3 ms·

Interesting. I use unblock-us (no affiliation) which I assumed just switched your dns to make it look like you were in another country. http://superuser.com/q

Interesting. I use unblock-us (no affiliation) which I assumed just switched your dns to make it look like you were in another country. http://superuser.com/q/617266/6263 http://superuser.com/q/617266/6263 Can someone educate me as to why people need to use a vpn to access Netflix instead of a service like the above? Is it only for people in countries that Netflix doesn't service? EDIT, yes I'm well aware of the different catalogs in different countries, that's the point of using unblock-us:) That doesn't answer the question I had asked:)

JosephRedfern 12y ago
The US Netflix Catalog offers a different selection of films/movies, so some people use proxies/VPNs as a way of spoofing their location. The DNS trick works by having a server that returns a different A record for netflix.com (and some subdomains) - the IP of a proxy server rather than the actual IP. That way, normal traffic avoids the proxy, but Netflix traffic gets routed through.
nilved 12y ago
Spoofing your location at the DNS level doesn't work in a lot of cases. Specifically, the Netflix Android app and every Chromecast app is hard-coded to use 8.8.8.8/8.8.4.4. To fool their geolocation you either need to reroute those IPs or run a VPN on your router.
- toomuchtodo 12y ago
  You could run your own Android app DNS server locally, and change your route so your phone responded to requests to 8.8.8.8 and 8.8.4.4.
- ghuntley 12y ago
  Either create a firewall rule or if your router isn't good enough create a null static route of 8.8.8.8/255.255.255.255 and 8.8.4.4/255.255.255.255 to the routers IP address with a metric of 2 and you'll achieve the same affect as a iptables/pf rule. Chromecast WILL degrade back to the resolver provided by your router if 8.8.8.8/8.8.4.4 are uncontactable.
ghuntley 12y ago
From what I've read it is speculated that NetFlix is now doing nslookups within the actual client with a internal whitelist of DNS servers; ie the client no loner trusts the results from the system configured resolvers and does spot checks. Workaround is simple really; null route the DNS servers at your router. I have to do this anyway to get chromecast working with UnblockUS as the chromecast is configured explictitly from the factory in a attempt to prevent these things. * create static route at router for 8.8.8.8/255.255.255.255 to your routers IP with metric of 2. Then do the same with 8.8.4.4. Note this disables querying googles DNS infrastructure on all devices connected on the network.
- diminoten 12y ago
  I'm not fully sure I understand this, so what this will do is the client will attempt and fail to check DNS, so it'll fall back to the DNS you're providing again?
  - ghuntley 12y ago
    Configure your router with DHCP and instead of using the upstream DNS server from your ISP configure in the servers from UnblockUS. Additionally create a firewall rule or null static route that denies all network connectivity to 8.8.8.8 and 8.8.4.4. Under the above configuration the chromecast will obtain a IP address and the DNS resolver from the router. Chromecast devices provide no way to configure DNS servers and by default does not trust the responses from your router, instead it trusts and uses Google DNS servers, it's only when network connectivity is blocked does the chromecast "degrade" to using the DNS server provided by the router. If your router is good enough I highly suggest creating two networks by aliasing your uplink, then applying a firewall rule to the uplink that blocks the DNS servers and then tagging by MAC address all devices such as TV/Consoles etc. That way for day to day computering you can use your standard resolvers but traffic is from entertainment network/devices is forced to go out via your tagged uplink - which blocks google DNS and uses UnblockUS for resolution. Better security practice as it means you can be very specific as to what devices should be allowed to be man in the middled/traffic rewritten by UnblockUS. MITM your TV? who cares, MITM your workstation - yeah not a good idea.
- deleted 12y ago

JosephRedfern 12y ago

The US Netflix Catalog offers a different selection of films/movies, so some people use proxies/VPNs as a way of spoofing their location. The DNS trick works by having a server that returns a different A record for netflix.com (and some subdomains) - the IP of a proxy server rather than the actual IP. That way, normal traffic avoids the proxy, but Netflix traffic gets routed through.

nilved 12y ago

Spoofing your location at the DNS level doesn't work in a lot of cases. Specifically, the Netflix Android app and every Chromecast app is hard-coded to use 8.8.8.8/8.8.4.4. To fool their geolocation you either need to reroute those IPs or run a VPN on your router.

toomuchtodo 12y ago
You could run your own Android app DNS server locally, and change your route so your phone responded to requests to 8.8.8.8 and 8.8.4.4.
ghuntley 12y ago
Either create a firewall rule or if your router isn't good enough create a null static route of 8.8.8.8/255.255.255.255 and 8.8.4.4/255.255.255.255 to the routers IP address with a metric of 2 and you'll achieve the same affect as a iptables/pf rule. Chromecast WILL degrade back to the resolver provided by your router if 8.8.8.8/8.8.4.4 are uncontactable.

ghuntley 12y ago

From what I've read it is speculated that NetFlix is now doing nslookups within the actual client with a internal whitelist of DNS servers; ie the client no loner trusts the results from the system configured resolvers and does spot checks. Workaround is simple really; null route the DNS servers at your router. I have to do this anyway to get chromecast working with UnblockUS as the chromecast is configured explictitly from the factory in a attempt to prevent these things. * create static route at router for 8.8.8.8/255.255.255.255 to your routers IP with metric of 2. Then do the same with 8.8.4.4. Note this disables querying googles DNS infrastructure on all devices connected on the network.

diminoten 12y ago
I'm not fully sure I understand this, so what this will do is the client will attempt and fail to check DNS, so it'll fall back to the DNS you're providing again?
- ghuntley 12y ago
  Configure your router with DHCP and instead of using the upstream DNS server from your ISP configure in the servers from UnblockUS. Additionally create a firewall rule or null static route that denies all network connectivity to 8.8.8.8 and 8.8.4.4. Under the above configuration the chromecast will obtain a IP address and the DNS resolver from the router. Chromecast devices provide no way to configure DNS servers and by default does not trust the responses from your router, instead it trusts and uses Google DNS servers, it's only when network connectivity is blocked does the chromecast "degrade" to using the DNS server provided by the router. If your router is good enough I highly suggest creating two networks by aliasing your uplink, then applying a firewall rule to the uplink that blocks the DNS servers and then tagging by MAC address all devices such as TV/Consoles etc. That way for day to day computering you can use your standard resolvers but traffic is from entertainment network/devices is forced to go out via your tagged uplink - which blocks google DNS and uses UnblockUS for resolution. Better security practice as it means you can be very specific as to what devices should be allowed to be man in the middled/traffic rewritten by UnblockUS. MITM your TV? who cares, MITM your workstation - yeah not a good idea.
deleted 12y ago