2

There are many services like "unblock-us.com" that make it possible to use geo-restricted services from other countries. The setup is always the same: just replace DNS and that's it.

My question is: how does it work?

For HTTP traffic it's very simple - DNS has to return IP of some server that is in the right geo area, accepts HTTP requests, and forwards them to the server known from the HOST header.

For HTTPS traffic - HTTP traffic is sent over SSL, so theoretically any proxy can only see that someone sent a blob of encrypted data with unknown destination. How does it work?

Improve this question

2 Answers 2

Reset to default
1

The Smart DNS service need not bother with the actual request contents. It just redirects the whole connection as is. Of course, this requires a 1:1 mapping between redirected domain name and IP address.

If you want to access netflix.com, the Smart DNS server “forges” the response and directs you to, say, 1.2.3.4. This server is located in the US, to fool Netflix. It just swaps some headers on the traffic while mediating between the actual netflix.com servers and your PC. For Netflix, it looks like it’s communicating with 1.2.3.4.

The server knows that when traffic arrives for 1.2.3.4, it’s for Netflix. There could be another address, 1.2.3.5, for Youtube.

Improve this answer
3
  • Can you explain this a bit more? If there's a server in the US where my traffic is passed through, my browser will see that server instead of netflix.com, therefor throwing an error stating the IP address of that server doesn't match netflix.com
    – Sam
    May 17, 2016 at 13:57
  • 1
    @Sam This process is completely transparent to your browser. It does not know netflix.com actually has a different IP address, because that information has been “forged” by the Smart DNS service.
    – Daniel B
    May 17, 2016 at 14:00
  • 1
    All right, I just read that certificates are not bound the IP, but only to the hostname. I always thought they were bound to both.
    – Sam
    May 17, 2016 at 14:30
1

Most modern software are capable of decrypt and re-encrypt SSL traffic by configuring the proxy as a man-in-the-middle. This way, the SSL/TLS certificate chain of trust is indeed broken, but is a bit more sofisticated so the user doesn't even know it was.

In my case I've used Squid3 to make a similar configuration for a transparent proxy, and there's a feature called Squid-in-the-middle SSL Bump which in resume does this. This (as you'll see in this link) entails some moral and even legal issues as it might be illegal depending on which country/state you live. However, keep in mind that when the proxy generates a dynamic Certificate, it must be accepted by the user in any case.

There's a very nice link which describes this in depth and it's easy to read, so I hope it helps you understand how these kind of transparent proxies are done.

Improve this answer
2
  • This is still visible for the user unless he chooses to trust the CA that dynamically creates certificates.
    – Daniel B
    Sep 18, 2015 at 20:26
  • You're right, I added a phrase clarifying it, thanks.
    – nKn
    Sep 18, 2015 at 20:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .