Access to Vudu blocked because of a Verizon proxy says Vudu
johnatbmd
Enthusiast - Level 3

I've spent a lot of time with Vudu tech support about this and I now agree that there is something fishy about the FiOS connection to Vudu.

(as backgroound I'm a network engineer by trade so know my way around tcp/ip connections)

Suddenly a couple months ago my LG blu-ray player stopped being able to connect to Vudu. Computer wsa OK but not the LG. After much back and forth with their tech support they concluded (bold added by me):

<<<<

Hello John,
I first want to apologize for the connection issue you are experiencing, and trouble you've gone through trying to get the issue resolved thus far. Recently our engineering department updated our systems framework, and as a result of this update, access to our service via proxy servers will no longer be available. We verified that you are using a Proxy server from information located on your account. This includes but not limited to hosting companies and anonymous proxies. Please contact your ISP to get this removed or disabled to continue using VUDU.
>>>>
 
This did seem ludicrous to me and all proxy detectors found nothing. But here's the thing: For fun I connected my LG wirelessly through my neighbor's Comcast service. Immediatly the LG connected and played content. 
 
I've since found at least one Samsung blu-ray owner who is having the same problem.
 
I tried desabling the IGMP proxy in the Actiontex router - no change
I tried connecting the LG directly and solo to the router using wire - no change
I tried all sorts of rebooting everything in the path - no change
 
Part of Vudu's diagnosis involved me sending them traceroute results. I'm saying this was a pretty thorough support session. Not teir 1.
 
Verizon? Care to comment? 
 
 
Re: Access to Vudu blocked because of a Verizon proxy says Vudu
smith6612
Community Leader
Community Leader

Lately Verizon has been pushing DSL folks to opt-out of a Carrier Grade NAT setup, which in essence can act as a "proxy" of sorts in a sense that many (hundreds) users come from a common IP address. This shouldn't apply to FiOS, but it may be something to consider if Verizon has recently started to take advantage of CGNAT.

Away from that, would it be possible to share the traceroute results? I've never seen proxy-like behavior even on my DSL connection, which has been opted out of Carrier Grade NAT since I use applications that will break behind CGNAT. When sharing the traces, please filter out anything sensitive so the moderators don't have to do it for you. Alternatively, you can send me an unedited trace via PM so it isn't floating around on the public forums.

Also, I'm sure you've checked all of this already, but please be sure to verify the Blu-Ray player or other devices on your network are not going through a proxy, or are set up behind a VPN or IPv6 tunnel.

Re: Access to Vudu blocked because of a Verizon proxy says Vudu
johnatbmd
Enthusiast - Level 3

Sure! Posted at bottom.

Definately no VPN, tunnel or proxy on my site.

I wonder if the http header the LG sends out  identifies it as an appliance versus a PC and Verizon senses that and sends it to a video caching farm. 

