{"id":2452,"date":"2020-03-01T23:24:21","date_gmt":"2020-03-02T04:24:21","guid":{"rendered":"https:\/\/blog.jonesling.us\/?p=2452"},"modified":"2020-04-24T07:25:42","modified_gmt":"2020-04-24T11:25:42","slug":"accessing-netflix-when-you-have-an-ipv6-address-via-a-tunnel-broker","status":"publish","type":"post","link":"https:\/\/blog.jonesling.us\/?p=2452","title":{"rendered":"Bypassing a Tunnel-Broker IPv6 Address For Netflix"},"content":{"rendered":"\r\n<p class=\"wp-block-paragraph\">My ISP is pretty terrible but living in the United States, as I do, effectively makes internet service a regional monopoly.\u00a0 In my case, not only do I pay too much for service but certain websites (<em>cough<\/em> google.com <em>cough<\/em>) are incredibly slow for no reason other than my ISP is a dick and won&#8217;t peer with them properly.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">This particular ISP, despite being very large, has so far refused to roll out IPv6.\u00a0 This was annoying until I figured out that I could use this to my advantage.\u00a0 If they won&#8217;t peer properly over IPv4, maybe I can go through a <a href=\"https:\/\/en.wikipedia.org\/wiki\/Tunnel_broker\">tunnel broker<\/a> to get IPv6 and route around them.\u00a0 Surprisingly, it worked beautifully.\u00a0 GMail has never loaded so fast at home.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">It was beautiful, that is, until I discovered an unintended side effect: Netflix stopped working.<\/p>\r\n\r\n\r\n\r\n<div class=\"wp-block-image size-full wp-image-2454\">\r\n<figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-2454\" src=\"https:\/\/blog.jonesling.us\/wp-content\/uploads\/2020\/03\/20200301-Netflix.png\" alt=\"netflix error: you seem to be using an unblocker or proxy\" width=\"604\" height=\"200\" \/>\r\n<figcaption>Despite my brokered tunnel terminating inside the United States, Netflix suspects me of coming from outside the United States.<\/figcaption>\r\n<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">A quick Google search confirmed my suspicion.\u00a0 Netflix denies access to known proxies, VPNs, and, sadly, IPv6 tunnel brokers.\u00a0 My brave new world was about to somewhat less entertaining if I couldn&#8217;t fix this.<\/p>\r\n\r\n\r\n\r\n<h1 class=\"wp-block-heading\">Background<\/h1>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Normally a DNS lookup returns both A (IPv4) and AAAA (IPv6) records together:<\/p>\r\n\r\n\r\n\r\n<pre class=\"wp-block-preformatted\">$ nslookup google.com\r\nServer:     192.168.1.2\r\nAddress:    192.168.1.2#53\r\n\r\nNon-authoritative answer:\r\nName:   google.com\r\nAddress: 172.217.12.142\r\nName:   google.com\r\nAddress: 2607:f8b0:4006:819::200e<\/pre>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Some services will choose to provide multiple addresses for redundancy; if the first address doesn&#8217;t answer then your computer will automatically try the next in line.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Netflix in particular will return a large number of addresses:<\/p>\r\n\r\n\r\n\r\n<pre class=\"wp-block-preformatted\">$ nslookup netflix.com 8.8.8.8\r\nServer: 8.8.8.8\r\nAddress: 8.8.8.8#53\r\n\r\nNon-authoritative answer:\r\nName: netflix.com\r\nAddress: 54.152.239.3\r\nName: netflix.com\r\nAddress: 52.206.122.138\r\nName: netflix.com\r\nAddress: 35.168.183.177\r\nName: netflix.com\r\nAddress: 54.210.113.65\r\nName: netflix.com\r\nAddress: 52.54.154.226\r\nName: netflix.com\r\nAddress: 54.164.254.216\r\nName: netflix.com\r\nAddress: 54.165.157.123\r\nName: netflix.com\r\nAddress: 107.23.222.64\r\nName: netflix.com\r\nAddress: 2406:da00:ff00::3436:9ae2\r\nName: netflix.com\r\nAddress: 2406:da00:ff00::6b17:de40\r\nName: netflix.com\r\nAddress: 2406:da00:ff00::34ce:7a8a\r\nName: netflix.com\r\nAddress: 2406:da00:ff00::36a5:f668\r\nName: netflix.com\r\nAddress: 2406:da00:ff00::36a5:9d7b\r\nName: netflix.com\r\nAddress: 2406:da00:ff00::23a8:b7b1\r\nName: netflix.com\r\nAddress: 2406:da00:ff00::36d2:7141\r\nName: netflix.com\r\nAddress: 2406:da00:ff00::36a4:fed8<\/pre>\r\n\r\n\r\n\r\n<h1 class=\"wp-block-heading\">The Solution<\/h1>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">The key is to have your local DNS resolver return A records, but not AAAA, if (and only if) it&#8217;s one of Netflix&#8217;s hostnames.