3
votes

I have a VPS in the USA running Ubuntu. I want to setup something similar to http://www.usvideo.org Basically, USVIDEO is a DNS service that allows Canadians to access American content like Hulu, Netflix, NBC, and etc (restricted by geographical IP).

Here is how I think USVideo does it:

  1. Clients (PS3, XBOX, PC) specifies the DNS server(s) as specified on USVIDEO.org's website.
  2. If the DNS request is a video/audio site such as Netflix or Pandora, forward the request to a proxy. Otherwise, for all other requests, forward it to a different DNS server.
  3. If the specific video/audio URL is requested, return the address of the proxy server, which in turn relays traffic to the destination video/audio domain via the U.S. gateway so that it appears that the access is coming from a U.S. IP address.
  4. Once the DNS request has passed the U.S. IP address check, their proxy server steps out of the loop and lets the video streaming site contact you directly to start the video stream. This trick relies on the way that the video streaming sites check the country of your IP address once up front, but don't actually check the country of the destination IP address while the video is streaming.

What is elegant about this solution is that a VPN Tunnel is not required to bypass geographical IP checks from certain websites. All that is required on the client side is to specify the DNS server (the VPS). If a certain site is geographically locked, just forward the traffic to a proxy, and that's it. These sites can be specified in the DNS entries, or perhaps in the proxy service to redirect the DNS request to its own proxy.

I believe what I need to setup something similar is Squid Proxy, IPTables, and DNS. What I need help is how to exactly approach this? Would Squid Proxy be setup as a transparent proxy?

7 Answers 7

2
votes

The trick is not just what you proxy, but what you don't proxy. Most video sites host there web content and video content on different hosts or even different domains. In the case of hulu.com all the video content is on akamaitechnologies.com domain... So if you proxy hulu.com but not akamaitechnologies.com you can fake the geographical region.

Even better, if you have an access to a router, and a low bandwidth vpn service, you can pretty much just do this with firewall rules. You redirect the low bandwidth stuff to your vpn service, and leave the high bandwidth stuff unfiltered. The beauty of this solution is there are many free low bandwidth vpn providers... If the number of sites you want to tick is fairly low, you could also use ssh tunnels instead of vpn.

1
vote

I wouldn't play any tricks with DNS; rather, I'd set up a proxy on the local net that only uses a proxy on the VPS for the specified domains. E.g., squid's cache_peer_domain option will accomplish this. On the local squid you'd add

cache_peer_domain vps-in-america.example.com .pandora.com
1
vote
  1. you need to run your own private dns with artificial records for example pandora.com
  2. you also need a real dns to fall back on.
  3. now that all requests for these sites are going to your US located box you can open up port 80 on squid and listen for the traffic. your cache_peer settings should allow you to map each domain to their real ip. The trafic now flows initially from your US located box to the service but then the server responds it responds directly to the host. no magic here. I won't share the fine details as it probably best serves all to not over exploit this.
1
vote

mmmmmmmm, If you take a look at the meta content you can see that they have GeoLocation running with the flash as soon as the movie loads. Again this is checked in the initial installation of netflix, the signup, and the login.

So what are unblock-us doing? esentially they are running a clone of netflix, we shall call this clone netflux.com

They leech all the data from the real website (excluding video content) and post it onto their clone site netflux.com . This is where the DNS server comes into play, since the site netflux.com actually only exists in their INTRANET and not Internet the record can only exists on their domain name servers, and so you must be a part of their servers to see it, as it doesn't get updated globally.

  • this might not be clear ATM, but keep reading. Remember when you setup your own dns server you will have to re-define that real netflix.com name and point its IP to a different name. IE: www.hollyflix.com -> *1.1.1.1(netflix's realip).

step 1(very easy) setting up a virtual name server for an name that already exists but listening on a an ip that can only be directed by your dns server. Hence, you use the dns netflix.com is now 10.20.30.80(example) and when you visit netflix.com you are automatically loading netflux.com .

Original: netflix.com -> (real netflix ip) -> your device.

new dnsmap:
netflix.com -> (your server ip) -> [email protected] -> /var/www1/netflux/index.pl -> your device.

The dns server controls the "your server ip" section.

step 2(easy) : login to the real netflix and leech their entire web-content excluding the videos. This is relatively easy you're essentially copying a website. you can network monitor what your (wii/360/sp3) is web requesting, and download that content as well to make it compatible with what ever system you like.

step 3(some skill required) : the next part is easy for an avg coder who understands php, (perl makes this easy as pie). The basic forum auth that netflix uses is really the weakness here, simply parse the users credentials during the login to holyflux.com(*the real netflix)

MAP: www.netflix.com -> (DNS loads netflux.com) -> user logs in -> holyflix.com(*real netflix) return validation.

step3 is to some-point optional depending on how you want to code your server. If you know the people using your private DNS server have valid authentications there is really no need to have a site login at all. get it?

step4(skilled) now you are fully browsing a mirror of netflix, you click on a video and have your server take the device ID and parse it to holyflux.com where based on your server (you have already been established and verified, or completely cut that out because you know the token is valid and will verify when you try to watch the title). Your device now has a socket open for streaming content, the return address is set in the header from the servers packet to holyflux.com, the geolocation is fooled by the server ip and the socket is established with your device from the real netflix server and their software takes care of DRM and video is plaid.

The hardest part is the protocol, since it has to be extracted at a packet level, but everything is really plain text encryption, just think of the MSNP but with out character keys and MSG ordering.

Cheers ~InSaneGame~

1
  • Does your method allow SSL(https) connection? If you create a fake site (i.e. NetFlux.com), the SSL certificate will generate an error while you try to access the content. I believe Netflix uses https connection to load their media player.
    – Nicolo
    Jun 24, 2011 at 2:09
1
vote

but services like http://tunlr.net does this automatically and for free. I am sure there's no 'netflux' in play there...

1
vote

For reference, there is a way of doing this simply using caching-only BIND DNS and SNI Proxy:

  1. Get a cheap Linux VPS in the US (e.g. Digital Ocean)
  2. Install BIND and SNI Proxy on your VPS
  3. Configure BIND to override *.netflix.com and return the IP of your VPS
  4. Configure SNI Proxy to proxy *.netflix.com (HTTP/HTTPS)
  5. Point your player device (e.g. Apple TV) to your VPS's public IP

The idea is that only *.netflix.com requests will be proxied via your VPS in the US, but video content coming from Akamai CDN will be accessed by your player device directly.

Also works for many other geo-locked services, such as Pandora, Crackle, etc.

--ab1

Ref: DIY clone of Netflix Tunlr/Unblock-Us/UnoTelly on cheap US based VPS

Ref: SNI Proxy GitHub

0
votes

An alternative solution is to set up a proxy using sockets in Python, as this Australian did: http://delx.net.au/blog/2011/12/hulu-and-pandora-outside-usa/

Not sure about the performance overhead of his solution, but it's just for proxying the geoblocking domains anyway.

Not the answer you're looking for? Browse other questions tagged .