GL-B1300 - VPN Policy - Netflix strange ISSUE

ralf00 · 2019-10-14T13:26:13.570Z

Hello,

i got this GL-B1300 router that works very well also with my Premium Account with NordVPN (Open VPN).

The speed under VPN is about 25 Mbit in down and 18 Mbit in up, so is quite good!

I use the VPN to route specifics IP subnet through the VPN and allow standard trafic for all the other subnets.

In particular i have 4/5 B-CLASS subnet like

83.12.0.0/16
85.19.0.0/16
97.112.0.0/16
104.98.0.0/16

using the VPN POLICY “Use vpn for these DOMAIN/ IP RANGE”

Everythink works fine except that i OPEN NETFLIX and i fall in a generic network error (not the same that i have when i’m covered by VPN “it seems that you are under proxy connection”, but is a generic network error like “cannot connect, verify your internet connection blablabla”).

So i thought MAYBE some of the ADDRESS i used includes some netflix services so I cleaned up all the list and i just leaved there A FAKE IP like: 99.99.99.99 with the expectation that only for that IP the VPN would have worked.

The result is that also with that configuration NETFLIX still doesn’t work with that generic error and it only happens when VPN POLICY is ENABLED. Of course with VPN POLICY DISABLED it doesn’t work because it says that i’m under VPN.

So i cannot achieve my goal that is: USE VPN FOR A SET OF IP RANGE and DOESN’T USE FOR ALL THE OTHERS (LIKE NETFLIX).

Amazon Video works correctly with the same setting.

Can anyone help me?

My hypothesis is that NETFLIX try to open many connections and the router performance cannot handle that inspection but it’s just an unjustified hypothesis.

Thank you

antifascista · 2019-10-14T20:05:33.878Z

Netflix controls your dns too…and you are using dns of vpn…This is your problem and it is confirmed by displayed error.
I have had your same problem and I have solved using an italian vpn for my italian netflix that is excluded from using vpn in vpn policies.

robotluo · 2019-10-15T02:48:33.119Z

When policy routing is enabled, system DNS Settings are enforced, which may be the cause of the problem.
You can set DNS manually as required by Netflix and then Override DNS Settings for All Clients.

ralf00 · 2019-10-15T07:07:02.722Z

I’m italian so the situation is the same. I’m connected through vpn to an italian server (nord vpn) so i’m already that situation.

How am i supposed to configure DNS? Using google? 8.8.8.8 or whatever? dns i guess cannot be set with specific policy, no?

For you it was enought to connect to an italian server and it worked? How did you set up the “excluding netflix vpn policy”?

Grazie

ralf00 · 2019-10-15T07:08:05.930Z

Which DNS do you advice to use? if i use common dns like 8.8.8.8 i will be still covered by the vpn? Thank you

antifascista · 2019-10-15T09:13:06.247Z

DNS that you are using it’s dns of your vpn and you can not use alternative dns while vpn is running because vpn policies can only route traffic. You have to try another italian vpn server of your vpn service that netflix doesn’t block.

VPN Policy and Android (TV) and Netflix Technical Support for Routers

Wanted to make use of the “new” VPN Policy function on Mango V2. I want to push the Netflix App on my Android (TV) boxes to a US VPN setting (via NordVPN) but only Netflix as otherwise my local provider apps won’t work as they need to be in local Australia. I’m assuming for my desktop/notebooks I should be able to use just www.netflix.com as a domain to push through the VPN (as you have to explicitly got to that URL to get Netflix) however does this work for Android Apps too ? I will have a…

I have spent lots of time but it’s working fine.

ahhydri · 2024-02-03T06:45:56.523Z

You mean in dhcp i should set dns to 8.8.8.8 for the clients and then on the router dns gui select option to override dns setting for all clients ?

@robotluo

admon · 2024-02-03T07:40:11.321Z

No. In DHCP you should set your routers IP.

ahhydri · 2024-02-03T08:25:41.572Z

I’m facing a weird issue, Netflix with the vpn works fine on my chrome browser, mobile application, but on google Chromecast it doesn’t work and say I’m using proxy. what could be the issue ?

admon · 2024-02-03T08:30:51.712Z

Can’t tell, sorry.

VPN policies are a very complex thing and you need to try out and / or dig deep into the internet for solutions.

xize11 · 2024-02-03T09:31:30.618Z

you might have to look into dhcp tagging (edit: for sending custom dns to a client.)

OpenWrt Forum – 12 Feb 22

Using Tags to define range in which IP address should be assigned from

Installing and Using OpenWrt Network and Wireless Configuration

Hi there, I currently have setup a walled garden range of IP addresses which don't have access to the Internet (i.e. deny rules in both UPNP as well as Firewall). This works as intended. The clients are currently setup with a static ip address...

Reading time: 1 mins 🕑 Likes: 1 ❤

OpenWrt Wiki – 25 Nov 09

DHCP and DNS configuration /etc/config/dhcp

DHCP and DNS configuration /etc/config/dhcp See also: DHCP and DNS examples, dnsmasq, odhcpd OpenWrt uses dnsmasq and odhcpd to serve DNS/DHCP and DHCPv6 by default. Roles Ports Packages Configuration DNS server 53/UDP, 53/TCP dnsmasq ...

The only issue arises is that there might be a chance one detection looks to the ip origin geo, and the origins dns geo, if that mismatches you are still blocked.

To be honest from what ive been observing i already gave up, they make it really hard especially if they start using vpn block lists even full ripe blocks from datacenters in the end its still public information.

admon · 2024-02-03T09:34:42.425Z

Referring to DHCP seems unlikely.

I would assume that the Chromecast maybe does some DNS-over-https stuff or something like this.

xize11 · 2024-02-03T13:08:09.727Z

oh I see, I was confused with the OP and thought it was a new topic.

though i would like to make a suggestion for such things:

would it be a better idea if there was a rule for bumping a very old thread and instead it would be advised to make a new topic with a link to this thread?

in some forums its called ‘thread necroing’ though I don’t think the user is aware so this is not a attack in anyway, but it can avoid various situations such as the collective thread but also that more people start following this example ‘hijacking’ threads/bumping really old threads with their own issue I quoted it, because the user is unaware, again its not personal, it also helps the site alot for the search engines