Using VPNs to avoid censorship blocks

Commonly used, from what I see on these forums.

What puzzles me though that these are by definition "Virtual". They are not private networks.

Wouldn't it be dead simple for the powers that be just to make it necessary to have a licence to run a VPN? (Costing money of course). ISPs having to record customer VPN licences and block any unlicensed use of one.

If it is, how long before it happens?

It won't happen. The people would rise up, raise an army and march on London.

All 472 of them?

I thought there were more people...

There are, but are there more than 472 that use VPN to avoid censorship?

Anyway - what about the concept? Simple; not easy; very complex; or impossible to implement?

Licensing VPN would be like trying to licence BitTorrent. Wont happen.

Recent news on censorship and spying has just inspired a lot of programmers keen to fix the problem for good. The next few years are going to be interesting. This, coupled with the work that is going on with cryptocurrencies right now, is going to give governments a big headache. And there is nothing they can do about it, without destroying the internet (which wont happen).

The reason you can't licence BitTorrent is because using a VPN is so easy. Licensing VPNs I see as being a piece of cake. Far easier than blocking child porn, which in relation to the vast majority seems to be pretty well established. And the serious people use VPNs.

The thing is everything initially goes through the ISPs routers. I get the impression the use of a VPN is obvious to the ISP. Is it? If it is, then it is easy to block.

If you use standard ports and protocols, then yes you can block VPN, but it would be trivial to get around that, just as it is trivial to get around censorship. I dont really understand why you would want to license VPN? And what about TOR? You going to license that too?

Yep. A lot of VPNs operate in countries which would tell the British Government what they can do with their licence.

Heh! I've no idea what TOR is. I just see all the ones who want to get round blocking either use proxies or VPN. And I don't want to license anything. Whatever the trivial methods are, they don't seem to be mainstream on these forums.

The crux of my OP was the final sentence. If it can be done, how long before it is done. Possibly easy and effective.

Why should the port or protocol used be a problem at the ISP's routers?

So they wouldn't be accessible.

Then the USA and Europe join in on it as well?

Protocols often use standard ports. Suppose an ISP wanted to block all web traffic. The web uses ports 80 and 443. If you blocked those ports, the web would not work. But before long, someone will provide a proxy to get around it. So the ISP would need to block that port too. But now it's becomes a game of whack a mole.

So the ISP needs to read the traffic, and decide what it is. For unencrypted web traffic, that is easy. As soon as they see that the data is web data, they can block it, regardless of what port it is. BUT, if you encrypt the traffic first, the ISP cant know what the data is.

Now suppose the government imposed a license on VPN. What is to stop you from using an encrypted VPN from say the USA, The government cant tax that.

In reply to a post by RobertoS:

So they wouldn't be accessible.

Then the USA and Europe join in on it as well?

So all ISPs have to block all VPNs other than the ones the Government says are ok?

That's very draconian. There are lots of VPNs worldwide. A businessman from Sweden would travel to UK and find he can't connect to his work's VPN in Sweden because the British Government has gone nuts.

So are you saying it is impossible, or just fairly complex?

Edited by RobertoS (Fri 31-Jan-14 23:28:54)

It's impossible.

In reply to a post by RobertoS:

So you are saying it is impossible, or just fairly complex?

Technically possible, but in practice completely unworkable.

In reply to a post by Oliver341:

Technically possible

You mean like blocking TPB is technically possible? lol

In reply to a post by BatBoy:

In reply to a post by Oliver341:

Technically possible

You mean like blocking TPB is technically possible? lol

If the government were to require all ISPs to block all internet traffic other than that which they "licence" then sure, it's technically possible.

In reply to a post by Oliver341:

There are lots of VPNs worldwide. A businessman from Sweden would travel to UK and find he can't connect to his work's VPN in Sweden because the British Government has gone nuts.

What would he be connecting to in the UK?

In reply to a post by RobertoS:

In reply to a post by Oliver341:

There are lots of VPNs worldwide. A businessman from Sweden would travel to UK and find he can't connect to his work's VPN in Sweden because the British Government has gone nuts.

What would he be connecting to in the UK?

An ISP.

So the licensing idea needs refining. That's no big deal. How would he hire a car over here?

In reply to a post by RobertoS:

So the licensing idea needs refining. That's no big deal.

How would you refine it?

In reply to a post by RobertoS:

How would he hire a car over here?

How is that relevant to blocking VPNs?

The ISP over here needs evidence that it is a legitimate VPN, same as hiring a car here requires documentary support.

Again, I only put forward a thought about what could come to pass, not a master-plan about how it would be brought to pass. The arguments against it being feasible so far are a bit weak. Just shooting from the hip.

In reply to a post by RobertoS:

The arguments against it being feasible so far are a bit weak.

I beg to differ but there you go.

