How to setup equivalent USVIDEO.ORG DNS-Proxy on Linux

Question

I have a VPS in the USA running Ubuntu. I want to setup something similar to http://www.usvideo.org Basically, USVIDEO is a DNS service that allows Canadians to access American content like Hulu, Netflix, NBC, and etc (restricted by geographical IP).

Here is how I think USVideo does it:

1. Clients (PS3, XBOX, PC) specifies the DNS server(s) as specified on USVIDEO.org's website.
2. If the DNS request is a video/audio site such as Netflix or Pandora, forward the request to a proxy. Otherwise, for all other requests, forward it to a different DNS server.
3. If the specific video/audio URL is requested, return the address of the proxy server, which in turn relays traffic to the destination video/audio domain via the U.S. gateway so that it appears that the access is coming from a U.S. IP address.
4. Once the DNS request has passed the U.S. IP address check, their proxy server steps out of the loop and lets the video streaming site contact you directly to start the video stream. This trick relies on the way that the video streaming sites check the country of your IP address once up front, but don't actually check the country of the destination IP address while the video is streaming.

What is elegant about this solution is that a VPN Tunnel is not required to bypass geographical IP checks from certain websites. All that is required on the client side is to specify the DNS server (the VPS). If a certain site is geographically locked, just forward the traffic to a proxy, and that's it. These sites can be specified in the DNS entries, or perhaps in the proxy service to redirect the DNS request to its own proxy.

I believe what I need to setup something similar is Squid Proxy, IPTables, and DNS. What I need help is how to exactly approach this? Would Squid Proxy be setup as a transparent proxy?

Solution 1

The trick is not just what you proxy, but what you don't proxy. Most video sites host there web content and video content on different hosts or even different domains. In the case of hulu.com all the video content is on akamaitechnologies.com domain... So if you proxy hulu.com but not akamaitechnologies.com you can fake the geographical region.

Even better, if you have an access to a router, and a low bandwidth vpn service, you can pretty much just do this with firewall rules. You redirect the low bandwidth stuff to your vpn service, and leave the high bandwidth stuff unfiltered. The beauty of this solution is there are many free low bandwidth vpn providers... If the number of sites you want to tick is fairly low, you could also use ssh tunnels instead of vpn.

Solution 2

1. you need to run your own private dns with artificial records for example pandora.com
2. you also need a real dns to fall back on.
3. now that all requests for these sites are going to your US located box you can open up port 80 on squid and listen for the traffic. your cache_peer settings should allow you to map each domain to their real ip. The trafic now flows initially from your US located box to the service but then the server responds it responds directly to the host. no magic here. I won't share the fine details as it probably best serves all to not over exploit this.

Solution 3

For reference, there is a way of doing this simply using caching-only BIND DNS and SNI Proxy:

1. Get a cheap Linux VPS in the US (e.g. Digital Ocean)
2. Install BIND and SNI Proxy on your VPS
3. Configure BIND to override *.netflix.com and return the IP of your VPS
4. Configure SNI Proxy to proxy *.netflix.com (HTTP/HTTPS)
5. Point your player device (e.g. Apple TV) to your VPS's public IP

The idea is that only *.netflix.com requests will be proxied via your VPS in the US, but video content coming from Akamai CDN will be accessed by your player device directly.

Also works for many other geo-locked services, such as Pandora, Crackle, etc.

--ab1

Ref: DIY clone of Netflix Tunlr/Unblock-Us/UnoTelly on cheap US based VPS

Ref: SNI Proxy GitHub

Solution 4

but services like http://tunlr.net does this automatically and for free. I am sure there's no 'netflux' in play there...

Solution 5

I wouldn't play any tricks with DNS; rather, I'd set up a proxy on the local net that only uses a proxy on the VPS for the specified domains. E.g., squid's cache_peer_domain option will accomplish this. On the local squid you'd add

cache_peer_domain vps-in-america.example.com .pandora.com

View more solutions

Comments

[Nicolo]

Does your method allow SSL(https) connection? If you create a fake site (i.e. NetFlux.com), the SSL certificate will generate an error while you try to access the content. I believe Netflix uses https connection to load their media player.