Netflix restricts streaming from abroad

http://money.cnn.com/2015/01/05/technology/netflix-vpn/index.html

by webdisrupt • 12 years ago

54 58 12 years ago

money.cnn.com

mwg• 12 years ago

This has not affected me yet - has it anyone else?

chollida1• 12 years ago

Interesting. I use unblock-us (no affiliation) which I assumed just switched your dns to make it look like you were in another country.

http://superuser.com/q/617266/6263

Can someone educate me as to why people need to use a vpn to access Netflix instead of a service like the above?

Is it only for people in countries that Netflix doesn't service?

EDIT, yes I'm well aware of the different catalogs in different countries, that's the point of using unblock-us:) That doesn't answer the question I had asked:)

JosephRedfern6• 12 years ago

The US Netflix Catalog offers a different selection of films/movies, so some people use proxies/VPNs as a way of spoofing their location.

The DNS trick works by having a server that returns a different A record for netflix.com (and some subdomains) - the IP of a proxy server rather than the actual IP. That way, normal traffic avoids the proxy, but Netflix traffic gets routed through.

nilved• 12 years ago

Spoofing your location at the DNS level doesn't work in a lot of cases. Specifically, the Netflix Android app and every Chromecast app is hard-coded to use 8.8.8.8/8.8.4.4. To fool their geolocation you either need to reroute those IPs or run a VPN on your router.

toomuchtodo• 12 years ago

You could run your own Android app DNS server locally, and change your route so your phone responded to requests to 8.8.8.8 and 8.8.4.4.

ghuntley5• 12 years ago

Either create a firewall rule or if your router isn't good enough create a null static route of 8.8.8.8/255.255.255.255 and 8.8.4.4/255.255.255.255 to the routers IP address with a metric of 2 and you'll achieve the same affect as a iptables/pf rule.

Chromecast WILL degrade back to the resolver provided by your router if 8.8.8.8/8.8.4.4 are uncontactable.

ghuntley5• 12 years ago

From what I've read it is speculated that NetFlix is now doing nslookups within the actual client with a internal whitelist of DNS servers; ie the client no loner trusts the results from the system configured resolvers and does spot checks.

Workaround is simple really; null route the DNS servers at your router. I have to do this anyway to get chromecast working with UnblockUS as the chromecast is configured explictitly from the factory in a attempt to prevent these things.

* create static route at router for 8.8.8.8/255.255.255.255 to your routers IP with metric of 2. Then do the same with 8.8.4.4. Note this disables querying googles DNS infrastructure on all devices connected on the network.

diminoten• 12 years ago

I'm not fully sure I understand this, so what this will do is the client will attempt and fail to check DNS, so it'll fall back to the DNS you're providing again?

crazygringo• 12 years ago

Curious -- how is this technically possible? Does Netflix simply maintain a blacklist of IP's they know belong to certain VPN services? If you used a VPN that wasn't popular enough to be "on the radar" (e.g. your corporate VPN based in the US) would Netflix have any way of blocking it?

snarkyturtle• 12 years ago

For the Android app at least, it's manually setting the DNS lookup to 8.8.8.8 (source: http://www.reddit.com/r/netflix/comments/2qevqt/meta_netflix...)

danesparza• 12 years ago

Wow -- so if you lock down your network's DNS (say, to OpenDNS) you can't use the Netflix app in Android?

JosephRedfern6• 12 years ago

On that topic: I'm not doubting that they are using a different DNS server, but I decompiled the latest Netflix APK, and couldn't find any reference to the string "8.8.8.8", or any other DNS server. I suspect they might be hiding/obfuscating/encrypting the IP somewhere: http://imgur.com/SNQeEi4

mintplant• 12 years ago

This could be a workaround for buggy ISP DNS servers, with the unintentional effect of breaking VPN access on Android.

dogma11382• 12 years ago

Geolocating the IP and comparing it to IP's assigned to ISP's isn't that hard, then it's simply just blocking non US registered accounts with a US IP address which is not assigned to a general commercial or residential address spaces of US ISP's. There might be some issues with people using netflix from within very large corporations that own entire IP blocks and are effectively their own ISP but that's quite a negligible amount of users to begin with.