[balderdash:~] john% traceroute llgvault.vudu.com
traceroute to vudu.re.llnwd.net (69.28.143.32), 64 hops max, 52 byte packets
1 192.168.1.1 (192.168.1.1) 0.668 ms 0.391 ms 0.371 ms
l100.washdc-vfttp-115.verizon-gni.net (71.178.197.1) 12.586 ms 6.955 ms 7.454 ms
g0-8-3-2.washdc-lcr-22.verizon-gni.net (130.81.49.130) 7.842 ms 7.442 ms 24.731 ms
ae0-0.res-bb-rtr1.verizon-gni.net (130.81.209.114) 19.851 ms 42.489 ms 7.380 ms
5 0.xe-8-3-0.xl2.iad8.alter.net (152.63.5.169) 7.523 ms 7.290 ms 7.627 ms
6 0.xe-11-3-1.gw9.iad8.alter.net (152.63.42.10) 7.360 ms
0.xe-11-0-1.gw9.iad8.alter.net (152.63.33.169) 6.378 ms
0.xe-11-1-1.gw9.iad8.alter.net (152.63.35.121) 11.516 ms
llnw-gw.customer.alter.net (152.179.50.142) 9.521 ms 17.072 ms 17.279 ms
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * *^C
[balderdash:~] john% traceroute llpvault.vudu.com
traceroute: Warning: llpvault.vudu.com has multiple addresses; using 69.28.143.61
traceroute to vudu-p.vo.llnwd.net (69.28.143.61), 64 hops max, 52 byte packets
1 192.168.1.1 (192.168.1.1) 0.686 ms 0.380 ms 0.380 ms
l100.washdc-vfttp-115.verizon-gni.net (71.178.197.1) 14.362 ms 7.338 ms 7.878 ms
g0-8-2-0.washdc-lcr-21.verizon-gni.net (130.81.191.48) 27.400 ms 9.419 ms 10.287 ms
so-7-1-0-0.res-bb-rtr1.verizon-gni.net (130.81.199.30) 7.802 ms 9.530 ms 10.226 ms
5 0.xe-5-0-1.xl1.iad8.alter.net (152.63.7.33) 9.823 ms 10.146 ms 9.510 ms
6 0.xe-10-0-0.gw9.iad8.alter.net (152.63.33.157) 10.567 ms
0.xe-8-2-0.gw9.iad8.alter.net (152.63.35.250) 9.261 ms
0.xe-10-3-0.gw9.iad8.alter.net (152.63.41.246) 10.040 ms
llnw-gw.customer.alter.net (152.179.50.142) 12.165 ms 15.381 ms 9.621 ms
8 ve5.fr4.iad.llnw.net (69.28.171.214) 9.780 ms 17.248 ms 9.636 ms
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 *^C
[balderdash:~] john% traceroute lldvault.vudu.com
traceroute: Warning: lldvault.vudu.com has multiple addresses; using 69.28.143.60
traceroute to vudu-rd.vo.llnwd.net (69.28.143.60), 64 hops max, 52 byte packets
1 192.168.1.1 (192.168.1.1) 0.689 ms 0.414 ms 0.443 ms
l100.washdc-vfttp-115.verizon-gni.net (71.178.197.1) 7.813 ms 9.521 ms 8.112 ms
g0-8-3-2.washdc-lcr-22.verizon-gni.net (130.81.49.130) 26.827 ms 14.956 ms 7.644 ms
ae2-0.res-bb-rtr1.verizon-gni.net (130.81.199.138) 15.013 ms 89.626 ms 70.240 ms
5 0.xe-4-1-1.xl4.iad8.alter.net (152.63.7.237) 25.147 ms 17.592 ms 76.773 ms
6 tengige0-5-2-0.gw1.iad8.alter.net (152.63.39.2) 17.751 ms 9.992 ms
tengige0-5-1-0.gw1.iad8.alter.net (152.63.38.250) 12.499 ms
limelightnetworks.customer.alter.net (152.179.50.10) 10.659 ms 7.620 ms 9.948 ms
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 *^C

0 Likes
Re: Access to Vudu blocked because of a Verizon proxy says Vudu
Anti-Phish1
Master - Level 1
0 Likes
Re: Access to Vudu blocked because of a Verizon proxy says Vudu
johnatbmd
Enthusiast - Level 3

thanks. One more thing. Vudu asked me to chenge from default dns IP to Google at 8.8.8.8 hooping that maybe Verizon is pointing to wrong Vudu server or redirecting to a cache farm.

did not help anything, though.

0 Likes
Re: Access to Vudu blocked because of a Verizon proxy says Vudu
smith6612
Community Leader
Community Leader

Interesting.

So the traces are proving you're at least making it to the border router between Verizon and Limelight Networks, but you're also getting at least one hop beyond a Verizon controlled router. The traffic is staying within the US, so that's a plus. In addition, it's dumping off of Verizon rather close to you in a grand scheme of things. Afterwards the traces time out, so is it a question of the endpoint not accepting UDP Echo (default for *nix systems), or is it a question of a range being filtered outward.

I would try running Wireshark against the LG player or at minimum, see if you can get a dump of the NAT Table for your router which should show the destination, since if Verizon was manipulating the route on the fly by simply sending data to another place (rather than redirect via HTTP/DNS) you'd likely not be able to communicate at all with Vudu. If you have equipment capable of doing a man-in-the-middle capture, such as a switch with port mirroring, a hub, or a Wi-Fi adapter capable of capturing traffic, I'm curious if the Blu-Ray player is getting a particular response back from Vudu or if it's a case of just not getting a route. Assuming the traffic is not encrypted I suspect it should be easy to get.

I'm honestly not sure what Vudu is trying to accomplish blocking proxies and VPNs, though. I feel like they're shafting more than just the foreigners. VPNs and Proxies come in so many forms it's nearly impossible to filter them out without breaking things for others.

I would also consider checking the WHOIS record history for your Public IP address from Verizon. I know in recent months folks have been having on and off issues with getting to services due to Verizon assigning out freshly allocated IP addresses. Some of them came from other providers, for example that were not within the US. It's also noteworthy to point out that many folks run Tor exit nodes on FiOS. I don't know if they run them off of Dynamic IP accounts, but since you can switch between Exit nodes, that's something to consider.

0 Likes
Re: Access to Vudu blocked because of a Verizon proxy says Vudu
johnatbmd
Enthusiast - Level 3

All fairness to Vudu I suspect they have no interest in blocking anyone who has a good credit card. I'm sure it's the content providers demanding US only. Netflix doesn't work outside US either IIRC.

