[{"_1":2,"_152":-5,"_153":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_131":132},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_83":-5,"_84":85,"_124":-5,"_125":11,"_126":17,"_127":11,"_128":-5,"_129":130},"canonicalUrl","https://hub.docker.com/r/intersoftlab/iptables-auth/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","intersoftlab","reponame","iptables-auth","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":31,"_44":11,"_45":46,"_47":48,"_49":50,"_52":31,"_28":29,"_53":54,"_55":40,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":29,"_68":69,"_74":17,"_75":76,"_80":29,"_81":82},"categories",[],"content_types",[40],"image","date_registered","2016-07-09T05:16:26.527822Z","description","is_private","last_updated","2017-08-04T07:47:39.327079Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[51],"application/vnd.docker.container.image.v1+json","name","pull_count",428,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# netflix-proxy [![Build Status](https://travis-ci.org/ab77/netflix-proxy.svg?branch=master)](https://travis-ci.org/ab77/netflix-proxy) [![](https://www.paypalobjects.com/en_GB/i/btn/btn_donate_SM.gif)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=5UUCDR8YXWERQ)\n`Docker` packaged smart DNS proxy to watch `Netflix`, `Hulu`[n2], `HBO Now` and others out of region using `BIND` and `sniproxy`[n1]. Works for blocked sites too, such as [PornHub](http://www.pornhub.com/).\n\nThis solution will only work with devices supporting Server Name Indication (SNI)[n7]. To test, open a web browser on the device you are planning to watch content and go to [this](https://sni.velox.ch/) site (`https://sni.velox.ch/`).\n\n**Update March/2016**: IPv6 addresses of common hosting providers are now blocked in the same way as IPv4. Netflix could to be \"tagging\" accounts too, so if your account is tagged, the only device that will work out of region is the desktop web browser (i.e. Chrome)[n11]. Netflix and BBC iPlayer are also perfoming geo checks on their media hosts, so the relevant media domains are now proxied by default[n8]. Please note, that proxying media delivery could increase the bandwidth bill you get from your VPS provider. However, since most VPS providers offer 1TB per month inclusive with each server and most home ISPs don't offer anywhere near that amount, it should be a moot point in most situations.\n\nIf you feel all of this is too complicated, I don't blame you. If you want change, vote with your wallet by cancelling your Netflix subscription and/or sign the petition:\n\n[![](https://raw.githubusercontent.com/ab77/netflix-proxy/master/static/petition.png)](https://act.openmedia.org/netflix)\n\nPlease see the [**Wiki**](https://github.com/ab77/netflix-proxy/wiki) page(s) for some common troubleshooting ideas.\n\n**Unblocked Netflix?** Great success! [Vote](http://www.poll-maker.com/poll622505x596e406D-26) now and see the [results](http://www.poll-maker.com/results622505xfcC7F6aA-26).\n\n[![](https://raw.githubusercontent.com/ab77/netflix-proxy/master/static/poll_results.png)](http://www.poll-maker.com/results622505xfcC7F6aA-26)\n\n# Supported Services\nThe following are supported out of the box, however adding additional services is trivial and is done by updating `zones.override` file and running `docker restart bind`:\n* Netflix\n* Hulu[n2]\n* HBO Now \n* Amazon Instant Video\n* Crackle\n* Pandora\n* Vudu\n* blinkbox\n* BBC iPlayer[n5]\n* NBC Sports and potentially many [more](https://github.com/ab77/netflix-proxy/blob/data/conf/zones.override)\n\n# Instructions\nThe following paragraphs show how to get this solution up and running with a few different Cloud providers I've tried so far.\n\n[![](https://raw.githubusercontent.com/ab77/netflix-proxy/master/static/digitalocean.png)](https://m.do.co/c/937b01397c94)\n\nThe following is based on a standard Ubuntu Docker image provided by `DigitalOcean`, but should in theory work on any Linux distribution **with** Docker pre-installed. Do **not** enable native IPv6 on the host.\n\n1. Head over to [Digital Ocean](https://m.do.co/c/937b01397c94) to get **$10 USD credit**\n2. Create a Droplet in a location closest to you using `Docker 1.x` on `Ubuntu 14.04` (find in under `One-click Apps` tab).