amazon prime does not work with pfsense (openvpn)

lovan6

It has nothing to do with Pfsense. It is the server you are connected with ExpressVPN. Go ask ExpressVPN which is a working server connection.

Sometimes the server you get connected is okey and sometimes not.

I had the same exact experience with ExpressVPN. it takes several days to get a good connection and the problem is always on their end. If you ask customer service they will tell you there is nothing wrong on their end which make it so confusing.

Trust me I had the same dilemma. just be patient and wait until those engineers fix it.

jagradang

I seriously doubt this is a pfsense issue, I have this problem and my dns is always routed through cloudflare. I enable vpn and amazon blocks my firestick. I disable vpn and they allow it. My dns is exactly the same in both situations.

The issue is with the vpn providers servers being blocked

https://www.reddit.com/r/nordvpn/comments/bgkw0s/amazon_prime_has_started_blocking_nordvpn_servers/?utm_source=amp&utm_medium=&utm_content=comments_view_all

wpmccormick

I think it might be possible that it has something to do with pfSense, as my current work-around is to restart the DNS Resolver service. That said, I believe the root issue is that I don't have my DNS configured correctly for what I'm trying to do.

What I'm trying to do is route all traffic (including DNS) from a specific host through a VPN. And I thought I'd like to route all network DNS traffic through the VPN as well (to plug DNS leaks), but now I can see that may cause some issues with some hosts. I followed followed this guide to get as far as I have.

The specific host (it's a Linux VM) is mostly working, but DNS is leaking:

ubuntu@ubuntu-18-04:~$ ./dnsleaktest.sh 
Your IP:
208.84.155.45 [United States of America AS46562 Total Server Solutions L.L.C.]

You use 9 DNS servers:
24.93.50.4 [United States of America AS11427 Time Warner Cable Internet LLC]
24.93.50.5 [United States of America AS11427 Time Warner Cable Internet LLC]
24.93.50.7 [United States of America AS11427 Time Warner Cable Internet LLC]
24.93.50.9 [United States of America AS11427 Time Warner Cable Internet LLC]
24.93.50.12 [United States of America AS11427 Time Warner Cable Internet LLC]
24.93.50.14 [United States of America AS11427 Time Warner Cable Internet LLC]
24.93.50.15 [United States of America AS11427 Time Warner Cable Internet LLC]
24.175.34.39 [United States of America AS11427 Time Warner Cable Internet LLC]
103.86.96.100 [Australia AS36351 SoftLayer Technologies Inc.]

Conclusion:
DNS may be leaking.

And not surprisingly, DNS is leaking for other non VPN LAN clients.

The key configuration points are:

Services->DNS Resolver->General Settings->Outgoing Network Interfaces: [WAN, VPN_INT]
Services->DNS Resolver->General Settings->DNS Query Forwarding: [Enable Forwarding Mode]
System->General Setup->DNS Server Settings->DNS Servers: [VPN DNS1, VPN DNS2]

For item 1 above, I tried to configure without the WAN interface, but that basically shut down all DNS capabilities for clients not using the VPN.

When I look at Status->DNS Resolver, I see my VPN DNS server IP's, and additionally 2 DNS IP's that I assume are from my ISP; not sure how the ISP DNS servers get configured in, but maybe that's the problem?

Thanks!

johnpoz

If you want to forward only to specific NS, then turn off getting dns from ISP.

wpmccormick

I think that is done by setting Services->DNS Resolver->General Settings->DNS Server Override:[OFF]. And then probably Services->DNS Resolver->General Settings->Outgoing Network Interfaces: [VPN_INT] (i.e. VPN only)

Doing that, I was able to get Amazon Prime to work (Roku app), but it seemed slow and wonky (thumbnails didn't display), but whatever I blindly selected did play. I quit the app, and started it again and it seemed okay. However, still on Roku, running the Sling TV and apps that depend on it (ESPN) do not work. Also, connecting to https://www.amazon.com from a PC did not work.

Put the DNS Server Override back on and all is normal. I'm stumped. Any other ideas?

wpmccormick

I think I figured how to make this work: I configured the DHCP Static mapping for the Roku device to use googles DNS and all is well ... so far.

wpmccormick

it didn't take long to find something that doesn't work ... I forgot to check if amazon works, and it does not.

That might be a good thing really, but still, I'd rather have it work and it's probably not the only web site that will be an issue.

I don't mind setting DHCP Static DNS settings for a few devices, but more than a few is ugly, and setting google DNS Servers for all clients defeats the purpose.

There must be another way.

wpmccormick

Just logging issues here; another thing that this DNS issue causes is that NFL.com Fantasy Football Game Center does not work.