11 00:47:08 DD-WRT daemon.notice stunnel: LOG5[ui]: Configuration successful Jun 10 20:48:18 DD-WRT daemon.warn openvpn[28841]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Jun 10 20:48:18 DD-WRT daemon.notice openvpn[28841]: Re-using SSL/TLS context Jun 10 20:48:18 DD-WRT daemon.notice openvpn[28841]: Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ] Jun 10 20:48:18 DD-WRT daemon.notice openvpn[28841]: Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ] Jun 10 20:48:18 DD-WRT daemon.notice openvpn[28841]: Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1572,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client' Jun 10 20:48:18 DD-WRT daemon.notice openvpn[28841]: Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1572,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server' Jun 10 20:48:18 DD-WRT daemon.notice openvpn[28841]: TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:1413 Jun 10 20:48:18 DD-WRT daemon.notice openvpn[28841]: Socket Buffers: R=[87380->87380] S=[16384->16384] Jun 10 20:48:18 DD-WRT daemon.notice openvpn[28841]: Attempting to establish TCP connection with [AF_INET]127.0.0.1:1413 [nonblock] Jun 11 00:48:18 DD-WRT daemon.notice stunnel: LOG5[0]: Service [openvpn] accepted connection from 127.0.0.1:48232 Jun 11 00:48:18 DD-WRT daemon.info stunnel: LOG6[0]: failover: round-robin Jun 11 00:48:18 DD-WRT daemon.info stunnel: LOG6[0]: s_connect: connecting 62.102.148.190:443 Jun 11 00:48:18 DD-WRT daemon.notice stunnel: LOG5[0]: s_connect: connected 62.102.148.190:443 Jun 11 00:48:18 DD-WRT daemon.info stunnel: LOG6[0]: SNI: sending servername: 62.102.148.190 Jun 11 00:48:18 DD-WRT daemon.info stunnel: LOG6[0]: CERT: Locally installed certificate matched Jun 11 00:48:18 DD-WRT daemon.notice stunnel: LOG5[0]: Certificate accepted at depth=0: C=IT, ST=Italy, L=Perugia, O=AirVPN, OU=stunnel, CN=stunnel.airvpn.org, emailAddress=info@airvpn.org Jun 11 00:48:18 DD-WRT daemon.info stunnel: LOG6[0]: SSL connected: new session negotiated Jun 11 00:48:18 DD-WRT daemon.info stunnel: LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) Jun 10 20:48:19 DD-WRT daemon.notice openvpn[28841]: TCP connection established with [AF_INET]127.0.0.1:1413 Jun 10 20:48:19 DD-WRT daemon.notice openvpn[28841]: TCPv4_CLIENT link local: (not bound) Jun 10 20:48:19 DD-WRT daemon.notice openvpn[28841]: TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:1413 Jun 11 00:48:19 DD-WRT daemon.info stunnel: LOG6[0]: SSL closed (SSL_read) Jun 10 20:48:19 DD-WRT daemon.err openvpn[28841]: Connection reset, restarting [0] Jun 10 20:48:19 DD-WRT daemon.notice openvpn[28841]: TCP/UDP: Closing socket Jun 10 20:48:19 DD-WRT daemon.notice openvpn[28841]: SIGUSR1[soft,connection-reset] received, process restarting Jun 10 20:48:19 DD-WRT daemon.notice openvpn[28841]: Restart pause, 160 second(s) Jun 11 00:48:19 DD-WRT daemon.info stunnel: LOG6[0]: Read socket closed (readsocket) Jun 11 00:48:19 DD-WRT daemon.info stunnel: LOG6[0]: SSL_shutdown successfully sent close_notify alert Jun 11 00:48:19 DD-WRT daemon.notice stunnel: LOG5[0]: Connection closed: 16 byte(s) sent to SSL, 0 byte(s) sent to socket My OpenVpn config ca /tmp/openvpncl/ca.crtcert /tmp/openvpncl/client.crtkey /tmp/openvpncl/client.keymanagement 127.0.0.1 16management-log-cache 100verb 3mute 3syslogwritepid /var/run/openvpncl.pidclientresolv-retry infinitenobindpersist-keypersist-tunscript-security 2dev tun1proto tcp4-clientcipher aes-256-cbcauth sha256remote 127.0.0.1 1413comp-lzo notun-mtu 1500mtu-disc yesresolv-retry infinitenobindpersist-keypersist-tunauth-nocacheverb 5route 62.102.148.190 255.255.255.255 net_gatewayremote-cert-tls servercipher AES-256-CBCkey-direction 1 My Stunnel Configclient = yesdebug = 6 [openvpn];ciphers = DHE-RSA-AES128-SHA256accept = 127.0.0.1:1413connect = 62.102.148.190:443TIMEOUTclose = 0verify = 3CAfile = /opt/etc/stunnel/stunnel.crt

Hi, I just purchased the ASUS RT-AC66U B1 router and intended to configure it to work with AirVPN. I visited the client area to download the configuration file for routers and also followed the asuswrt guide but it doesn't seem to work as I lose connection. Can anyone please help me as I have already updated the router to the latest firmware. Thanks.

Hello, I set up airVPN on my mini router using a custom build of openWRT from GL.inet but when I run ipleak and whoer it comes back with a ton of DNS leaks (50+). When I changed the DNS from "Keep blank to use default DNS" to Custom DNS of 10.4.0.1 and 10.5.0.1 then airVPN can no longer connect at all! I've also tried checking the box that says: "Force all clients to use: [ ] Override Clients' DNS setting" but it doesn't solve the issue. After setting the Custom DNS, airVPN disconnects and says the following over and over: RESOLVE: Cannot resolve host address: America.vpn.airdns.org:1194 (try again) Could not determine IPv4/IPv6 Protocol SIGUSR1 [soft,init_instance] received, process restarting Thoughts? NOTE: When NOT connecting through the router, and just firing up Eddie on my mac, I get no leaks.

EDIT: Hello all In order to get an Internet connection i need to reset dns and ip settings everytime after being connected to AirVPN. Help and information about any of this is greatly appreciated. Thanks for reading. SOLVED using merlin user scripts.

hi all, i've been having problems with my internet connection and my ISP switched my router and other things. I was wondering, being that the firmware is not open source, is there any other way to check whether the router has a backdoor installed? thanks