\n3. Create a free [tunnel broker](https://tunnelbroker.net/register.php) account.\n4. Create a [regular tunnel](https://tunnelbroker.net/new_tunnel.php).\n5. Set the `IPv4 Endpoint` to the Droplet IP, pick a tunnel server in a location closest to you and click `Create Tunnel`.\n6. SSH to your server and run `ping6 netflix.com`; if you get `Network is unreachable` proceed to the next step, otherwise remove native IPv6 first.\n7. Run: `git clone https://github.com/ab77/netflix-proxy /opt/netflix-proxy && cd /opt/netflix-proxy && ./build.sh -u -p `, making sure to specify your HE tunnel username and password correctly.\n8. Make sure to **record the credentials** for the `netflix-proxy` admin site.\n9. Set your DNS server to the IP given at the end of the script, then go to [this](http://ipinfo.io/) site to make sure the same IP is displayed.\n10. Finally, enjoy `Netflix` and others out of region.\n11. Enjoy or raise a new [issue](https://github.com/ab77/netflix-proxy/issues/new) if something doesn't work quite right (also `#netflix-proxy` on [freenode](https://webchat.freenode.net/?channels=netflix-proxy)).\n\n### Authorising Additional IPs\nIf you want to share your system with friends and family, you can authorise their home IP address(s) using the `netflix-proxy` admin site, located at `http://:8080/`, where `ipaddr` is the public IP address of your VPS. Login using `admin` account with the password you recorded during the build, in step 6.\n\n[![](https://raw.githubusercontent.com/ab77/netflix-proxy/master/static/admin.png)](https://raw.githubusercontent.com/ab77/netflix-proxy/master/static/admin.png)\n\n#### Dynamic IPs\nYou can also use the `netflix-proxy` admin site to update your IP address, should your ISP assign you a new one (e.g. via DHCP). If your IP address does change, all HTTP/HTTPS requests will automatically be redirected to the admin site on port `8080`. All DNS requests will be redirected to `dnsmasq` instance running on port `5353`. You will most likely need to purge your browser and system DNS caches after this (e.g. `ipconfig /flushdns` and `chrome://net-internals/#dns`) and/or reboot the relevant devices. This mechanism should work on browsers, but will most likely cause errors on other devices, such as Apple TVs and smart TVs. If you Internet stops working all of a sudden, try loading a browser and going to `netflix.com`.\n\n#### Automatic IP Authorization\n**WARNING**: do not do enable this unless you know what you are doing.\n\nTo enable automatic authorization of every IP that hits your proxy, set `AUTO_AUTH = True` in `auth/settings.py` and run `service netflix-proxy-admin restart`. This setting will effectively authorize any IP hitting your proxy IP with a web browser for the first time, including bots, hackers, spammers, etc. Upon successful authorization, the browser will be redirected to [Google](http://google.com/).\n\nThe DNS service is configured with recursion turned on by [default](https://github.com/ab77/netflix-proxy#security), so after a successful authorization, anyone can use your VPS in DNS amplification attacks, which will probably put you in breach of contract with the VPS provider. You have been **WARNED**.\n\n### Security\nThe build script automatically configures the system with **DNS recursion turned on**. This has security implications, since it potentially opens your DNS server to a DNS amplification attack, a kind of a [DDoS attack](https://en.wikipedia.org/wiki/Denial-of-service_attack). This should not be a concern however, as long as the `iptables` firewall rules configured automatically by the build script for you remain in place. However if you ever decide to turn the firewall off, please be aware of this.