Netflix is adding residential IP addresses to its VPN blocklists

Netflix blocks known commercial VPNs and proxies from accessing its services in order to preserve its geofencing—partitioning access to content based on a user's real-world location. Users who connect to a commercial VPN or proxy provider endpoint in another country can access content licensed for viewing in the endpoint country—but not in the viewer's own.

Recently, as reported by TorrentFreak, Netflix began including putatively residential IP subnets in its blocklists.

Cat and mouse

Since Netflix first began blocking commercial VPN and proxy providers in 2015, those services have fought back by finding ways to evade its and other streaming services' blocking attempts. The simplest way is just to discard an existing subnet that's been widely identified as "VPN/proxy" and purchase another, "clean" space. This move can buy a blocklist evader a few days or even weeks before the new subnet is added to the list.

This basic conflict between VPN providers eager to keep region-shifting customers happy and streaming services trying to keep content licensers pacified led to a six-year-long cat-and-mouse game. Both sides are pretty cagey about the technical details, but one technique the VPN providers use is leasing IP addresses in supposedly "residential" IP subnets to use as exit proxies.

One commercial VPN provider told TorrentFreak that recently, Netflix began blocking those "residential" proxy addresses as well—with some readily apparent collateral damage. "You have hundreds of thousands of legitimate residential Netflix subscribers blocked," WeVPN's spokesperson said.

Scope of damage

Falling afoul of Netflix's VPN block doesn't hurt quite as badly these days as it did in 2015. Instead of an outright ban on devices coming from a blocked IP address, the service now somewhat selectively removes access to region-locked content.

If you want to watch Netflix originals across a VPN, you can do so whether your endpoint is on the service's blocklist or not, but region-locked content will be hidden from view, neither browsable nor playable. A clever user who tries to access hidden content using a deep link directly to that content gets a "Pardon the interruption" error dialog asking the user to turn off VPNs and proxies instead.

Although WeVPN claims "hundreds of thousands of users" who don't use VPNs or proxies have been caught in the crossfire, the real numbers aren't yet clear. Some Redditors report "missing content" when accessed over Wi-Fi, with the same content showing up again on mobile data. This situation corresponds to Netflix's current VPN blocklist policies. A similar user report on Twitter got an odd response from Netflix pointing the finger right back at the user's ISP:

Some tech-savvy Netflix users have reported working around the false-block issue by releasing their public IP address and getting a new one—but that approach only helps if you know what you're doing, your ISP issues DHCP addresses, and the lease on those addresses is relatively short. We aren't very optimistic about outcomes for customers who don't meet all those criteria and are stuck calling into ISP support departments not primed for this sort of call.