Netflix Streaming broken if using HE IPv6 Tunnel Broker service

[effadj]

I use the Hurricane Electric (HE) free IPv6 Tunnel Broker to get to IPv6 servers as I was having major time-outs using my AT&T ISP IPv6. I recently discovered, via my family screaming, that Netflix does not work anymore (started last Wednesday). In Netflix quest to block proxies and VPNs for folks outside of US accessing US Netflix content, it seems that Netflix has blocked HE IPv6 space. So, no device on my LAN can access Netflix, unless I turn off IPv6 or use a DNS server that doesn't resolve AAAA addresses (so the traffic doesn't go through the tunnel).

I've just contacted HE about it today, but I was wondering if anyone here uses this HE IPv6 Tunnel service has found a simple solution for the AsusWrt-Merlin software?

Thanks.

 

[Snoopotic]

Hi,
you shall use a tunnel server at HE near your current location. Did you try different tunnel server(s)?

 

[effadj]

Hi,
you shall use a tunnel server at HE near your current location. Did you try different tunnel server(s)?

I just put in what they assigned me when I signed up. As far as I know they have no server list to choose from.

 

[Snoopotic]

How did you do? Tunnelbroker.net (the page behind HE) has in its "create new tunnel" dialogue as first step to choose the location of the tunnel server. They have 3 Asia ones, many Europe ones and also many US ones. You can set up 5 Tunnels (but only use one at one time, for sure )

 

[effadj]

How did you do? Tunnelbroker.net (the page behind HE) has in its "create new tunnel" dialogue as first step to choose the location of the tunnel server. They have 3 Asia ones, many Europe ones and also many US ones. You can set up 5 Tunnels (but only use one at one time, for sure )

Sure. I picked Chicago, IL, US @ 184.105.253.14. That is the closest to me.

 

[sfx2000]

It used to, kind of worked - with HE Tunnels... never was optimal. And then when NFLIX starting putting down the screws on GeoLocking, they see HE Tunnels the same as VPN's.

Not HE's fault, it's the design of how NFLIX is doing their CDN's...

Might have to put in a rule to allow local ISP access to the CDN for NFLIX...

 

[sfx2000]

Might have to put in a rule to allow local ISP access to the CDN for NFLIX...

blocking v6 and allowing v4 on the local ISP...

 

[sfx2000]

and bonus tip...

the "apps" have Google DNS hardcoded - so you might consider at least trusting 8.8.8.8 and 8.8.4.4 as trusted DNS servers - block them and with some APP's, you'll have problems...

 

[effadj]

What a pain.

 

[sfx2000]

What a pain.

Indeed - esp. as a legit user on travel...

 

[effadj]

We have a lot of Apple products and they love to use IPv6. My native ISP IPv6 from AT&T does not work very well as it drops connections. So I thought HE was a solution and it does work well for me until the NetFlix BS I noticed today and found it was due to the HE tunnel.

 

[sfx2000]

So I thought HE was a solution and it does work well for me until the NetFlix BS I noticed today and found it was due to the HE tunnel.

yep

 

[reddice]

I know. I had to turn off IPv6 HE.net and factory reset my router. Not happy I am legally in the US watching US Netflix now they are even blocking that.

I had HE.net set to New York where I am located so I am in the same state.

Also I know this is the Merlin thread even though I am using shibby Tomato but still it does no longer work with that firmware either.

 

[sfx2000]

Just keep in mind that this is _not_ a RMerlin/Tomato/Shibby problem - nor one with HE.NET

It's purely Netflix...

 

[reddice]

Thanks. This started on June 2nd for me when I tried to watch Netflix in the Windows 10 app. I am really ticked off with Netflix. Not just this crap but with its push of original content 90% which is why are rates went up I have no interest in and the ever shrinking content the latest being the Mirimax movies. So far though Hulu and Amazon works with iPv6 HE.net tunnel.

Also forgot I found a bunch of links Googling so I am not alone but seems like it here. Tip on Googling search for past week or month otherwise you will get old irrelevant links.
http://blog.cyphermox.net/2016/06/ne...ling-with.html
http://seclists.org/nanog/2016/Jun/24 (Warning: Have to click for every new topic).
http://www.dslreports.com/forum/r307...t-IPv6-Tunnels
https://forums.he.net/index.php?topic=3564.0

Too think I only been using IPv6 HE.net tunnel for about 2 weeks. For me it started on June 2nd some had issues on June 1st but that was the day Netflix banned HE IPv6. Got tired of my ISP TWC Earthlink doing nothing for years saying it will be ready by 2014, 2015, 2016 still IPv6 Nothing so I would not have noticed if I never experimented with it.

 

[sfx2000]

The IPv6 rollout has been, for lack of a better word, interesting to say the least.

CoxHSI has been doing the slow-roll launch, and has run into a number of issues, not just with customer routers, but also their own premises equipment. They went general availability back in Feb of 2016 for many markets, including my own. It hasn't gone well, at least for some... myself included.

Many here know that I'm a recovering standards guy, and even as a former member of IETF, and running a good platform for ipv6 (pfSense), I've actually disabled the WAN side IPv6 as we currently have a situation that works poorly across multiple platforms. I still run IPv6 inside my LAN, and there it works fairly well - and esp. with mDNS (aka Bonjour/Avahi).

I do have an Hurricane Electric tunnel set up via TunnelBroker - but content providers like Netflix (and others, esp. in the "app" space) see it similar to other approaches for geo-unlocking and refuse to work.

v6 is enough of a problem that it was specifically excluded from the latest test plan updates - as each carrier tends to take a different view of how to deploy v6...

 

[reddice]

It's up to HE.net to actually block IPv6 for Netflix. This means on there end when you go to Netflix.com it will only go to the IPv4 site even when you are using the HE.net tunnel.

 

[john9527]

CoxHSI has been doing the slow-roll launch, and has run into a number of issues, not just with customer routers, but also their own premises equipment. They went general availability back in Feb of 2016 for many markets, including my own. It hasn't gone well, at least for some... myself included.

What kind of problems are you having with Cox IPv6? I got them to turn it on 'early' for me, and it's been solid (after I fixed some bugs in my fork )

 

[sfx2000]

What kind of problems are you having with Cox IPv6? I got them to turn it on 'early' for me, and it's been solid (after I fixed some bugs in my fork )

Running into issues where their infra occasionally "forgets" that they've given me IA_NA and IA_PD - and packets start getting blackholed before the lease expires.. Renewing the interface fixes things for a bit - e.g. I get a new IA_NA, but we remain with the same IA_PD, so it's not like it's forgetting who I am..

They've haven't been a whole lot of help trying to sort this - and yes, it's been escalated up into their engineering department... first they asked me if I was running Airport (which I do as AP's only, routing is pfSense), which they claim is an airport issue, not theirs - when I sent them pcap's, additional log data, and a technical write up of the problem and a proposed solution.

They pretty much clammed up and closed the ticket without resolution. Since them I've been slowly peeling back their services - TV was first to go (moved to DirecTV), and then yanked the hardline (POTS), and if they don't fix this, I'll move to ATT Business DSL, which while perhaps not as fast as Cox, it works..

Since I work from home these days - the quick fix was to just disable IPV6 and get back to work - it's not my job to debug their network.

 

[reddice]

Decided to delete the Netflix app off all of my IPv6 devices like the Apple TV nexus phone and tablet. Netflix works perfect on my IPv4 only devices like the Roku firetv ps4. Not going nuclear and turning off ipv6 just for those devices as ipv6 websites run so much faster then when they are on IPv4.

Sent from my Nexus 7 using Tapatalk