In reply to a post by Oliver341:

If the government were to require all ISPs to block all internet traffic other than that which they "licence" then sure, it's technically possible.

They couldn't block communications over satellite.

True, but it'll be a fair while before the WWW goes that way by any significant amount.

Merely an example to show that "technically possible" is impossible.

Once said documentary support has been provided, how do you stop my employer misusing the VPN?

I've proven that (for example) the VPN connects me to my employer in Sweden, but my employer in Sweden might see a nice sideline in offering filtering bypasses to the UK. Now you have a problem; you can block the VPN I use for work, stopping me from working, or you can leave it unblocked, and I can help UK citizens bypass your filtering block.

FWIW, the system isn't completely infeasible; North Korea manages it successfully, and both Iran and China make it work most of the time.

Note, however, that part of making it work is draconian penalties for bypassing the censorship filters, deliberately or otherwise; technically, the bypass process is simple unless you require all ISPs to filter traffic that hasn't been whitelisted, as I just find a VPN that hasn't yet had all its entry nodes blacklisted (and the VPN operator has a commercial incentive to add entry nodes that aren't blacklisted, so you have to keep playing whack-a-mole here).

Even if you permit traffic that hasn't been explicitly whitelisted, there are enough people with plausible reasons to extend the whitelist who are prepared to do things like run Tor relays to get traffic out of a censorship-heavy country - you need the threat of decades in jail for using such a bypass system to make it effective.

Thanks for a useful reply . A lot of meat for me to digest there.

In reply to a post by farnz:

FWIW, the system isn't completely infeasible; North Korea manages it successfully, and both Iran and China make it work most of the time.

In reference to en.wikipedia.org/wiki/Kwangmyong_%28network%29:

Given that there is no direct connection to the outside Internet, unwanted information cannot enter the network. Information is filtered and processed by government agencies before being hosted on the North Korean Intranet. Cuba and Myanmar also use a similar network system that is separated from the rest of the Internet and Iran has been reported as having future plans to implement such a network.

In reply to a post by RobertoS:

Thanks for a useful reply .

Which basically re-iterated many of the points already made, but you chose to discard.

It just seemed easier to follow somehow. Perhaps repetition if that's the case. I'm starting from very little knowledge of VPN, as you can tell - rather like legislators would . I still don't know what TOR is at all, a quick acronym-google didn't help.

It just seems odd to me that with all the technology VPNs are apparently as impervious to blocking as is being said. I have chewing about it to do, with what has been said here.

Hyperthetically speaking such as system if ever it became fact, the internet industry would suffer, Who i their right mind would want a governments white list for a internet connection, or pay for such, ? I for one would not
So less people that use the the governments walled garden could only mean one thing for the rest , big price increases
Or by the time such draconian measures got introduced someone had devised alternative meathods to circumvent the firewall's that couldn't be licenced or blocked by a comunist style government

the original purpose of VPNs was for private LANs indeed thats how many are used, but obviously people eventually realised it was useable to provide a remote gateway to the internet and as such that got popular.

The thing is what you said isnt workable, even if they wanted to do it, it cant be policed.

Funny enough today I finished setting up my own private VPN for netflix on my consoles.

After I figure out a way to automate a selective push mechanism (so the vpn only routes netflix not all traffic.) I will be rolling this out to some of my family member's as well on their routers.

Edited by Chrysalis (Sun 02-Feb-14 00:54:34)

Some folk were discussing that here http://www.dd-wrt.com/phpBB2/viewtopic.php?t=161397
Depends on your router though

yes, those ip ranges are not enough tho.

I am now using another list I found which does work. The list quite possibly catches a few things in the net that are not netflix but does work for its job.

Its only the auth server that needs an american ip, not the streaming server.

In reply to a post by RobertoS:

I still don't know what TOR is at all, a quick acronym-google didn't help.

https://www.torproject.org/about/overview.html.en

In reply to a post by RobertoS:

It just seems odd to me that with all the technology VPNs are apparently as impervious to blocking as is being said. I have chewing about it to do, with what has been said here.

Why would anyone want to block VPNs?

You seem to be majoring on VPN use being mainly to pilfer copyright stuff by getting around site blocks, but as others have mentioned that is just one use for a VPN.

Also you would have serious issues trying to block them anyway, as most VPN providers aren't even based in the UK.

In reply to a post by RobertoS:

So you are saying it is impossible, or just fairly complex?

As some others have mentioned, technically it is possible, if you want to live in a country like North Korea. Practically in any democracy it is impossible, because everyone from large corporations downwards would be somewhat annoyed.

Thanks Jon . I now know what TOR is.

Re the VPN blocking, which I'm almost convinced is a non-starter, unless I'm missing something to get to the foreign VPN you still have to go through your ISP who I believe would know that was where the traffic was going. So it could be blocked.

Earlier posts have shown that even if that were the case, blocking would be far from simple.

