AirVPN not connecting (China) [now with no more panic]

Networking Networking Software
1

Okay, actually, I'm doing my best not to panic, it's only been since this morning when I woke up that my VPN was no longer connecting. Unfortunately my VPN is sort of my lifeline to the outside world because China hates information. They're afraid the people inside might learn something and revolt and are afraid the people outside will realize China isn't such a great place after all (hahahaha....silly China)
AAAAAANYWAYS, I can't access AirVPN's website because it's blocked so I can't even find out if there has been any news released as to why...like...maybe server maintenance or maybe they need to update their protocols to combat the Great Firewall. Either way, I would appreciate it if someone could maybe share a little information with me about this and in addition to that, if they have any VPN recommendations please let me know. Here's a list of what I have tried already:

VyprVPN (sucked ass)
SoftEther w/ VPNgate
TunnelBear
PureVPN
AirVPN

edit
I feel like I should mention that I have tried different servers in different countries, and different protocols. Still same issue...I mean, I definitely figured as much with the protocols...their SSL protocol is the only one that seems to work...

2

What does the log say? If it's something about the server being unreachable then it's blocked, if it's a cipher error or certificate error then it's most likely that they've changed a setting on the server and you need to change your configuration to match.

If you're using their client then I'm not sure if it has a log or not but openvpn has logging and if the client is based on that then it's likely to have one too.

3

I've had a quick look at their site and it seems a lot of people are having this problem. It's something to do with the certificates not being able to verify trust. You may be able to get it working in openvpn manually but it looks like something airvpn need to fix.

4

Okay, good to know! Thank you for looking that up for me, I greatly appreciate it.

According to the log:
. 2016.07.21 10:39:45 - OpenVPN > TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

this was just pushed to the log:
. 2016.07.21 11:08:25 - Updating systems & servers data ...
. 2016.07.21 11:08:26 - Systems & servers data update completed

Trying to connect now.

edit
no luck so far, but sometimes (because China) it takes a few attempts before it actually gets a connection. Will update you soon.

5

Here's the latest log (because I am ignorant, for safety reasons I have removed any IP addresses in the log)

