Netgate SG-1000 microFirewall

Author Topic: Pfsense plus hurricane electric breaks netflix IPV6 - proxy error  (Read 2646 times)

0 Members and 1 Guest are viewing this topic.

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4954
  • Karma: +196/-40
  • Debugging...
    • View Profile
Re: Pfsense plus hurricane electric breaks netflix IPV6 - proxy error
« Reply #15 on: October 21, 2017, 03:07:14 pm »
Yep - I've heard somewhere that might work...

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4954
  • Karma: +196/-40
  • Debugging...
    • View Profile
Re: Pfsense plus hurricane electric breaks netflix IPV6 - proxy error
« Reply #16 on: November 04, 2017, 03:26:48 pm »
I could be wrong about this, but I bet there is more than just Netflix out there blocking access to their site if someone is using a IPV6 tunnel.

Wonder if one of the people who make updates for surricata might compile such a list of IPV6 offenders so they can be blocked at the wan by a regularly updated list?
Then everyone who uses a tunnel won't have to update their custom resolver configs every time Netflix does something new. 

They could just call the rule set "IPV6 Tunnel Idiots" or something. 

Offline tartan

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
I finally put the time in today to fix this.

I really needed to leave ipv6 running here, and I rely on HE for this, since Charter Spectrum Business STILL hasn't rolled out ipv6 in my part of Georgia, USA.

Sure, I could kick Netflix out of my house, and then my wife and kids would kick me out.  I could put them all on an ipv4-only vlan with a dedicated wifi SSID, but that, to me, is a step backward.

After reading through the various Reddit posts and such, I decided to take the brute-force firewalling approach.  Special thanks go to diyftw for his/her contribution around the specific whois lookup, within this thread:
https://www.reddit.com/r/PFSENSE/comments/5ei2t6/netflix_over_hurricane_electric_tunnel_broker

Essentially, I'm rejecting all outbound ipv6 packets to all Netflix ASNs [I have found], as well as to ALL of Amazon AWS, since Netflix uses AWS heavily, and I'm in no mood to keep up with which IP ranges Netflix is using from AWS.

The Netflix ranges update somewhat automatically.  I have a list of ASNs from HE at https://bgp.he.net/search?search%5Bsearch%5D=netflix&commit=Search.  (Thanks again to diyftw for that URL.)  But I don't yet have a way to discover new ASNs should Netflix add them.  I do a whois query nightly against these known ASNs, to at least keep them updated.

The AWS IP ranges update automatically.  Thanks to this lovely blog post, http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html, which references this json file https://ip-ranges.amazonaws.com/ip-ranges.json, I can daily look up what Amazon claims it's using.

So here's how I did it..

1) From the shell of pfsense, add a script somewhere, such as /root/get_netflix_v6, and make it executable.  Notice that the script writes the IP networks into the web directory of pfsense, so they can be used as alias URLs.

Code: [Select]
#!/bin/sh

# get_netflix_v6

# Netflix ASNs from https://bgp.he.net/search?search%5Bsearch%5D=netflix&commit=Search
AS="AS55095 AS40027 AS394406 AS2906 AS136292"

# Backup previous list
cp /usr/local/www/netflix/netflix_ipv6 /usr/local/www/netflix/netflix_ipv6.`date "+%G%m%d_%H%M"`

# Query for ipv6 networks within Netflix ASNs, and create new list of networks
for i in $AS
do
        whois -h riswhois.ripe.net -- -F -K -i $i | grep "^route6" | awk '{print $2}' | sort
done > /usr/local/www/netflix/netflix_ipv6