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Before I document the solution, it helps to know my particular setup and assumptions:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>IPv6 via a tunnel broker<\/li>\r\n<li>BIND&#8217;s <em>named<\/em> v9.14.8<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Earlier versions of BIND are configured somewhat differently: you may have different options, or (if it&#8217;s a really old build) you may need to run two separate <em>named<\/em> instances.\u00a0 YMMV.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Step 0: Break Out Your Zone Info (optional but recommended)<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">If your zone info is part of <code>named.conf<\/code> you really should put it into it&#8217;s own file for easier maintenance and re-usability. The remaining instructions won&#8217;t work, without modification, if you don&#8217;t.<\/p>\r\n\r\n\r\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n# \/etc\/bind\/local.conf\r\nzone &quot;.&quot; in {\r\n        type hint;\r\n        file &quot;\/var\/bind\/named.cache&quot;;\r\n};\r\n\r\nzone &quot;localhost&quot; IN {\r\n        type master;\r\n        file &quot;pri\/localhost.zone&quot;;\r\n        notify no;\r\n};\r\n\r\n# 127.0.0. zone.\r\nzone &quot;0.0.127.in-addr.arpa&quot; {\r\n        type master;\r\n        file &quot;pri\/0.0.127.zone&quot;;\r\n};\r\n\r\n<\/pre><\/div>\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Step 1: Add a New IP Address<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">You can run a single instance of <em>named<\/em> but you&#8217;ll need at least two IP addresses to handle responses.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">In this example the DNS server&#8217;s &#8220;main&#8221; IP address is 192.168.1.2 and the new IP address will be 192.168.1.3.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">How you do this depends on your distribution. If you&#8217;re using openrc and netifrc then you only need to modify \/etc\/conf.d\/net:<\/p>\r\n\r\n\r\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n# Gentoo and other netifrc-using distributions\r\nconfig_eth0=&quot;192.168.1.2\/24 192.168.1.3\/24&quot;\r\n<\/pre><\/div>\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Step 2: Listen To Your New Address<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Add your new IP address to your <strong>listen-on<\/strong> directive, which is probably in <code>\/etc\/bind\/named.conf<\/code>:<\/p>\r\n\r\n\r\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nlisten-on port 53 { 127.0.0.1; 192.168.1.2; 192.168.1.3; };\r\n<\/pre><\/div>\r\n\r\n\r\n<p class=\"wp-block-paragraph\">It&#8217;s possible that your directive doesn&#8217;t specify the IP address(es) and\/or you don&#8217;t even have a <strong>listen-on<\/strong> directive &#8211; and that&#8217;s ok. <a href=\"https:\/\/downloads.isc.org\/isc\/bind9\/9.14.8\/doc\/arm\/Bv9ARM.ch05.html\">From the manual<\/a>:<\/p>\r\n\r\n\r\n\r\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\r\n<p>The server will listen on all interfaces allowed by the address match list. If a port is not specified, port 53 will be used\u2026 If no listen-on is specified, the server will listen on port 53 on all IPv4 interfaces.<\/p>\r\n<cite><a href=\"https:\/\/downloads.isc.org\/isc\/bind9\/9.14.8\/doc\/arm\/Bv9ARM.ch05.html\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/downloads.isc.org\/isc\/bind9\/9.14.8\/doc\/arm\/Bv9ARM.ch05.html<\/a><\/cite><\/blockquote>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Everything I just said also applies to <strong>listen-on-v6<\/strong>.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Step 3: Filter Query Responses<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Create a new file called <code>\/etc\/bind\/limited-ipv6.conf<\/code> and add the following at the top:<\/p>\r\n\r\n\r\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nview &quot;internal-ipv4only&quot; {\r\n        match-destinations { 192.168.1.3; };\r\n        plugin query &quot;filter-aaaa.so&quot; {\r\n                # don&#039;t return ipv6 addresses\r\n                filter-aaaa-on-v4 yes;\r\n                filter-aaaa-on-v6 yes;\r\n        };\r\n};\r\n<\/pre><\/div>\r\n\r\n\r\n<p class=\"wp-block-paragraph\">What this block is saying is, if a request comes in on the new address, pass it through the <em>filter-aaaa<\/em> plugin.