I 2016.07.21 11:51:29 - Checking authorization ...
! 2016.07.21 11:51:30 - Connecting to Cebalrai (Hong Kong, Hong Kong)
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:30 LOG5ui: stunnel 5.17 on x86-pc-mingw32-gnu platform
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:30 LOG5 with OpenSSL 1.0.2a 19 Mar 2015
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:30 LOG5ui: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:30 LOG5ui: Reading configuration from file C:\Users\Alighieri\AppData\Local\AirVPN\f6466262c7ab581b2bcc7060985b5b31bc5845659f3fb841c76e1e1c591be1f3.tmp.ssl
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:30 LOG5ui: UTF-8 byte order mark not detected
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:30 LOG6ui: Initializing service [openvpn]
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:30 LOG5ui: Configuration successful
. 2016.07.21 11:51:33 - OpenVPN > OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [IPv6] built on Aug 13 2015
. 2016.07.21 11:51:33 - OpenVPN > library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.08
. 2016.07.21 11:51:33 - OpenVPN > MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:3100
. 2016.07.21 11:51:33 - OpenVPN > Control Channel Authentication: tls-auth using INLINE static key file
. 2016.07.21 11:51:33 - OpenVPN > Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
. 2016.07.21 11:51:33 - OpenVPN > Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
. 2016.07.21 11:51:33 - OpenVPN > Socket Buffers: R=[65536->131072] S=[65536->131072]
. 2016.07.21 11:51:33 - OpenVPN > Attempting to establish TCP connection with [AF_INET][ipaddress] [nonblock]
. 2016.07.21 11:51:33 - OpenVPN > TCP connection established with [AF_INET][ipaddress]:[channel]
. 2016.07.21 11:51:33 - OpenVPN > TCPv4_CLIENT link local: [undef]
. 2016.07.21 11:51:33 - OpenVPN > TCPv4_CLIENT link remote: [AF_INET][ipaddress]:[channel]
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG5[0]: Service [openvpn] accepted connection from [ipaddress]:[channel]
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG6[0]: Failover strategy: round-robin
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG6[0]: s_connect: connecting [ipaddress]:[port]
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG5[0]: s_connect: connected [ipaddress]:[port]
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG5[0]: Service [openvpn] connected remote server from [ipaddress]:[channel]
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG6[0]: SNI: sending servername: [ipaddress]
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG6[0]: CERT: Locally installed certificate matched
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG5[0]: Certificate accepted at depth=0: C=IT, ST=Italy, L=Perugia, O=AirVPN, OU=stunnel, CN=stunnel.airvpn.org, [email protected]
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG6[0]: SSL connected: new session negotiated
. 2016.07.21 11:51:33 - SSL > 2016.07.21 11:51:33 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption)
. 2016.07.21 11:51:33 - OpenVPN > TLS: Initial packet from [AF_INET][ipaddress]:[channel], sid=3ac911ee 234f2b32
. 2016.07.21 11:51:34 - OpenVPN > VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, [email protected]
. 2016.07.21 11:51:34 - OpenVPN > Validating certificate key usage
. 2016.07.21 11:51:34 - OpenVPN > ++ Certificate has key usage 00a0, expects 00a0
. 2016.07.21 11:51:34 - OpenVPN > VERIFY KU OK
. 2016.07.21 11:51:34 - OpenVPN > Validating certificate extended key usage
. 2016.07.21 11:51:34 - OpenVPN > ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
. 2016.07.21 11:51:34 - OpenVPN > VERIFY EKU OK
. 2016.07.21 11:51:34 - OpenVPN > VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=server, [email protected]
. 2016.07.21 11:51:35 - OpenVPN > Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
. 2016.07.21 11:51:35 - OpenVPN > Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
. 2016.07.21 11:51:35 - OpenVPN > Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
. 2016.07.21 11:51:35 - OpenVPN > Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
. 2016.07.21 11:51:35 - OpenVPN > Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
. 2016.07.21 11:51:35 - OpenVPN > [server] Peer Connection Initiated with [AF_INET][ipaddress]:[channel]
. 2016.07.21 11:51:37 - OpenVPN > SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
. 2016.07.21 11:51:37 - OpenVPN > PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.50.0.1,comp-lzo no,route-gateway 10.50.0.1,topology subnet,ping 10,ping-restart 60,ifconfig [ipaddress] [ipaddress]'
. 2016.07.21 11:51:37 - OpenVPN > OPTIONS IMPORT: timers and/or timeouts modified
. 2016.07.21 11:51:37 - OpenVPN > OPTIONS IMPORT: LZO parms modified
. 2016.07.21 11:51:37 - OpenVPN > OPTIONS IMPORT: --ifconfig/up options modified
. 2016.07.21 11:51:37 - OpenVPN > OPTIONS IMPORT: route options modified
. 2016.07.21 11:51:37 - OpenVPN > OPTIONS IMPORT: route-related options modified
. 2016.07.21 11:51:37 - OpenVPN > OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
. 2016.07.21 11:51:37 - OpenVPN > do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
. 2016.07.21 11:51:37 - OpenVPN > open_tun, tt->ipv6=0
. 2016.07.21 11:51:37 - OpenVPN > TAP-WIN32 device [Ethernet 2] opened: \.\Global{47ACF038-4375-40C5-9169-51F4C59DCC45}.tap
. 2016.07.21 11:51:37 - OpenVPN > TAP-Windows Driver Version 9.21
. 2016.07.21 11:51:37 - OpenVPN > Set TAP-Windows TUN subnet mode network/local/netmask = 10.50.0.0/10.50.0.253/[ipaddress] [SUCCEEDED]
. 2016.07.21 11:51:37 - OpenVPN > Notified TAP-Windows driver to set a DHCP IP/netmask of 10.50.0.253/[ipaddress] on interface {47ACF038-4375-40C5-9169-51F4C59DCC45} [DHCP-serv: 10.50.255.254, lease-time: 31536000]
. 2016.07.21 11:51:37 - OpenVPN > Successful ARP Flush on interface [5] {47ACF038-4375-40C5-9169-51F4C59DCC45}
. 2016.07.21 11:51:43 - OpenVPN > TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
. 2016.07.21 11:51:43 - OpenVPN > C:\Windows\system32\route.exe ADD [ipaddress] MASK 255.255.255.255 [ipaddress]
. 2016.07.21 11:51:43 - OpenVPN > ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
. 2016.07.21 11:51:43 - OpenVPN > Route addition via IPAPI succeeded [adaptive]
. 2016.07.21 11:51:43 - OpenVPN > C:\Windows\system32\route.exe ADD [ipaddress] MASK 255.255.255.255 [ipaddress] IF 8
. 2016.07.21 11:51:43 - OpenVPN > ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
. 2016.07.21 11:51:43 - OpenVPN > Route addition via IPAPI succeeded [adaptive]
. 2016.07.21 11:51:43 - OpenVPN > C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.50.0.1
. 2016.07.21 11:51:43 - OpenVPN > ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
. 2016.07.21 11:51:43 - OpenVPN > Route addition via IPAPI succeeded [adaptive]
. 2016.07.21 11:51:43 - OpenVPN > C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.50.0.1
. 2016.07.21 11:51:43 - OpenVPN > ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
. 2016.07.21 11:51:43 - OpenVPN > Route addition via IPAPI succeeded [adaptive]
. 2016.07.21 11:51:43 - OpenVPN > C:\Windows\system32\route.exe ADD [ipaddress] MASK 255.255.255.255 [ipaddress]
. 2016.07.21 11:51:43 - OpenVPN > ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
. 2016.07.21 11:51:43 - OpenVPN > Route addition via IPAPI succeeded [adaptive]
. 2016.07.21 11:51:43 - Starting Management Interface
. 2016.07.21 11:51:43 - OpenVPN > Initialization Sequence Completed
I 2016.07.21 11:51:43 - DNS of a network adapter forced (Intel(R) Centrino(R) Advanced-N 6200 AGN)
I 2016.07.21 11:51:43 - DNS of a network adapter forced (TAP-Windows Adapter V9)
I 2016.07.21 11:51:43 - Flushing DNS
I 2016.07.21 11:51:43 - Checking route
W 2016.07.21 11:51:45 - The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

6

This is the error that a lot of people seem to be having. I'll have another look and see if anyone has posted a sollution but I think it's a problem with the server certificate.

7

Mkay, then I will just be patient. When this is resolved will there be anything I need to do? It seems the client is able to acquire updates automatically, so I don't think I would need to.

8

No it sounds like it's a server side issue so you should be okay. From reading the airvpn forum it seems some people are having luck by connection with openvpn rather than the client (and presumably disabling TLS authentication which seems to be where the problem is)

Another sollution that apparently works with the client is this:

I'm able to connect if I uncheck "Check if tunnel effectively works" in Advanced > General and I have unchecked "Check if tunnel uses AIRVPN DNS" in Advanced > DNS

9

Bingo, it was able to establish a connection. Thanks man!
Sorry, memory is a little fuzzy. Are you the one who initially introduced me to AirVPN in the first place?

10

I don't think so, I use torguard myself.

11

Ah, okay. Pretty sure you would remember if you were. The person bought me a little trial, hosted the exe on a separate site so I could download it and was otherwise a pretty cool guy.

12

Can't have been me then :P

1 Like