But before people some how blame the US again i have a feeling this is actually powered by non US actors. US firms have no reason to block it, the problem comes when the rights for the content that Netflix streams in the US belong to other entities elsewhere, especially of those entities licensed the content to other competing services. If LoveFilme(Amazon Instant Video these days), NOW, or any other streaming services bought the rights exclusive rights for shows or movies in the UK the last thing they would want is for people to be able to stream them from Netflix using a VPN or a proxy..

jacalata• 12 years ago

US content firms absolutely have reason to block it because they want to sell the content to the foreign providers in the first place.

manicdee• 12 years ago

A better way to address this issue is to charge similar rates for the same content, rather than charging $12 for a movie in Australia that can be streamed in the USA for $6.

leeoniya• 12 years ago

just when we thought, "Finally, here's a content delivery system that isnt artificially limited by some stupid regional, device (DRM), screen-size or targeted release-date rules."

blacksmith_tb• 12 years ago

Hmm, shot by both sides. Now your ISP will throttle your Netflix stream to try and punish you for not buying video content from them, and Netflix will stop you from using a VPN to try and slip past your ISP?

aschampion• 12 years ago

I tried this morning and it still worked through domestic VPN, i.e., I'm a US customer using a VPN exit in the US. It only seems to be targeted at those using VPNs to get around region restrictions. So it should still be effective to circumvent ISP tracking, throttling and tampering.

codezero• 12 years ago

I hope they don't hit my VPN, I use it to get around ISP throttling.

Edit: since this is a DNS hack, looks like I'll be OK.

kleiba• 12 years ago

I wish they could just let paying customers watch whatever they want.

reledi• 12 years ago

So do I, and I bet Netflix does too. But I imagine it's not up to them to decide. They have to comply with licensing restrictions.

mhaymo• 12 years ago

Netflix told Engadget that there has been "no change" in the way it handles VPNs: http://www.engadget.com/2015/01/03/netflix-clamps-down-on-vp...

Possibly this is just a bug that people have misunderstood?

TillE• 12 years ago

Per the CNN article, there's been no change in policy. That doesn't exclude technical changes. Engadget quotes two words, and who knows if they've accurately represented the context.

readme3• 12 years ago

This title is not completely accurate. If you read the article it specifically references users attempting to VPN and also using the Netflix Android app.

I am gonna go out on a limb and say the app is probably checking the GPS in order to achieve this.

Fortunately, GPS can be spoofed with the developer tools if someone wants to test my theory: http://stackoverflow.com/questions/2279647/how-to-emulate-gp...

dang• 12 years ago

We changed the post to use the article's current title, which is consistent with what you're saying. (The submitted title was "Netflix blocks users streaming via VPN", which I think may also have been what the article originally said.)

readme3• 12 years ago

Thanks

webdisrupt• 12 years ago

Yes that is correct and apologies for that. After posting the article I found that there were no changes to the way they detect VPN access. In actual fact it was some change to just the Android App which is probably DNS resolution.

JosephRedfern6• 12 years ago

The Netflix Android App doesn't seem to use the "ACCESS_COARSE_LOCATION" or "ACCESS_FINE_LOCATION" permissions: http://i.imgur.com/wFOLs6Q.png

readme3• 12 years ago

Thanks for checking that. Looks like I'm wrong.

Out of curiosity, what other perms does it have?

I bet you could also sneakily restrict people by checking the device's phone number, for example.

dantiberian• 12 years ago

This article http://torrentfreak.com/netflix-cracks-down-on-vpn-and-proxy... suggests that the Android app is experimenting with forcing Google's DNS which would break DNS proxy systems. It also talks about looking at a number of signifiers of time/location (IP address, clock, timezone, GPS) and not allowing to play if they don't match.

vbezhenar• 12 years ago

It's funny that copyright holders restrict people to legally watch their content and then complain that their content is being pirated.

valarauca1• 12 years ago

"We think there is a fundamental misconception about piracy," Newell said. "Piracy is almost always a service problem and not a pricing problem. For example, if a pirate offers a product anywhere in the world, 24/7, purchasable from the convenience of your personal computer, and the legal provider says the product is region-locked, will come to your country three months after the U.S. release and can only be purchased at a brick and mortar store, then the pirate's service is more valuable.

-Gabe Newell of Valve

http://www.ign.com/articles/2011/11/25/gabe-says-piracy-isnt...

ghuntley5• 12 years ago

It is a service problem.

Game of Thrones used to available for 30-40 bucks on iTunes in the form of a season pass. It allowed Australians to prepurchase the box set of the series and watch to episodes as they aired (in sync with USA release schedule)

Used to. In Australia we only have one cable company Foxtel which has advertisements, 10-20mins per 1hr of scheduled programming. Foxtel secured exclusive rights to season 2 and 3. Now the only legal way to watch game of thrones is to suscribe under multi year contracts at 24/month, endure the advertising and to make matters worse episodes were delayed broadcast by 24-48 hours.

Delayed broadcast is a horrible, in Australia it basically means "avoid social media" for 48h until Foxtel airs or have the storyline ruined. With GOT whereby every episode was a epic twist piracy won out. Free, Imediate and no ads.

