Clampdown on TV 'Dodgy Boxes'

The VPN service effectively acts as a proxy and the dodgybox service will see an IP from the VPN service rather than the ISP subscriber's IP.

But it doesn't matter what IP the dodgy box service sees.

The task is to fool the ISP into thinking you are not connecting to the dodgy box service.

I can't square the circle that you can use a VPN to do two different things, convince a destination that you are coming from somewhere you are not and convince your ISP that you are going to somewhere you are not.

What seems to be missing is the concept of routes. This is a very simplified version (leaving out a lot of stuff) of what happens.

subscriber IP - ISP route - dodgybox service

subscriber IP - ISP route - streaming service

The IP is the one assigned by the ISP. Traffic to and from an IP addresses on the Internet effectively follows routes.

At the most simple, a route is where data to a particular range of IP addresses goes. A router will essentially send the data for a particular range of IP addresses to a gateway for those IP addresses.

Without the association of IPs with routes and thinking of things as being just a connection of one IP address to another, that might be causing the confusion. (There can be multiple routes but that is not necessary for this simple explanation.)

With the examples above, the traffic from the dodgybox service goes to the subscriber's IP via the ISP's route. The traffic from the streaming service goes to the subscriber's IP via the ISP's route. Think of routes as roads and the subscriber IPs as being houses. With the above, the data from the dodgybox service/streaming service takes the road to Dublin in order to get to the subscriber's house.

With the VPN service between the ISP and the dodgybox service/streaming service, there is an extra route for the data from the dodgybox service/streaming service.

Subscriber IP - ISP route - VPN route - dodgybox service

Subscriber IP - ISP route - VPN route - streaming service

In the examples above, the dodgybox service / streaming service send the data via the VPN service's route. The VPN service then sends that data to the subscriber's IP via the ISP's route. The dodgybox service/streaming service sees the IP from the VPN service and sends the data to that IP via the route for the VPN service's IPs.

The ISP effectively sees the subscriber's IP connecting to the VPN service's IPs rather than connecting directly to the dodgybox service/streaming service's IPs. To reuse the road analogy, the data from the dodgybox service/streaming service now takes the road to Cork first and is then redirected to Dublin by the VPN service. It is a very simplified explanation but the concept of the routes that the data takes and how it relates to IP addresses may have been what was causing some of the confusion.

With geo-fencing, a streaming service might only accept connections from IP addresses that are associated with a particular country. It is possible for an IP range owner to reflag an IP address or range of IP addresses. It typically requires the streaming service to either maintain its own IP-country database or use a geolocation service.

“But it doesn't matter what IP the dodgy box service sees. “

That depends on whether the “dodgy box service” is geoblocked.

“The task is to fool the ISP into thinking you are not connecting to the dodgy box service.” 

That could be the task. The task could also be to stop the ISP identifying the type of traffic. For example, some ISP’s restrict streaming, or streaming from certain areas…

Note that we are talking about the end user’s ISP, the ‘Dodgy Box Service’ will have their own ISP.

“I can't square the circle that you can use a VPN to do two different things, convince a destination that you are coming from somewhere you are not and convince your ISP that you are going to somewhere you are not.”

The end user (e.g. a ‘Dodgy Box with VPN Client SW‘), at Location A, creates an ‘Encrypted Tunnel’ over the Internet to a VPN Server belonging to the VPN Service Provider. Typically this is their nearest location (say Location B) where the VPN Service Provider has equipment (or a ‘network node’). 

The end user’s ISP only knows that the end user is connecting to the IP Address associated with Location B. Because of the encryption it has no idea what type of data is involved, or the ultimate destination. 

If the service the end user is accessing is available from Location B (which could be in Ireland) then the end user can connect directly to that service from their nearest VPN Provider's node - job done!

Let’s say the end user wants to connect to a service (e.g. BBC iPlayer) that is geoblocked and not available in Location B. The VPN Service Provider could route the traffic internally to a location (Location C, say London) where the service is offered. The VPN Service Provider then forwards the information to the desired service, over the public Internet. In this case the BBC iPlayer thinks the requests are coming from the IP Address associated with Location C.

All this is simplified, but gives the general principles…

Hmm, that's a good shout. I used have DNS settings set to google or 1.1.1.1 with previous ISP, but can't remember if I did that with the new sky router I got. Will check and test and report back tomorrow.

Your ISP can (probably are) hijack DNS. Even if you set your OS or router DNS to 8.8.8.8 or 1.1.1.1 the ISP can intercept it and send back to you a different response, faked to look like it's coming from 8.8.8.8 or 1.1.1.1. You can check by setting your DNS to 8.8.8.8 or 1.1.1.1 and visiting https://whoismydns.com/ (if the result isn't Google or Cloudflare you're being hijacked), or by using quad9 (9.9.9.9) and visiting this page https://on.quad9.net/.

The only sure way to prevent this is using DoT, DoH, or DoQ, as they encrypt the DNS query.

Just checked with a friend and both of his are still up and running.

There was damage at a data centre in Europe which has effected so many friends IPTV. A good provider has a back up server, so my friends are still active. Will be a few weeks to rebuild and re-upload all the on demand content.

My friend in Cork has partial service restored

Mine is down, but using the backup so not really affected. Watched a bit of Norsemen. Will be back fully in a few days.

100euro for the year still worth it lol

Someone from SKY arson around???😳

Needed one for my brother so picked it up in HN for €80 a few weeks ago. He's been happy with it since.