Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a VPS in the USA running Ubuntu. I want to setup something similar to Basically, USVIDEO is a DNS service that allows Canadians to access American content like Hulu, Netflix, NBC, and etc (restricted by geographical IP).

Here is how I think USVideo does it:

  1. Clients (PS3, XBOX, PC) specifies the DNS server(s) as specified on's website.
  2. If the DNS request is a video/audio site such as Netflix or Pandora, forward the request to a proxy. Otherwise, for all other requests, forward it to a different DNS server.
  3. If the specific video/audio URL is requested, return the address of the proxy server, which in turn relays traffic to the destination video/audio domain via the U.S. gateway so that it appears that the access is coming from a U.S. IP address.
  4. Once the DNS request has passed the U.S. IP address check, their proxy server steps out of the loop and lets the video streaming site contact you directly to start the video stream. This trick relies on the way that the video streaming sites check the country of your IP address once up front, but don't actually check the country of the destination IP address while the video is streaming.

What is elegant about this solution is that a VPN Tunnel is not required to bypass geographical IP checks from certain websites. All that is required on the client side is to specify the DNS server (the VPS). If a certain site is geographically locked, just forward the traffic to a proxy, and that's it. These sites can be specified in the DNS entries, or perhaps in the proxy service to redirect the DNS request to its own proxy.

I believe what I need to setup something similar is Squid Proxy, IPTables, and DNS. What I need help is how to exactly approach this? Would Squid Proxy be setup as a transparent proxy?


locked by Michael Hampton Aug 14 '15 at 17:19

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by Michael Hampton Aug 14 '15 at 17:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – Michael Hampton
If this question can be reworded to fit the rules in the help center, please edit the question.

The trick is not just what you proxy, but what you don't proxy. Most video sites host there web content and video content on different hosts or even different domains. In the case of all the video content is on domain... So if you proxy but not you can fake the geographical region.

Even better, if you have an access to a router, and a low bandwidth vpn service, you can pretty much just do this with firewall rules. You redirect the low bandwidth stuff to your vpn service, and leave the high bandwidth stuff unfiltered. The beauty of this solution is there are many free low bandwidth vpn providers... If the number of sites you want to tick is fairly low, you could also use ssh tunnels instead of vpn.


I wouldn't play any tricks with DNS; rather, I'd set up a proxy on the local net that only uses a proxy on the VPS for the specified domains. E.g., squid's cache_peer_domain option will accomplish this. On the local squid you'd add

  1. you need to run your own private dns with artificial records for example
  2. you also need a real dns to fall back on.
  3. now that all requests for these sites are going to your US located box you can open up port 80 on squid and listen for the traffic. your cache_peer settings should allow you to map each domain to their real ip. The trafic now flows initially from your US located box to the service but then the server responds it responds directly to the host. no magic here. I won't share the fine details as it probably best serves all to not over exploit this.

mmmmmmmm, If you take a look at the meta content you can see that they have GeoLocation running with the flash as soon as the movie loads. Again this is checked in the initial installation of netflix, the signup, and the login.

So what are unblock-us doing? esentially they are running a clone of netflix, we shall call this clone

They leech all the data from the real website (excluding video content) and post it onto their clone site . This is where the DNS server comes into play, since the site actually only exists in their INTRANET and not Internet the record can only exists on their domain name servers, and so you must be a part of their servers to see it, as it doesn't get updated globally.

  • this might not be clear ATM, but keep reading. Remember when you setup your own dns server you will have to re-define that real name and point its IP to a different name. IE: -> *'s realip).

step 1(very easy) setting up a virtual name server for an name that already exists but listening on a an ip that can only be directed by your dns server. Hence, you use the dns is now and when you visit you are automatically loading .

Original: -> (real netflix ip) -> your device.

new dnsmap: -> (your server ip) -> -> /var/www1/netflux/ -> your device.

The dns server controls the "your server ip" section.

step 2(easy) : login to the real netflix and leech their entire web-content excluding the videos. This is relatively easy you're essentially copying a website. you can network monitor what your (wii/360/sp3) is web requesting, and download that content as well to make it compatible with what ever system you like.

step 3(some skill required) : the next part is easy for an avg coder who understands php, (perl makes this easy as pie). The basic forum auth that netflix uses is really the weakness here, simply parse the users credentials during the login to*the real netflix)

MAP: -> (DNS loads -> user logs in ->*real netflix) return validation.

step3 is to some-point optional depending on how you want to code your server. If you know the people using your private DNS server have valid authentications there is really no need to have a site login at all. get it?

step4(skilled) now you are fully browsing a mirror of netflix, you click on a video and have your server take the device ID and parse it to where based on your server (you have already been established and verified, or completely cut that out because you know the token is valid and will verify when you try to watch the title). Your device now has a socket open for streaming content, the return address is set in the header from the servers packet to, the geolocation is fooled by the server ip and the socket is established with your device from the real netflix server and their software takes care of DRM and video is plaid.

The hardest part is the protocol, since it has to be extracted at a packet level, but everything is really plain text encryption, just think of the MSNP but with out character keys and MSG ordering.

Cheers ~InSaneGame~

Does your method allow SSL(https) connection? If you create a fake site (i.e., the SSL certificate will generate an error while you try to access the content. I believe Netflix uses https connection to load their media player. – Nicolo Jun 24 '11 at 2:09

but services like does this automatically and for free. I am sure there's no 'netflux' in play there...


For reference, there is a way of doing this simply using caching-only BIND DNS and SNI Proxy:

  1. Get a cheap Linux VPS in the US (e.g. Digital Ocean)
  2. Install BIND and SNI Proxy on your VPS
  3. Configure BIND to override * and return the IP of your VPS
  4. Configure SNI Proxy to proxy * (HTTP/HTTPS)
  5. Point your player device (e.g. Apple TV) to your VPS's public IP

The idea is that only * requests will be proxied via your VPS in the US, but video content coming from Akamai CDN will be accessed by your player device directly.

Also works for many other geo-locked services, such as Pandora, Crackle, etc.


Ref: DIY clone of Netflix Tunlr/Unblock-Us/UnoTelly on cheap US based VPS

Ref: SNI Proxy GitHub


An alternative solution is to set up a proxy using sockets in Python, as this Australian did:

Not sure about the performance overhead of his solution, but it's just for proxying the geoblocking domains anyway.


Not the answer you're looking for? Browse other questions tagged or ask your own question.