In reply to a post by RobertoS:

Thanks Jon . I now know what TOR is.

Re the VPN blocking, which I'm almost convinced is a non-starter, unless I'm missing something to get to the foreign VPN you still have to go through your ISP who I believe would know that was where the traffic was going. So it could be blocked.

So then you can just go Proxy/TOR----->VPN----->Internet. That way your ISP can only see you connecting to TOR or a proxy. What will your ISP block then?

In reply to a post by JonDav:

What will your ISP block then?

Which is why I asked in the first place :-

In reply to a post by RobertoS:

Wouldn't it be dead simple for the powers that be just to make it necessary to have a licence to run a VPN? (Costing money of course). ISPs having to record customer VPN licences and block any unlicensed use of one.

Answer - no it wouldn't.

Edited by RobertoS (Sun 02-Feb-14 19:19:30)

In reply to a post by RobertoS:

In reply to a post by JonDav:

What will your ISP block then?

Which is why I asked in the first place

A very important point about VPNs is that they aren't just used for nicking copyright stuff (as I previously mentioned). VPNs are a useful tool for secure communication over the net.

In reply to a post by RobertoS:

Wouldn't it be dead simple for the powers that be just to make it necessary to have a licence to run a VPN? (Costing money of course). ISPs having to record customer VPN licences and block any unlicensed use of one.

In reply to a post by RobertoS:

Answer - no it wouldn't.

That is your answer.

I'm intrigued Chrysalis. Netflix is a legal service and there seems to be little necessity to hide activity using it. So, why do you need a private VPN for netflix traffic? Seems like a lot of hassle to go to for seemingly little benefit.

This is a serious question as I think I must be missing something here?

UK Netflix & USA Netflix have different contents

By using VPN, you can access USA Netflix to watch their shows that is not available here when connecting from an UK based IP address.

If that is the case then it would appear to be against Netflix Ts&Cs and therefore against the contract that has been signed up to.

So, it is another example of using a VPN to bypass the legal restrictions placed on content.

EDIT : And given that it is against movie industry licensing terms it seems pointless to pay netflix for access as might as well just download torrents - it has the same legal standing.

Edited by ian72 (Mon 03-Feb-14 11:06:14)

In reply to a post by RobertoS:

Thanks Jon . I now know what TOR is.

Re the VPN blocking, which I'm almost convinced is a non-starter, unless I'm missing something to get to the foreign VPN you still have to go through your ISP who I believe would know that was where the traffic was going. So it could be blocked.

Earlier posts have shown that even if that were the case, blocking would be far from simple.

The issue is that I can disguise VPN traffic very easily as something else; North Korea, Cuba and others manage to avoid this issue by blocking everything, except a small amount of data approved by the state, which gets copied onto state-controlled servers. China and Iran do block VPNs officially, but get bypassed routinely by two different mechanisms:

1. Abuse of licensed VPNs; if China permits a VPN from IBM China HQ to IBM USA, it then has to trust IBM USA to not let employees at IBM China access forbidden material via IBM USA's Internet link. All it takes is one employee at IBM USA letting people at IBM China through (by mistake, possibly - "of course Steve, you can Remote Desktop to my machine while I'm asleep to check whether the task I triggered is complete" - and whoops, Steve can also browse the web from your machine).
2. Disguised VPNs, such as Tor in some configurations. This is VPN traffic disguised so that it looks like something acceptable, such as HTTP traffic for web browsing; the disguise is especially effective if the traffic inside the VPN matches the traffic profile of the disguise. The filtering then sees (for example) normal browsing of the Seattle Chinese Post that's been approved by the censor, but someone at the Seattle Chinese Post has arranged for that traffic to route out to the uncensored Internet.

In both cases, draconian (and enforced!) punishments for bypassing the censor are the major way to prevent it happening - if you know that being caught bypassing the censor at all is a guarantee of 10 to 30 years in jail, and being caught accessing banned content having bypassed the censor is a guarantee of life imprisonment or death penalty, you're a lot more cautious than you might be if the penalty is an £100 fine. If you then get the catch rate up high enough that most people who might consider bypassing the censor know someone who's been punished for doing so, you put a heavy brake on the idea.

Whether this is the sort of environment the country that produced George Orwell would like to create is a different question - it's entirely possible to do it, it's just not at all easy.

I dont and currently my VPN has encryption disabled for performance.

I set it up so I could get consoles accessing it via an american ip. (on consoles using a proxy server doesnt work like on a pc).

I am aware is some commercial services that allow just changing the dns server and then they reverse proxy traffic to netflix, but why pay for such a service when I already have my own resources?

yes whitelisting would be an effective way of blocking VPNs. It will be a sad day if our country ever adopts such an approach.

So you are doing it in order to get at american Netflix content that is not licensed/available for viewing in the UK?

Don't even need to use VPN, "SmartDNS" services will do this for you.

