Bdtyktl

I have set up an OpenVPN server on a VPS in the USA and configured it to route all clients traffic through it. Everything seems to work fine regarding the VPN connection in gerneral. All ip lookup sites show me the us server's ip address and even hulu.com works(it won't work if you are not in the usa). But for some reason netflix.com says "Sorry, Netflix is not available in your country yet.". So I thought that netflix probably uses some more sophisticated ways to determine your location beyond just your ip address. But I could not find a way to get it to work until I dropped the idea of using a VPN and instead connected to the server via a simple socks tunnel with ssh by running:

ssh -D 9999 user@serverip

All I had to do was changing the key

network.proxy.socks_remote_dns

in Firefox from false to true to prevent DNS leaks and setting up the socks proxy. Then I could finally watch netflix.com. As a result I concluded that there is nothing in the browser(or something like system timezone) that tells netflix the location, so it has to have something to do with the OpenVPN config.

After that I used tcpdump to log all the traffic on the server's network interface venet0 (OpenVZ VPS), visited netflix.com on the client while first connected to the VPN and then connected via socks tunnel and afterwards compared both outputs.

The only thing that caught my eye was that while using the socks tunnel the server mainly used ipv6 to connect to netflix whereas it only used ipv4 when the client was connected to the OpenVPN server. But I don't get how that could make such a difference.

So what am I missing? Is there a way to configure OpenVPN to also use ipv6 to connect to a website although there is only an ipv4 connection between the VPS and the client?

Here is the server.conf of the OpenVPN server (OpenVZ VPS)

local serverip

port 443

proto tcp

dev tun

ca ./easy-rsa2/keys/ca.crt

cert ./easy-rsa2/keys/vps1.crt

key ./easy-rsa2/keys/vps1.key  # This file should be kept secret

dh ./easy-rsa2/keys/dh1024.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 8.8.8.8"

push "dhcp-option DNS 8.8.4.4"

client-to-client

keepalive 10 120

tls-auth ta.key 0 # This file is secret

cipher AES-256-CBC

comp-lzo

max-clients 4

user nobody

group nogroup

persist-key

persist-tun

status openvpn-status.log

log-append  openvpn.log

verb 3

iptables forwarding

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j SNAT --to-source serverip

(enabled ipv4 forwarding)

I have tried everything always on a Win7 and a Debian client with only ipv4 connections and always made sure that they use the correct DNS server (tested with ipleak.net and tcpdump / wireshark).

client.conf:

client

dev tun

proto tcp

remote serverip 443

resolv-retry infinite

nobind

persist-key

persist-tun

ca ca.crt

cert client.crt

key client.key

ns-cert-type server

tls-auth ta.key 1

cipher AES-256-CBC

comb-lzo

verb 3

I don't know if it will solve your Netflix problems (though I suppose it its possible that Netflix does not geolocate you the same over IPv4 and IPv6), but since OpenVPN 2.3, there is full support for IPv6.

Just use server-ipv6 addr/bits with bits between 64 and 112.

Netflix has not geo-fenced IPv6 since at least 2013, see here[n1].

-- ab1

[n1] more information on the project page, netflix-proxy