6 ms·

How do you block a VPN though? Do you just constantly chase after their IP addresses? I mean Netflix and similar services do try but with not much luck really.

ZoF 8y ago
Yeah you block vpn providers ip ranges and it's actually very effective unless you're deploying e.g. ovpn on a box yourself. Even then some sites will block content submission from large hosting provider ranges as well.
saurik 8y ago
That isn't at all the same problem: Netflix is trying to block being accessed by a VPN, while China/Russia/etc. want to block users from talking to a VPN.
- kabacha 8y ago
  How do you block "talking" to a VPN?
  - tgragnato 8y ago
    When packets traverse the edge router, IX, cable (landing) station, .. if they're recognised as VPN traffic, then the server's IP (or IP / port) is added to a blacklist, every subsequent packet is dropped. https://en.wikipedia.org/wiki/Deep_packet_inspection https://en.wikipedia.org/wiki/Deep_packet_inspection
    - exelius 8y ago
      Yup; this is why VPN over HTTPS is a thing.
      - tgragnato 8y ago
        HTTPS has whole series of side-channel leaks, which can be exploited to fingerprint the tunnelled protocol: many implementations don't add padding or active probing resistance. Sizable communications with an uncommon IP can be singled out by netflow analysis. But yes, it usually works.
  - vbezhenar 8y ago
    You will start with blocking their websites. Then you might want to reverse-engineer it just a little bit (for example to find out which domains they connect to) and block those domains. Usually that's enough to block most of people from using it.
A2017U1 8y ago
Netflix do it with a good amount of success I thought. Self hosting a vpn is still beyond the vast majority of consumers and every big player in the market has their ip ranges mapped thoroughly.
kim0 8y ago
You use deep packet inspection to detect and block VPN protocols. Ask the Egyptian gov!

ZoF 8y ago

Yeah you block vpn providers ip ranges and it's actually very effective unless you're deploying e.g. ovpn on a box yourself. Even then some sites will block content submission from large hosting provider ranges as well.

saurik 8y ago

That isn't at all the same problem: Netflix is trying to block being accessed by a VPN, while China/Russia/etc. want to block users from talking to a VPN.

kabacha 8y ago
How do you block "talking" to a VPN?
- tgragnato 8y ago
  When packets traverse the edge router, IX, cable (landing) station, .. if they're recognised as VPN traffic, then the server's IP (or IP / port) is added to a blacklist, every subsequent packet is dropped. https://en.wikipedia.org/wiki/Deep_packet_inspection https://en.wikipedia.org/wiki/Deep_packet_inspection
  - exelius 8y ago
    Yup; this is why VPN over HTTPS is a thing.
    - tgragnato 8y ago
      HTTPS has whole series of side-channel leaks, which can be exploited to fingerprint the tunnelled protocol: many implementations don't add padding or active probing resistance. Sizable communications with an uncommon IP can be singled out by netflow analysis. But yes, it usually works.
- vbezhenar 8y ago
  You will start with blocking their websites. Then you might want to reverse-engineer it just a little bit (for example to find out which domains they connect to) and block those domains. Usually that's enough to block most of people from using it.

A2017U1 8y ago

Netflix do it with a good amount of success I thought. Self hosting a vpn is still beyond the vast majority of consumers and every big player in the market has their ip ranges mapped thoroughly.

kim0 8y ago

You use deep packet inspection to detect and block VPN protocols. Ask the Egyptian gov!