# Amazon AWS ipv6 range

# Backup previous list
cp /usr/local/www/netflix/aws_ipv6 /usr/local/www/netflix/aws_ipv6.`date "+%G%m%d_%H%M"`

# Query for ipv6 networks from AWS listing, and create new list of networks
# I didn't feel like installing the json package into pfsense when some simple grep and awk do the trick.
curl -s "https://ip-ranges.amazonaws.com/ip-ranges.json" | \
        grep "ipv6_prefix" | \
        grep -v "ipv6_prefixes" | \
        awk '{print $2}' | \
        awk -F'"' '{print $2}' | \
        sort | \
        uniq \
        > /usr/local/www/netflix/aws_ipv6

2) Setup the web directory, and touch initial, empty files:
Code: [Select]
mkdir /usr/local/www/netflix
touch /usr/local/www/netflix/{netflix_ipv6,aws_ipv6}

3) Run the script once, then confirm
Code: [Select]
/root/get_netflix_v6
tail -10 /usr/local/www/netflix/{netflix_ipv6,aws_ipv6}

for example:

[2.4.2-RELEASE][root@xxxx.xxxxxxx.xxx]/root: tail -10 /usr/local/www/netflix/{netflix_ipv6,aws_ipv6}
==> /usr/local/www/netflix/netflix_ipv6 <==
2a00:86c0:39bc::/48
2a00:86c0:39bd::/48
2a00:86c0:4::/48
2a00:86c0:5::/48
2a00:86c0:600::/48
2a00:86c0:601::/48
2a00:86c0:98::/48
2a00:86c0:99::/48
2a00:86c0::/32
2a00:86c0:ff0a::/48

==> /usr/local/www/netflix/aws_ipv6 <==
2a05:d07c:8000::/40
2a05:d07c:c000::/40
2a05:d07e:2000::/40
2a05:d07e:4000::/40
2a05:d07e:8000::/40
2a05:d07e:c000::/40
2a05:d07f:2000::/40
2a05:d07f:4000::/40
2a05:d07f:8000::/40
2a05:d07f:c000::/40

4) Add the cron package from the pfsense package manager.  Go to Services | Cron, and run the update script daily.  I run mine at 3am
Code: [Select]
0 3 * * * root /root/get_netflix_v6 2>&1

5) Create two aliases at Firewall | Aliases | URLs
Code: [Select]
Name = awsv6
Description = Amazon AWS ipv6 networks
Type = URL Table (IPs)
URL Table (IPs) = https://127.0.0.1:443/netflix/aws_ipv6         / 1      <--- the / 1 tells pfsense to re-read the file daily

Name = netflix6
Description = Netflix ipv6 networks
Type = URL Table (IPs)
URL Table (IPs) = https://127.0.0.1:443/netflix/netflix_ipv6         / 1      <--- the / 1 tells pfsense to re-read the file daily

6) Add two rules at Firewall | Rules | Floating -- I put mine near the top of the list:
Code: [Select]
Action = Reject                 <----- You really do want to Reject here, not just Drop, so that the client immediately is informed of such
Quick = yes, Apply the action immediately on match
Interface = (select all the internal network interfaces where you have ipv6 users who want to use Netflix)
Direction = any
Address Family = IPv6
Protocol = Any
Source = any
Destination = Single host or alias = netflix6

And then create a second, identical entry for:
Destination = Single host or alias = awsv6

Click Apply

7) Test!

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4954
  • Karma: +196/-40
  • Debugging...
    • View Profile
Yep - Fixed this ages ago also basically by not allowing ipv6 netflix anything. 
Still - I think it is crazy stupid of netflix to so zealously block anything remotely related to a tunnel.

It is stupidity with a capital S. 

Offline tartan

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
Yep - Fixed this ages ago also basically by not allowing ipv6 netflix anything. 
Still - I think it is crazy stupid of netflix to so zealously block anything remotely related to a tunnel.

It is stupidity with a capital S.
Agreed.  It's too bad they didn't at least talk with the HE team to come up with a better plan.  Surely Netflix realizes tons of ISPs have not yet implemented ipv6, and that tunnels will be used for legit purposes.

Oh well.

Anyway, I wanted to provide that write-up for others who are struggling, and for myself for future reference.