13

I registered a virtual private server with a dedicated public IP and set up my own private VPN on it. Out of curiosity, I tried to access Netflix over it and I got the famous "You seem to be using an unblocker or proxy" screen.

I have always thought that Netflix simply maintains a blacklist of public VPN providers. But in this case I'm using my own private IP. How is it possible that Netflix is able to detect my VPN? Isn't it kind of a point of a VPN that it should not be detectable?

Note that the server is set up in a country where Netflix is actually very limited. Therefore it seems unlikely that anybody would run a public VPN to provide access to Netflix here and got all IPs owned by this provider blacklisted as a result.

Is it possible that Netflix simply detects a running instance of a VPN server (OpenVPN in my case) on my IP? Can that be prevented? I moved it from the default port (1194) but that didn't help.

9
  • 1
    Couldn't you test your hypothesis that maybe all IPs owned by this VPS provider have been blacklisted? Go to Netflix directly from your VPS itself and see what happens.
    – Spiff
    Dec 27 '16 at 19:41
  • 3
    @Ramhound - I'm curious (and, to be honest skeptical) - how can the VPN connection be relatively easily detected?
    – davidgo
    Dec 27 '16 at 20:54
  • 5
    @LMiller7 You are right but I don't think this is relevant here. The point is that if they are technically capable of detecting VPNs, it has quite big security implications. So I'm curious how it works.
    – tobik
    Dec 27 '16 at 21:31
  • 3
    That's not really convincing. It's mainly about identifying users coming from common VPN providers. That does not apply to me. The rest (packet size, round trip time) sounds a lot like guessing.
    – tobik
    Dec 28 '16 at 0:18
  • 1
    @Ramhound the VPN is not leaking any infomatation - in fact the lead answer pretty much says "VPN's are known by the endpoint IP, which does not apply here". The bit about MTU makes assumptions which may not hold true. Its is true that DNS can give hints if this is not correctly configured - but its trivial to use 8.8.8.8 and 8.8.4.4 which will subvert it.
    – davidgo
    Dec 28 '16 at 1:54
7

Okay, mystery solved. As someone suggested in the comments, I tried to access Netflix directly from my VPS (I had to setup VNC for that) and got blocked!

The positive thing is that Netflix is clearly not using any dark magic to reveal that you are hidden behind a VPN (because in this particular case, I was not and got blocked anyway).

The negative thing is that Netflix is apparently very aggressive when it comes to blocking IP addresses.

Until now, I was under the impression that Netflix blocks IP addresses based on the suspicious traffic going through those IPs. In the case of this particular VPS provider, I find it very unlikely. I seriously doubt that anybody has built a public VPN which was heavily used to access Netflix because the provider is located in a country where Netflix gets only around 10% of the US content. It would make no sense at all to tunnel to this country to watch Netflix.

My guess would be that Netflix uses some kind of smart algorithm to distinguish between IPs belonging to ISPs (those are good) and to VPS providers (those are bad as they are likely to be used for VPNs). My IP is registered to a company whose name actually contains the word "hosting" which means that the algorithm didn't have to be really smart in this case.

So to answer my original question, I'd say that even though nothing suggests that it is actually possible to detect a VPN, the source IP address can reveal enough information about itself to make it clear that this is no Jon Doe browsing from his home computer.

4
  • 3
    They probably go as far as to block BGP routes coming from datacenters instead of ISPs
    – Dmitri DB
    Dec 28 '16 at 22:52
  • Ownership of a is address is public knowledge. VPN block isn't likely going to be dynamic, which means they can collect information on a up address and then act on whenever they feel like it
    – Ramhound
    Dec 28 '16 at 22:52
  • If you feel like downvoting my answer, please let me know in the comments why. I (and I'm sure other users as well) would like to know the reasons. Afaik this answer is correct (even though it's not using very technical terms) and moreover, this information is hard to come across on the Internet.
    – tobik
    Jan 4 '17 at 19:06
  • I think I'll block netflix then.
    – Rolf
    May 4 '18 at 22:47
6

The way they are blocking in particular seems to be done through blocking routes coming from data centers who may be hosting VPNs (Not likely to be legitimate traffic at all) and even going as far as working with ISPs who actually have stuff like this to provide to homes and businesses: https://openconnect.netflix.com/en/ - Guaranteeing their routing is going to be quite strict (Check the deployment guide which goes somewhat into this: https://openconnect.netflix.com/deploymentguide.pdf ).

The proposed solution I've heard so far to this is to use a VPN method which works 'peer to peer' - Essentially something like a ghetto version of tor without the onion routing aspect of it. Think kind of like Hola, which was that crazy one which faced a lot of controversy years ago because it had nasty security vulnerabilities (And which may be a deciding factor in you not using this particular circumvention). There's some solutions here which may work for you:

https://www.freelan.org/

https://peervpn.net/

And given a couple of google searches more, this is even being talked about in Forbes magazine:

http://www.forbes.com/sites/thomasbrewster/2016/06/29/netflix-vpn-block-responsible-bypass/

You may also have luck setting up openvpn PROPERLY (with dns leaks etc taken care of, of course - a fun learning exercise and skill to have) at an obscure data center, but that approach may be hit-or-miss and/or costly.

1
  • The peer to peer VPN seems to be the ideal solution (freelan.org, peervpn.net) as Netflix will not block their own users at the person level. However searching for these two services, there doesn't seem to exist much use of it regarding Netflix, yet? Jan 3 '17 at 15:55
1

It's because Netflix now detects and blacklists IP addresses that belong to VPNs (for copyright reasons).

Good VPNs stay one-step ahead of Netflix the majority of the time. But now-and-then Netflix blacklists a ton of IPs at once. So it takes a while - normally a day or twofor the VPNs to respond (by creating new IP addresses).

This article, Netflix Detecting VPN? explains the problem in more detail if you want to learn more.

Hope this helps :)

0

Found this interesting project about VPN detection https://github.com/ValdikSS/p0f-mtu-script. So those kind of heuristics are the ones that engineers at Netflix or Amazon are using.

That comes from this article: https://medium.com/@ValdikSS/detecting-vpn-and-its-configuration-and-proxy-users-on-the-server-side-1bcc59742413

-1

That's because your DNS is being leaked, once your dns is leaked it means it knows you are behind a VPN or proxy .

1
  • 1
    I tested that on dnsleaktest.com and when connected through the VPN, it reported the correct DNS servers (i.e. the ones provided by the VPN and not the normal ones).
    – tobik
    Dec 27 '16 at 22:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.