0 Likes
Re: Access to Vudu blocked because of a Verizon proxy says Vudu
johnatbmd
Enthusiast - Level 3

Well that was fun.

I set up wifi internet sharing on my mac and routed the LG through it and ran Wireshark against the interface.

First thing the LG does is send a dns query for startup.vvond.net. It gets back 208.79.221.221 which is an IP at peakwebhosting. Vvond is the original name of Vudu I read and peakwebhosting appears to be associated with Vudu as well.

From then on all traffic is https between the LG and 208.79.221.221. 

 

The traceroute bewteen my home and that IP is

 

1 192.168.1.1 (192.168.1.1) 1.136 ms 0.444 ms 0.417 ms
2 l100.washdc-vfttp-115.verizon-gni.net (71.178.197.1) 8.720 ms 7.362 ms 7.524 ms
3 p9-2.bstnma-lcr-03.verizon-gni.net (130.81.49.128) 7.524 ms 12.210 ms 11.945 ms
4 so-12-1-0-0.res-bb-rtr1.verizon-gni.net (130.81.151.230) 7.853 ms 10.063 ms 7.285 ms
5 0.xe-7-0-0.br1.iad8.alter.net (152.63.37.41) 7.712 ms 7.135 ms 7.367 ms
6 xe-2-1-0.er2.iad10.us.above.net (64.125.13.173) 7.635 ms 7.087 ms 7.610 ms
7 xe-4-1-0.cr2.dca2.us.above.net (64.125.29.214) 10.269 ms 9.292 ms 9.403 ms
8 xe-1-0-0.cr1.dca2.us.above.net (64.125.28.249) 10.515 ms
xe-0-2-0.cr2.iah1.us.above.net (64.125.28.50) 64.714 ms 55.179 ms
9 xe-0-2-0.cr1.iah1.us.above.net (64.125.25.114) 44.689 ms 44.210 ms 45.047 ms
10 xe-1-3-0.cr1.lax112.us.above.net (64.125.26.122) 97.889 ms 78.284 ms 77.534 ms
11 xe-4-1-0.cr1.sjc2.us.above.net (64.125.29.1) 80.053 ms 79.676 ms 99.963 ms
12 xe-4-3-0.er1.sjc2.us.above.net (64.125.28.53) 82.892 ms 92.206 ms 82.408 ms
13 te2-4.cr1.mlp1.peakwebhosting.com (64.124.200.82) 80.053 ms 82.233 ms 82.190 ms
14 67.221.32.165 (67.221.32.165) 80.012 ms 79.519 ms 79.941 ms
15 208.79.221.221 (208.79.221.221) 80.006 ms 78.587 ms 79.988 ms

Danged if I can see a proxy in there.

 

0 Likes
Re: Access to Vudu blocked because of a Verizon proxy says Vudu
dslr595148
Community Leader
Community Leader

1. Verizon assigns IP addresses dynamically. It's an automatic process, no one is manually handing out IPs.

2. The issue is not with the IP addresses that Verizon assigns, but with the blacklists not updating the IP addresses when they are changed. Verizon can't change third party sites' lists; it is up to the listing site to keep their filters updated.

0 Likes
Re: Access to Vudu blocked because of a Verizon proxy says Vudu
smith6612
Community Leader
Community Leader

Right, so that trace is showing a normal trace for the Verizon network. Since the traffic is via HTTPS, unless the traffic is somehow being proxied through another host without interference, a MITM redirect or hijack would instalty raise red flags for the application being used, causing the connection to halt or terminate. 

There's some data you can check within the Wireshark dump if you saved it to see if there's a transparent proxy being used. One key bit to check for is for the IP address of the source and/or destination. Source should be either your computer's IP if you're sending out, or the remote server's IP if receiving. Vice versa for the other direction. If something's different, you're getting pointed to what could be a proxy. What you're also looking for is the difference or delta between the time it takes for a SYN to be sent and a resulting ACK to be received. The latency betweeen the two should be within the range of the latency you get to the server on the other end. If you get 70ms of latency in a trace/ping and a normal initial connection setup takes something like 8ms to set up, there's a red flag right there. If it's taking same or even slightly more time than the latency to the server to set up, you likely do not have a proxy in the mix.

I would run the Netalyzer tool on your computer to see if it detects any sort of proxy. It won't display the technical details, but it does have a few proxy detection mechanisms in it, one of which is a Transparent proxy detection. It's not 100% reliable since ISPs can manipulate results, but I've never seen Verizon do such a thing.

At this point though, I would consider talking to Vudu a bit more, or trying the same type of Wireshark capture against your neighbor's Comcast connection. I suspect the problem is with Vudu terminating the connection due to their "proxy/VPN" detection system, unless they've checked and have claimed otherwise.

http://netalyzr.icsi.berkeley.edu/ is the link to Netalyzr

0 Likes