EDIT: This was in reply to using VPN for netflix..

Edited by deleted (Mon 03-Feb-14 16:13:16)

of course.

You need to look at this another way tho.

Netflix probably could somehow if they really wanted to be much stricter on their regional policies, eg. a uk account doesnt work from an american ip, but common sense probably plays a part here in that its better for someone in the uk to view us only content than that person to not be a netflix customer at all and as such generate no revenue.

The movie industry is still trying to hold on to ancient business practices such as regionalising their content but thats not consumer friendly.

Which is worse?

Paying for netflix and doing something to view content from another region (typically america as that nearly always gets favourable treatment).
Or downloading copyrighted content for free for viewing.

I know what you might say which is tough luck if they dont want to provide the content here via any official channels then I have to go without, thats not actually the original purpose of copyright, its to protect revenue streams for the creator, if the creator has no revenue stream and copyright is been enforced (simply for control) its abusing the copyright system.

Why you so bothered anyway?

Not particularly bothered, I was trying to understand if there was a "legal" reason to use VPN with Netflix - so was teasing out the answer.

In the end you can do whatever you like as long as you (and the others you are setting this up for) understand it is against the Ts&Cs of Netflix and therefore Netflix could cut you off from using their systems. They probably won't.

But, I disagree that just because they offer it in the US then the income streams are protected by you accessing it from here by paying. The copyright owners might decide in time to offer the content to Netflix UK for twice the price but if people are already accessing it then the income stream is damaged (or they could offer the content to Lovefilm UK and never to Netflix UK and therefore Lovefilm could lose UK income).

We may disagree with territorial controls on content but it is part of the way the media industry work. It may be outdated (and actually has been since region free DVD players were available). But, it is a way they manage their profit/income. Do what you will but don't justify it by saying they are getting their income anyway - they own the media and currently can choose where it is distributed - if you get it via workarounds then you are breaking that copyright.

My only wish is that people would be honest - it is against copyright and Ts&Cs. That is your choice but you can't pretend you aren't by saying they are getting their money anyway.

I don't know if it would really. It would be somewhat akin to trying to stop say, drug dealing via mobiles, by blocking all but a handful of phone numbers. There's just too much to block or whitelist to be possible.

Also, while DPI systems are pretty sophisticated at guessing traffic, they are easy to fool. The problem is no-one really cares enough to do it, because they are not usually blocked. I'm sure as soon as you start trying to block VPNs you'll have a huge incentive for people to write VPNs and proxy software that looks exactly like normal 'legit' web traffic.

"might decide" is weak, you dont get points for been undecisive.

Netflix will have already tried to get all their .us content here. there has even been quotes from their boss stating some content they cant put in the uk due to restrictive licencing.

The legality of it, I am not 100% but as far as I am aware it is illegal, to watch .us content in the uk but its not illegal in terms of the account, netflix is designed so that a uk account can watch .us content but actually in america such as when you on a trip. So if a .us account holder came to the uk they would get restricted content.

so technically speaking I am not breaching my netflix agreement, as I am accessing the american content on a american ip, however me personally since I am the one streaming from my american server to myself here in the uk (via vpn) its arguable that I am doing something illegal yes. Not sure if its clearcut tho. As of yet I have not heard about movie companies going after vpn services that commercially get sold as netflix workarounds.

This isnt the only vpn I manage, I have a few but all the others are used purely as private lan's, not remote gateways for internet data.

Edited by Chrysalis (Tue 04-Feb-14 14:50:12)

as I mentioned in the gaming section, these dns services are more than just a dns server, they route netflix traffic via a reverse proxy so its an american ip accessing the appropriate netflix servers.

When using my own resources, its easier to configure a vpn than it is to configure some kind of complex reverse proxy system.

Of course on a pc its very easy, just use a basic socks proxy.

Netflix Ts&Cs are here

6c states:

c.You may view a movie or TV show through the Netflix service only in geographic locations where we offer our service and have licensed such movie or TV show

(my bold)

6e:

e.You agree to use the Netflix service, including all features and functionalities associated therewith, in accordance with all applicable laws, rules and regulations

6h:

h.We may terminate or restrict your use of our service, without compensation or notice if you are, or if we suspect that you are (i) in violation of any of these Terms of Use or (ii) engaged in illegal or improper use of the service.

Seems pretty clear to me that you have to be in the right geographic region to access content and anything to bypass those controls may result in termination.

Again, Netflix may not care but their terms do cover this.

my netflix end point is in the right geographic location.

Just the thing http://www.gizmag.com/iridium-go-satellite-hotspot/3...

Again we have to disagree. The netflix endpoint is you and your computer. You are watching it outside of the licensed region. It maybe semantics and they won't almost certainly won't do anything but your argument would not stand up in court. The end point is the bit at the end - not the bit in the middle.