\n\nIf you want to turn DNS recursion off, please be aware that you will need a mechanism to selectively send DNS requests for domains your DNS server knows about (i.e. netflix.com) to your VPS and send all of the other DNS traffic to your local ISP's DNS server. Something like [Dnsmasq](http://www.thekelleys.org.uk/dnsmasq/doc.html) can be used for this and some Internet routers even have it built in. In order to switch DNS recursion off, you will need to build your system using the following command:\n\n```\ngit clone https://github.com/ab77/netflix-proxy /opt/netflix-proxy && cd /opt/netflix-proxy && ./build.sh -r 0 -b 1\n```\n\n### Command Line Options\nThe following command line options can be optionaly passed to `build.sh` for additional control:\n\n```\nUsage: ./build.sh [-r 0|1] [-b 0|1] [-c ] [-i 0|1] [-d 0|1] [-t 0|1] [-z 0|1] [-u ] [-p ] [-n <1..N>] [-s ]\n -r enable (1) or disable (0) DNS recursion (default: 1)\n -b grab docker images from repository (0) or build locally (1) (default: 0)\n -c specify client-ip instead of being taken from ssh_connection\n -i skip iptables steps\n -d skip Docker steps\n -t skip testing steps\n -s specify IPv6 subnet for Docker (e.g. 2001:470:abcd:123::/64)\n -z enable caching resolver (default: 0)\n -u HE tunnel broker username\n -p HE tunnel broker password\n -n HE tunnel index (default: 1)\n```\n\n## Other Cloud Providers\n\n### Locale Issues\n\nSome pre-requisites require the locale to be set correctly and some provider OS images need extra help. If you get `locale` issues reported by `Python` and/or `pip` durin the build, try running the following first:\n\n```\nexport LANGUAGE=en_US.UTF-8 && \\\n export LANG=en_US.UTF-8 && \\\n export LC_ALL=en_US.UTF-8 && \\\n locale-gen en_US.UTF-8 && \\\n sudo dpkg-reconfigure locales\n```\n\n[![](https://raw.githubusercontent.com/ab77/netflix-proxy/master/static/vultr.png)](http://www.vultr.com/?ref=6871746)\n\nThe following is based on a Debian image provided by `Vultr`, but should in theory work on any Debian distribution. Do **not** enable native IPv6 on the host.\n\n1. Head over to [Vultr](http://www.vultr.com/?ref=6871746) to create an account.\n2. Create a compute instance in a location closest to you using `Debian 8 x64 (jessie)` image.\n3. Create a free [tunnel broker](https://tunnelbroker.net/register.php) account.\n4. Create a [regular tunnel](https://tunnelbroker.net/new_tunnel.php).\n5. Set the `IPv4 Endpoint` to the IP address of your Vultr instance, pick a tunnel server closest to you and click `Create Tunnel`.\n6. SSH to your server and run `ping6 netflix.com`; if you get `Network is unreachable` proceed to the next step, otherwise remove native IPv6 first.\n7. Run: `apt-get update && apt-get -y install vim dnsutils curl sudo git && curl -sSL https://get.docker.com/ | sh && git clone https://github.com/ab77/netflix-proxy /opt/netflix-proxy && cd /opt/netflix-proxy && ./build.sh -u -p `, making sure to specify your HE tunnel username and password correctly.\n8. Make sure to **record the credentials** for the `netflix-proxy` admin site.\n9. Set your DNS server to the IP given at the end of the script, then go to [this](http://ipinfo.io/) site to make sure the same IP is displayed.\n10. Finally, enjoy `Netflix` and others out of region.\n11. Enjoy or raise a new [issue](https://github.com/ab77/netflix-proxy/issues/new) if something doesn't work quite right (also `#netflix-proxy` on [freenode](https://webchat.freenode.net/?channels=netflix-proxy)).\n\n[![](http://www.ramnode.com/images/banners/affbannerdarknewlogo.png)](https://clientarea.ramnode.com/aff.php?aff=3079)\n\nThe following is based on a Debian or Ubuntu OS images provided by `RamNode`. Do **not** enable native IPv6 on the host.\n\n1. Head over to [RamNode](https://clientarea.ramnode.com/aff.php?aff=3079) to create an account and buy a **KVM** VPS in a location closest to you (OpenVZ won't work).\n2. Log into the `VPS Control Panel` and (re)install the OS using `Ubuntu 14.04 x86_64 Server Minimal` or `Debian 8.0 x86_64 Minimal` image.\n3. Create a free [tunnel broker](https://tunnelbroker.net/register.php) account.\n4. Create a [regular tunnel](https://tunnelbroker.net/new_tunnel.php).\n5. Set the `IPv4 Endpoint` to the IP address of your RamNode VPS, pick a tunnel server closest to you and click `Create Tunnel`.\n6. SSH to your server and run `ping6 netflix.com`; if you get `Network is unreachable` proceed to the next step, otherwise remove native IPv6 first.\n7. Run: `apt-get update && apt-get -y install vim dnsutils curl sudo git && curl -sSL https://get.docker.com/ | sh && git clone https://github.com/ab77/netflix-proxy /opt/netflix-proxy && cd /opt/netflix-proxy && ./build.sh -u -p `, making sure to specify your HE tunnel username and password correctly.