Windscribe: internet works but slow

[rkochar]

I had installed Windscribe on Manjaro which messed up my iptables. Deleted it and Internet is very slow for all sites.

Edit: There are multiple windscribe packages on aur. From my logs, I installed windscribe-bin.

sudo iptables -F first said can not initialize table filter, sudo pacman -Syu iptables and enable iptables.service with systemctl. Reboot. sudo iptables -F does not return an error. Now my internet works but very slowly for some sites. It takes about a minute to load stackoverflow.com for instance but could load forum.manjaro.org almost instantly. I do not have a save of the rules (which are mentioned in some answers).

Any ideas why some sites take way too long on Manjaro but load almost instant;y on my phone (on same network) and on my Windows (dualboot).

> sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

> uname -r
6.1.80-1-MANJARO

# For comments on DNS. (taken from https://forum.manjaro.org/t/how-to-change-dns-servers/56869/12)
> nmcli conn show <name> | grep dns
connection.mdns:                        -1 (default)
connection.dns-over-tls:                -1 (default)
ipv4.dns:                               --
ipv4.dns-search:                        --
ipv4.dns-options:                       --
ipv4.dns-priority:                      0
ipv4.ignore-auto-dns:                   no
ipv6.dns:                               --
ipv6.dns-search:                        --
ipv6.dns-options:                       --
ipv6.dns-priority:                      0
ipv6.ignore-auto-dns:                   no

I don’t have a file ending with .ko at /lib/modules/6.1.80-1-MANJARO/kernel/net/ipv6/netfilter however there are many .ko.zst.

Thanks

[mithrial]

It’s probably DNS.

[rkochar]

Why do you think it is DNS? If it works on Windows and phone, it should not be DNS.

[Nachlese]

reading the PKGBUILD for this package - the “depends” variable in particular -

depends=('nftables' ...

means that you trying to apply or clear out iptables rules
may the wrong approach.

Windscribe may have set some nftables rules which are still there.

… this is pure speculation but may give you a clue

[MrLavender]

@rkochar

Why do you think it is DNS? If it works on Windows and phone, it should not be DNS.

The install script enables system-resolved which isn’t used by default on Manjaro. I suggest to try disabling it.

[dgdg]

@rkochar

Why do you think it is DNS? If it works on Windows and phone, it should not be DNS.

It can be DNS if Manjaro has been configured to use a different DNS server to Windows/your phone/the network default. For example, the Windscribe DNS.

You say you ‘deleted’ Windscribe - just seems worth checking, but by deleted do you mean you ran the uninstall script? Because if not then running all the commands in the pre_remove section of the installer script seems like a good idea, as well as disabling systemd-resolved. So that’s basically running the following (pilfered from the install script @MrLavender linked):

killall -q Windscribe
systemctl stop windscribe-helper 
systemctl disable windscribe-helper 
userdel -f windscribe 
groupdel -f windscribe 
rm -rf /etc/windscribe
rm -f /opt/windscribe/helper_log.txt
rm -f /usr/bin/windscribe
systemctl stop systemd-resolved
systemctl disable systemd-resolved

(Edit to fix typo)

[cscs]

@MrLavender

The install script enables system-resolved which isn’t used by default on Manjaro. I suggest to try disabling it.

Edit. For the original problem.

Other way around I would expect.
User should endeavor to implement/enable systemd-resolved over openresolv.

Pretty much this, though I would add you would want openvpn-update-systemd-resolved as well.
(assuming its using openvpn)

DNS Refusal only on my Manjaro Linux

Using systemd-resolved has some prerequisites - namely sync systemd-resolvconf package enable and start systemd-resolved service backup your existing /etc/resolv.conf create a symlink for /run/systemd/resolve/stub-resolv.conf* remove openresolv sudo pacman -Syu systemd-resolvconf sudo systemctl enable --now systemd-resolved sudo mv /etc/resolv.conf /etc/resolv.conf.bak sudo ln /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf sudo pacman -Rns openresolv

[MrLavender]

@cscs

Other way around I would expect.
User should endeavor to implement/enable systemd-resolved over openresolv.

Why? OP has removed Windscribe so disabling systemd-resolvd just restores things to how they were. There’s some confusion in the AUR comments as to whether the package actually needs to enable that service at all with NetworkManager present.

[cscs]

@rkochar

Deleted it and Internet is very slow for all sites.

I guess I missed this part. Im april-fooling myself.

As to the original point … pretty much any vpn making use of openvpn would benefit from systemd-resolved over openresolv.
(there may be a few that dont … but that probably is indicative of some rather primitive infrastructure)

For example (from the archwiki openvpn page)

Note: As of October 2019, systemd-resolvconf works as long as the systemd-resolved service is running. Openresolv will not work out of the box because client.up will only create private DNS server entries. These require extra configuration of openresolv to work. See man 8 resolvconf for more details on private DNS servers in openresolv.

Note: Another script, update-systemd-resolved, is recommended by the author of update-resolv-conf for systems with systemd.

Note: Since systemd 229, systemd-networkd has exposed an API through DBus allowing management of DNS configuration on a per-link basis. Tools such as openresolv may not work reliably when /etc/resolv.conf is managed by systemd-resolved, and will not work at all if using resolve instead of dns in /etc/nsswitch.conf.

The update-systemd-resolved script links OpenVPN with systemd-resolved via DBus to update the DNS records.

Copy the script into /etc/openvpn/scripts and mark as executable (or install openvpn-update-systemd-resolvedAUR) and append the following lines into the OpenVPN client configuration file:

[…]

In order to send all DNS traffic through the VPN tunnel and prevent DNS leaks, also add the following line (see [7]):

[…]

Make sure that the systemd-resolved service is configured and running.

[rkochar]

> systemctl status system-resolved
Unit system-resolved.service could not be found.

> systemctl stop system-resolved
Failed to stop system-resolved.service: Unit system-resolved.service not loaded.

[rkochar]

@dgdg

You say you ‘deleted’ Windscribe - just seems worth checking, but by deleted do you mean you ran the uninstall script?

yay -R windscribe. I posted an edit at the top of post with link to the windscribe package I installed.

[rkochar]

@dgdg

For example, the Windscribe DNS.

Checking DNS using this

> nmcli conn show <name> | grep dns
connection.mdns:                        -1 (default)
connection.dns-over-tls:                -1 (default)
ipv4.dns:                               --
ipv4.dns-search:                        --
ipv4.dns-options:                       --
ipv4.dns-priority:                      0
ipv4.ignore-auto-dns:                   no
ipv6.dns:                               --
ipv6.dns-search:                        --
ipv6.dns-options:                       --
ipv6.dns-priority:                      0
ipv6.ignore-auto-dns:                   no

This is the same name that works normal for others.

[Nachlese]

@rkochar

systemctl status system-resolved systemd-resolved

typo - the name is: systemd-resolved

[rkochar]

@dgdg

systemctl stop system-resolved
systemctl disable system-resolved

This appears to have worked. To accept the solution, please update your answer with this observation by @Nachlese