Aussies got REALLY pissed off and just resulted to pirating from piratebay. Foxtel got all uppity in the media, calling Australians a bunch of pirates and then started lobbying government for copyright reform.

sandworm• 12 years ago

Yes. And Canadians still cannot watch the new Archer trailers on youtube.

Is it piracy to duplicate something that has no value? If the copyright owner decides not to sell an item in a particular country, it cannot be argued that a pirate is in any way diminishing the market for said.

refurb• 12 years ago

It's funny that people value their privacy and then complain that the government is violating it.

Same logic, no?

bhauer• 12 years ago

Assuming there is any validity to this story, I feel this is at least somewhat ironic considering Netflix's position as posterboy for "network neutrality." If one is neutral about the network, it should be of no concern whether the user is accessing Netflix via direct TCP/UDP or an encrypted tunnel. Nor should it matter what the client's IP address is.

I don't mean to imply that Netflix is actually in favor of a truly neutral network—or even whether or not a truly neutral network can in practice exist—but rather to highlight how "neutrality" means different things to different people.

patja• 12 years ago

I paid for a VPN specifically to improve my terms-compliant Netflix streaming performance when Comcast was throttling it.

Sharlin• 12 years ago

Pretty sure the copyright owners who are evidently behind this couldn't care less about network neutrality; but for some reason they do care quite a bit about who can watch what in which country.

joelthelion• 12 years ago

That's completely ridiculous. I guess people who are frequently abroad will simply go back to pirating.

joncp• 12 years ago

Educate me. What's stopping people from sending their DNS queries through the VPN as well?

timdierks• 12 years ago

The linked-to Reddit post, http://www.reddit.com/r/netflix/comments/2qevqt/meta_netflix..., makes it clear that it's not a VPN restriction: people are configuring DNS servers to resolve Netflix names with US geographic resolution, but the new Netflix app is no longer using system DNS settings, it has Google DNS hardcoded in. Nothing about VPNs, per se.

crocowhile• 12 years ago

Good news then. It means all it takes to bypass this is an iptables rule on a openwrt router.

ghuntley5• 12 years ago

Correct. Either create a firewall rule or if your parents router isn't good enough create a null static route of 8.8.8.8/255.255.255.255 and 8.8.4.4/255.255.255.255 to the routers IP address with a metric of 2 and you'll achieve the same affect as a iptables/pf rule.

JosephRedfern6• 12 years ago

It's thought that Netflix are blocking the IP ranges of VPN providers, though: http://www.cnet.com/news/netflix-vpn-access-lock-down-overse.... Seems like it might end up being a game of cat-and-mouse.

Perhaps someone could set up "FliXchange", a service where people can VPN through your home internet connection in return to VPN access through their foreign home connection ;)

faragon• 12 years ago

Why? Shut up and take my money! :-D

yitchelle• 12 years ago

Netflix (and partners) should take the lead and make its content accessible without any border restrictions. There is no technical reason for this restriction. It is purely for the purpose of getting more money. Is the problem purely a copyright issue, or is it something else? Eg, the government of the non-US country losing out of tax revenue from the non-US Netflix subscriptions.

redblacktree• 12 years ago

They have to play nice with Hollywood in order to get content. Doing something like this would be giving them the middle finger, and Netflix doesn't want to do that.

dante9999• 12 years ago

Aside from detecting your ip location they must be running some other proxy detecting schemes.

I live in Europe and have squid proxy server running on my Amazon instance located in Portland, Oregon (something like my private "free proxy"). It works ok in Firefox, but fails in Chrome, can't really figure out why. I suspect chrome extension I use to easily manage proxies adds some custom header that is detected by Netflix. And it's NOT some obvious header like "via" or "x-forwarded-for" which I disabled as a matter of course in squid conf. All "locate my ip" sites tell me I'm from US, but netflix tells me I'm from x (which is my homecountry).

Alternative to running http proxy such as squid is using ssh socks proxy(provided server you ssh to is located in US). This cannot be detected by any means IMO.

tyrion• 12 years ago

Wouldn't it be easier for Netflix to ask for a valid US ID document to its customers to prevent this? Or would this be considered a violation of privacy somehow?

Filtering users by ip address should not be allowed IMHO. What if I am a legitimate user traveling in Europe or some other "blocked" country? Aren't them violating my rights then?

Or even better, what if I am a legitimate user (e.g. an US citizen) using one of those VPN, on what legal grounds are they denying me the access to the service?

(I am sorry if these questions may look stupid to you, please don't kill me :P)

micheljansen• 12 years ago

For start, that would significantly increase the barrier to registration and almost certainly put a lot of potential customers off.

dachia• 12 years ago

How is it possible to block vpn access?

Netflix restricts streaming from abroad

Related Stories