\n8. Make sure to **record the credentials** for the `netflix-proxy` admin site.\n9. Set your DNS server to the IP given at the end of the script, then go to [this](http://ipinfo.io/) site to make sure the same IP is displayed.\n10. Finally, enjoy `Netflix` and others out of region.\n11. Enjoy or raise a new [issue](https://github.com/ab77/netflix-proxy/issues/new) if something doesn't work quite right (also `#netflix-proxy` on [freenode](https://webchat.freenode.net/?channels=netflix-proxy)).\n\n[![](https://www.linode.com/media/images/logos/standard/light/linode-logo_standard_light_small.png)](https://www.linode.com/?r=ceb35af7bad520f1e2f4232b3b4d49136dcfe9d9)\n\n**(untested)** The following is based on a standard Ubuntu image provided by `Linode`, but should work on any Linux distribution **without** Docker installed. Do **not** enable native IPv6 on the host or disable it post-build and before moving onto step 7.\n\n1. Head over to [Linode](https://www.linode.com/?r=ceb35af7bad520f1e2f4232b3b4d49136dcfe9d9) and sign-up for an account.\n2. Create a new `Linode` in a location closest to you and deploy an `Ubuntu 14-04 LTS` image into it.\n3. Create a free [tunnel broker](https://tunnelbroker.net/register.php) account.\n4. Create a [regular tunnel](https://tunnelbroker.net/new_tunnel.php).\n5. Set the `IPv4 Endpoint` to the IP address of your Linode, pick a tunnel server closest to you and click `Create Tunnel`.\n6. SSH to your server and run `ping6 netflix.com`; if you get `Network is unreachable` proceed to the next step, otherwise remove native IPv6 first.\n7. Run: `curl -sSL https://get.docker.com/ | sh && git clone https://github.com/ab77/netflix-proxy /opt/netflix-proxy && cd /opt/netflix-proxy && ./build.sh -u -p `, making sure to specify your HE tunnel username and password correctly.\n8. Make sure to **record the credentials** for the `netflix-proxy` admin site.\n9. Set your DNS server to the IP given at the end of the script, then go to [this](http://ipinfo.io/) site to make sure the same IP is displayed.\n10. Finally, enjoy `Netflix` and others out of region.\n11. Enjoy or raise a new [issue](https://github.com/ab77/netflix-proxy/issues/new) if something doesn't work quite right (also `#netflix-proxy` on [freenode](https://webchat.freenode.net/?channels=netflix-proxy)).\n\n[![](https://raw.githubusercontent.com/ab77/netflix-proxy/master/static/dreamhost.png)](http://www.dreamhost.com/r.cgi?2124700)\n\n**(untested)** The following is based on a standard Ubuntu image provided by `DreamHost`, but should work on any Linux distribution **without** Docker installed and running under **non-root** user (e.g. `Amazon Web Services`). Do **not** enable native IPv6 on the host.\n\n1. Head over to [DreamHost](http://www.dreamhost.com/r.cgi?2124700) and sign-up for an account.\n2. Find the `DreamCompute` or `Public Cloud Computing` section and launch an `Ubuntu 14-04-Trusty` instance in a location closest to you.\n3. Make sure to add an additional firewall rule to allow DNS: `Ingress\tIPv4\tUDP\t53\t0.0.0.0/0 (CIDR)`\n4. Also add a `Floating IP` to your instance.\n5. Create a free [tunnel broker](https://tunnelbroker.net/register.php) account.\n6. Create a [regular tunnel](https://tunnelbroker.net/new_tunnel.php).\n7. Set the `IPv4 Endpoint` to the IP address of your instance, pick a tunnel server closest to you and click `Create Tunnel`.\n8. SSH to your server and run `ping6 netflix.com`; if you get `Network is unreachable` proceed to the next step, otherwise remove native IPv6 first.\n9. Run: `curl -sSL https://get.docker.com/ | sh && sudo usermod -aG docker $(whoami | awk '{print $1}') && sudo git clone https://github.com/ab77/netflix-proxy /opt/netflix-proxy && cd /opt/netflix-proxy && ./build.sh -u -p `, making sure to specify your HE tunnel username and password correctly.\n10. Make sure to **record the credentials** for the `netflix-proxy` admin site.\n11. Set your DNS server to the IP given at the end of the script, then go to [this](http://ipinfo.io/) site to make sure the same IP is displayed.\n12. Finally, enjoy `Netflix` and others out of region.