Netflix: how to route one device through pfSense IPSec VPN to another pfSense FW, and exit through that WAN

andrewinhawaii

Please help me implement this routing to get around Netflix's "Give us more money" policy.

I have two houses, one is my parents that I am living in while my house is being renovated. Both houses have a LAN with a pfSense firewall. Both have distinct WAN connections. I have successfully set up the IPSec VPN between the two locations so that I can mount remote NFS shares as if they are local, and I can ssh to hosts between the two locations. Both pfSense installations are running NAT. One house is subnet 10.0/16 and the other is 10.1/16. I have a Roku streaming box at both locations. The one at 10.0.0.X was the first, and works fine. The second is on 10.1/16 at 10.1.0.Y. It worked for a few weeks until Netflix got greedy.

Now I am trying to route Roku box 10.1.0.Y through the VPN so that it comes out at WAN1 instead of WAN2 (please see the drawing). I'll be damned if the Roku boxes are the only devices with an ethernet port that does not allow for a static configuration, it must be DHCP.

On the 10.1/16 firewall, I have added a LAN rule to route only 10.1.0.Y packets to !RFC1918 addresses through IPSecGW. That seems to be working as tons of data seems to be going through that rule:

	Aug 27 23:27:01 	LAN 	10.1.0.Y:58774		8.8.4.4:53		TCP:S
	Aug 27 23:27:02 	LAN 	10.1.0.Y:46941		8.8.4.4:53		UDP
	Aug 27 23:27:04 	LAN 	10.1.0.Y:41748		52.38.7.83:80		TCP:S
	Aug 27 23:27:04 	LAN 	10.1.0.Y:41750		52.38.7.83:80		TCP:S
	Aug 27 23:27:04 	LAN 	10.1.0.Y:56540		44.240.158.19:80	TCP:S
	Aug 27 23:27:05 	LAN 	10.1.0.Y:57066		44.242.13.161:80	TCP:S
	Aug 27 23:27:08 	IPsec 	10.0.0.1:3294		10.1.0.1:53		UDP
	Aug 27 23:27:08 	LAN 	10.1.0.Y:33432		10.1.0.1:53		UDP
	Aug 27 23:27:08 	LAN 	10.1.0.Y:43393		10.1.0.1:53		UDP
	Aug 27 23:27:09 	LAN 	10.1.0.Y:59860		23.46.228.132:443	TCP:S
	Aug 27 23:27:09 	LAN 	10.1.0.Y:46812		23.46.228.143:443	TCP:S
	Aug 27 23:27:10 	LAN 	10.1.0.Y:44816		8.8.8.8:53		TCP:S
	Aug 27 23:27:13 	LAN 	10.1.0.Y:58794		8.8.4.4:53		TCP:S

I also added IPSec rules to pass traffic to/from 10.1.0.Y though they seem to be unused.

But I'm not seeing the traffic on 10.0/16, nor is the Roku box getting anything. I added IPSec rules to pass anything from 10.1.0.Y but they are also unused.

Here is a diagram of the set up I hope helps explain it.

Thanks for any help getting this to work.

Andrew

Gertjan

@andrewinhawaii

Thinking out loud :
Get the AS of Netflix. You could use pfBlockerng for that, and have it create a 'Netflix' table with all Netflix's IP addresses.
Use this table in a policy firewall rule, so that when the destination IP matches the 'Netflix' table, the traffic is routed to the designated 'WAN' : your VPN connection.

Btw : As a Netflix client I think I understand you. I'm the one paying for it, and use it on 'my' living room TV, never on something else. My wife uses often her iPad to watch here stuff. The third account is used by the daughter, on her phone, pad, PC, and TV in here room. All connections to Netflix come 'from my Home' == my one and only IPv4 (op whatever the IPv6 equivalent is).
Still, ones in a while, I, the ones how is paying the "3 screen account' (the max one) gets the message 'to many devices connected. ... wtf ....
I'm not sure .... kids follow 3 series in parallel on 3 different device these days ? Is that a thing ?
And no, I'm not sharing my access codes with someone 'not family', that's not possible anymore.

tinfoilmatt

Policy routing.

A little gauche to ask publicly how to violate Netflix's TOS, though.

Gertjan

@tinfoilmatt

Afaik, if you pay for a '2 screen' access, then at any time your account can be logged twice.
From what I know, if one person logins in from Alaska, let's call that state 'Home', and the other person from home is on trip to Hawaii for work, both US (right ?) then 'it should work'.
Or is connecting from 'another' state a violation ? I'm not sure, as I'm in France.

Using their services from another country then your own, I know, that's a no go now.
Accessing their services with a VPN ? That a "death threat" direct.

The idea of tunneling a connection to home, so you can connect from your "known" home WAN IPv4, why not ? Is that against TOS ?

edit : I was presuming that @andrewinhawaii wasn't TOS bending.