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">We&#8217;re configuring the plugin to filter all AAAA record replies to ipv4 clients (<em>filter-aaaa-on-v4<\/em>) and ipv6 clients (<em>filter-aaaa-on-v6<\/em>).<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Now add a new block after the first block, or modify your existing default view:<\/p>\r\n\r\n\r\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n# forward certain domains back to the ipv4-only view\r\nview &quot;internal&quot; {\r\n        include &quot;\/etc\/bind\/local.conf&quot;;\r\n\r\n        # AAAA zones to ignore\r\n        zone &quot;netflix.com&quot; {\r\n                type forward;\r\n                forward only;\r\n                forwarders { 192.168.1.3; };\r\n        };\r\n};\r\n<\/pre><\/div>\r\n\r\n\r\n<p class=\"wp-block-paragraph\">This is the default view for internal clients. Requests that don&#8217;t match preceding views fall through here.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">We&#8217;re importing the local zone from step 0 (so we don&#8217;t have to maintain two copies of the same information), then forwarding all netflix.com look-ups to the new IP address, which will be handled by the <em>internal-ipv4only<\/em> view.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Step 4: Include the New Configuration File<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Modify <code>\/etc\/bind\/named.conf<\/code> again, so we&#8217;re loading the new configuration file (which includes <code>local.conf<\/code>).<\/p>\r\n\r\n\r\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n#include &quot;\/etc\/bind\/local.conf&quot;;\r\ninclude &quot;\/etc\/bind\/limited-ipv6.conf&quot;;\r\n<\/pre><\/div>\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Restart <em>named<\/em> after you make this change.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Testing<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\"><em>nslookup<\/em> can help you test and troubleshoot.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">In the example below we call the &#8220;normal&#8221; service and get both A and AAAA records, but when we call the ipv4-only service we only get A records:<\/p>\r\n\r\n\r\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n$ nslookup google.com 192.168.1.2\r\nServer:         192.168.1.2\r\nAddress:        192.168.1.2#53\r\n\r\nNon-authoritative answer:\r\nName:   google.com\r\nAddress: 172.217.3.110\r\nName:   google.com\r\nAddress: 2607:f8b0:4006:803::200e\r\n\r\n$ nslookup google.com 192.168.1.3\r\nServer:         192.168.1.3\r\nAddress:        192.168.1.3#53\r\n\r\nNon-authoritative answer:\r\nName:   google.com\r\nAddress: 172.217.3.110\r\n<\/pre><\/div>\r\n\r\n\r\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\r\n","protected":false},"excerpt":{"rendered":"<p>Surprisingly, it worked beautifully&#8230; that is, until I discovered an unintended side effect<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","wprm-recipe-roundup-name":"","wprm-recipe-roundup-description":"","advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[9],"tags":[534,137,536,156,535,538,159,537],"class_list":["post-2452","post","type-post","status-publish","format-standard","hentry","category-linux","tag-bind","tag-dad-forgot-his-meds-again","tag-ipv4","tag-ipv6","tag-named","tag-netflix","tag-networking","tag-nslookup"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4o3FW-Dy","jetpack-related-posts":[],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=\/wp\/v2\/posts\/2452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2452"}],"version-history":[{"count":12,"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=\/wp\/v2\/posts\/2452\/revisions"}],"predecessor-version":[{"id":2554,"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=\/wp\/v2\/posts\/2452\/revisions\/2554"}],"wp:attachment":[{"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.jonesling.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}