\n13. Enjoy or raise a new [issue](https://github.com/ab77/netflix-proxy/issues/new) if something doesn't work quite right (also `#netflix-proxy` on [freenode](https://webchat.freenode.net/?channels=netflix-proxy)).\n\n[![](https://raw.githubusercontent.com/ab77/netflix-proxy/master/static/gandi.png)](https://www.gandi.net/hosting/iaas/buy)\n\nThe following is based on (slightly broken) Ubuntu image provided by `Gandi` using` root` login with SSH key only (no password). For default non-root `admin` login, adjust step 8 to use `sudo` where nesessary. Disable native IPv6 on the host as Gandi enable it by default.\n\n1. Head over to [Gandi](https://www.gandi.net/hosting/iaas/buy) to create a virtual server.\n2. Create a free [tunnel broker](https://tunnelbroker.net/register.php) account.\n3. Create a [regular tunnel](https://tunnelbroker.net/new_tunnel.php).\n4. Set the `IPv4 Endpoint` to the IP address of your server, pick a tunnel server in the US and click `Create Tunnel`.\n5. SSH to your server and run `ping6 netflix.com`; if you get `Network is unreachable` proceed to the next step, otherwise remove native IPv6 first.\n6. Run: `apt-get -y update && apt-get -y install vim dnsutils curl sudo git && export LANGUAGE=en_US.UTF-8 && export LANG=en_US.UTF-8 && export LC_ALL=en_US.UTF-8 && locale-gen en_US.UTF-8 && sudo apt-get -y install language-pack-id && sudo dpkg-reconfigure locales && curl -sSL https://get.docker.com/ | sh && git clone https://github.com/ab77/netflix-proxy /opt/netflix-proxy && cd /opt/netflix-proxy && ./build.sh -u -p `, making sure to specify your HE tunnel username and password correctly.\n7. Make sure to **record the credentials** for the `netflix-proxy` admin site.\n8. Set your DNS server to the IP given at the end of the script, then go to [this](http://ipinfo.io/) site to make sure the same IP is displayed.\n9. Finally, enjoy `Netflix` and others out of region.\n10. Enjoy or raise a new [issue](https://github.com/ab77/netflix-proxy/issues/new) if something doesn't work quite right (also `#netflix-proxy` on [freenode](https://webchat.freenode.net/?channels=netflix-proxy)).\n\n### Microsoft Azure (advanced)\nThe following **has not been tested** and is based on a standard `Ubuntu` image provided by `Microsoft Azure` using `cloud-harness` automation tool I wrote a while back and assumes an empty `Microsoft Azure` subscription.\n\n1. Head over to [Microsoft Azure](https://azure.microsoft.com/en-gb/) and sign-up for an account.\n2. Get [Python](https://www.python.org/downloads/).\n3. On your workstation, run `git clone https://github.com/ab77/cloud-harness.git /opt/cloud-harness`.\n4. Follow `cloud-harness` [Installation and Configuration](https://github.com/ab77/cloud-harness#installation-and-configuration) section to set it up.\n5. [Create](https://github.com/ab77/cloud-harness#create-storage-account-name-must-be-unique-as-it-forms-part-of-the-storage-url-check-with---action-check_storage_account_name_availability) a storage account.\n6. [Create](https://github.com/ab77/cloud-harness#create-a-new-hosted-service-name-must-be-unique-within-cloudappnet-domain-check-with---action-check_storage_account_name_availability) a new hosted service.\n7. [Add](https://github.com/ab77/cloud-harness#add-x509-certificate-containing-rsa-public-key-for-ssh-authentication-to-the-hosted-service) a hosted service certificate for SSH public key authentication\n8. [Create](https://github.com/ab77/cloud-harness#create-a-reserved-ip-address-for-the-hosted-service) a reserved ip address.\n9. [Create](https://github.com/ab77/cloud-harness#create-virtual-network) a virtual network.\n10. [Create](https://github.com/ab77/cloud-harness#create-a-new-linux-virtual-machine-deployment-and-role-with-reserved-ip-ssh-authentication-and-customscript-resource-extensionn3) a `Ubuntu 14.04 LTS` virtual machine as follows:\n\n```\n ./cloud-harness.py azure --action create_virtual_machine_deployment \\\n --service \\\n --deployment \\\n --name \\\n --label 'Netflix proxy' \\\n --account \\\n --blob b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu-14_04-LTS-amd64-server-20140414-en-us-30GB \\\n --os Linux \\\n --network VNet1 \\\n --subnet Subnet-1 \\\n --ipaddr \\\n --size Medium \\\n --ssh_auth \\\n --disable_pwd_auth \\\n --verbose\n```\n\n11. Use the [Azure Management Portal](https://manage.windowsazure.com/) to add `DNS (UDP)`, `HTTP (TCP)` and `HTTPS (TCP)` endpoints and secure them to your home/work/whatever IPs using the Azure `ACL` feature.\n12. SSH to your VM as `azureuser` using custom public TCP port (not `22`) and use any non-root user Ubuntu instructions to build/install `netflix-proxy`.\n\n### Automated Tests\nI've linked this project with `Travis CI` to automatically test the build. The helper Python script `__testbuild.py` now runs automatically after every commit. This script deploys a test `Droplet` and then runs a serious of tests to verify (a) that both `Docker` containers start; and (b) the `built.sh` script outputs the correct message at the end. The test `Droplet` is destroyed and the end of the run.\n\nThe `__testbuild.py` script can also be used to programatically deploy `Droplets` from the command line as follows:\n\n\tpython ./__testbuild.py digitalocean --api_token abcdef0123456789... --fingerprint 'aa:bb:cc:dd:...' --region 'abc1'\n\t\n* `--api_token abcdef0123456789...` is your `DigitalOCean` API v2 token, which you can generate [here](https://cloud.digitalocean.com/settings/applications).\n* `--fingerprint aa:bb:cc:dd:...` are your personal SSH key fingerprint(s) quoted and separated by spaces. You can manage your SSH keys [here](https://cloud.digitalocean.com/settings/security). If you don't specify a fingerprint, it will default to my test one, which means you **won't** be able to SSH into your `Droplet`.\n* `--region abc1` is the region where you want the `Droplet` deployed. The default is `nyc3`, but you can use `--list_regions` to see the available choices.\n* `--help` parameter will also list all of the available command line options to pass to the script.\n\nNote, you will need a working `Python 2.7` environment and the modules listed in `requirements.txt` (run `pip install -r requirements.txt`).\n\n### IPv6 and Docker\nThis solution uses IPv6 downstream from the proxy to unblock IPv6 enabled providers, such as Netflix. No IPv6 support on the client is required for this to work, only the VPS must public IPv6 connectivity. You may also need to turn off IPv6 on your local network (and/or relevant devices).[n6] Having said that, the current iteration uses `HE Eectric's` free tunnel broker service to provide IPv6 connectivity, since `HE Electric` is geo-located in the US, Netflix geoblocking (or `geo-bollocking`, if you like), allows the traffic through.\n\n```\n+----------+ +-----------+ +-----------------+\n| | | | | |\n| client | +--------------> | proxy | +-------------> | Netflix, etc. |\n| | (ipv4) | | (ipv6) | |\n+----------+ +-----------+ +-----------------+\n```\n\nWhen IPv6 public address is present on the host, Docker is configured with public IPv6 support. This is done by assuming the smallest possible IPv6 allocation, dividing it further by two and assigning the second half to the Docker system. Network Discovery Protocol (NDP) proxying is required for this to work, since the second subnet can not be routed[n9]. Afterwards, Docker is running in dual-stack mode, with each container having a public IPv6 address. This approach seems to work in most cases where native IPv6 is used. If IPv6 is provided via a tunnel, Docker subnet can not be reliably calculated and must be specified using `-s` parameter to the `build.sh` script. If IPv6 is not enabled at all, the VPS is built with IPv4 support only.\n\n#### RamNode\nRamNode (and any other provider which uses SolusVM as its VPS provisioning system[n10]) assign a `/64` subnet to the VPS, but don't route it. Instead, individual addresses must be added in the portal if they are to be used on the host. After speaking with RamNode support, it appears this is a side-effect of MAC address filtering, which prevents IP address theft. This means that even though the subnet can be further divided on the host, only the main IPv6 address bound to `eth0` is ever accessible from the outside and none of the IPv6 addresses on the bridges below can communicate over IPv6 to the outside.\n\nTo demonstrate this behavour, follow these steps:\n```\nIPV6_SUBNET=

intersoftlab/iptables-auth

Tags for intersoftlab/iptables-auth