> Second, even if I installed a VPN on my main machine, what about my phone? My laptop? My desktop? Every device would need the VPN running, and I’d have to remember to connect it before browsing. It’s messy.
This is what routers are for. My router (a cheap fanless box with several network ports running linux) is the only thing on my network that knows there's a VPN. I can selectively route whatever I want through it, including having a separate SSID/VLAN from which everything is routed through the VPN. It's wireguard based so there's no "installing a VPN", just an interface/network configured in systemd-networkd (once, on the router).
Edit: Routing by domain name could be tricky, though. I haven't had a need for that, and a proxy with local DNS override (as in the article) might needed if it came to that. I'd still do it on the router, though.
Two devices I use - both running Debian, and both being open-source hardware to some degree or other:
PC Engines APU2, AMD x86_64, 4-core, 4GiB, 3x Gigabit Ethernet, 3 x mini PCIe, SIM slot, USB 3, Serial, SATA ports. Mine has dual band WiFi in one mPCIe, SSD in another.
Turris Mox, Marvel aarch64. This can expand via plug and go via a range of extension modules. I've got one with 25 Gigabit (3 x 8-port modules) Ethernet, 1 x SFP, 5 x USB3, Wifi, Serial.
I was hoping, from the title ("Geo-Unblocked") that this would be about arranging an IP address block that wasn't associated with the UK, rather than just selectively running some traffic through a VPN.
Sometimes. You can publish whatever geolocation data file you want, but others aren't required to respect that file. It's known that geolocation providers run pings and traceroutes from different locations as well as looking at BGP data.
I don't think that would work though. If you changed your WAN address it wouldn't be dissimilar from changing your IP to a different schema on a machine in a given network, no? It just wouldn't work at all.
"Is this overkill for viewing the occasional Imgur image? Probably."
From the last couple of weeks of researching some stuff, it makes perfect sense - I keep stumbling across blogs and documentation that uses Imgur, and it's really quite annoying that I can't see the screenshot or image that is being referenced. It hasn't /quite/ hit the point to put something in place, but this is super helpful for the final straw - when it comes!
It's been eye-opening how far-reaching Imgur really is - for example, some of the images on the Core Devices (the new Pebble folks) website are actually on Imgur.
This simple block is relatively trivial to bypass - but if they disappear tomorrow, a lot of things break.
> but if they disappear tomorrow, a lot of things break.
Tale as old as time, long-running forums are graveyards of dead Photobucket, Tinypic and Imageshack embeds. Imgur has lasted longer than most but the cycle will probably repeat eventually, especially since they were acquired by faceless corpos a few years ago.
also, if foreign servers notice no real loss of traffic because people just circumvent draconian censorship measures from authoritarian regimes, then they can more safely ignore them without real repercussions
the EU seems to be following soon, so it's important that people have readily available tools so the power dynamics change and it doesn't become economically unfeasible to refuse censorship pressures
I feel like I'd rather solve this with a proxy PAC file. I recently started using this on airplane Wi-Fi where they'd block VPNs, but strangely not SSH. Dynamic forwarding with a good PAC to "direct" connect the onboard entertainment and flight tracking hosts/URLs works great!
> First, I just upgraded to 2.5 Gbps internet and I don’t want to route all my traffic through a VPN and take the speed hit. I have this bandwidth for a reason
You don't have to. You create a container which runs openvpn to connect to your vpn provider, and also hosts an ssh daemon. The ssh daemon receives incoming SOCKS5 connections from a firefox portable browser, which has been configured to use the proxy (your Docker openvpn-container) for browsing and DNS resolution, and pipes it through the VPN tunnel.
So you have that one browser just to surf imgur. if that's your thing. And you could also use Firefox on Android (maybe also iOS) with those proxy settings (a secondary Firefox browser, like the beta version).
So you get very high control about what you are using the VPN for, you don't just pipe your entire OS's network traffic through the VPN.
This would have the exact problem mentioned immediately after the paragraph you quoted. Every computer, phone, etc. would need specific setup. The author is clear about their goal:
> I wanted something cleaner: a solution that works for every device on my network, automatically, without any client-side configuration.
That doesn't seem very practical. The issue is that imgur links are everywhere and you wouldn't want to switch browsers whenever you encounter one. Not to mention it requires per device setup. Author's solution is much better than what you describe.
This is a great idea except for me (and for the author I suspect) I regularly come across attachment of Imgur hosted images on sites (like a post on a DIY forum but not all of them) so it wouldn't solve my issue unless I were to use your browser in the container all the time (I suspect the author also doesn't just 'surf imgur' but randomly comes across images hosted on imgur linked to from other locations).
Nope, security/privacy is always a trade off. It's much much safer just to route all your traffic through a VPN. I get ~200-500 Mbps with Mullvad, that seems good enough. Sucks if you upgraded to 2.5 Gbps before checking, but oh well
I've done similar. But I just used PBR (policy based routing) on my OpenWRT router. Took about 15 minutes to set it up. You can pick which domains go through VPN. Works great.
Presumably TLS still only happens at the browser and at the Imgur origin server. Everything in between just routes the request without being able to read any of the encrypted stuff. This is no different than using your browser while your computer is connected to the web via a VPN, except that in this case only a small subset of requests go through the VPN.
What's annoying about this block is that Imgur detects Telegram's server for image previews as coming from the UK but they are in the Netherlands so when someone sends an imgur link through Telegram with the little preview attached you now only get the "not available" image as prevew...
a-ha, if you happen to have a Unifi router then a simpler setup would be to do policy based routing by hostnames through a vpn client maintained in the router config
I've thought about doing something similar as well! It drives me nuts this ban, everywhere I look I see these blocked images. I thought about making a chrome extension that proxies.
So you are just a simple GB citizen and some external site blocked access by country affiliation?! Is there any practical reason for blocking access to that site by geotargeting?
Install the Wireguard packages, create a connection to your VPN of choice in a nearby country (I chose Sweden). Then I used the "vpn-policy-routing" package to route Imgur IPs (199.232.196.193 199.232.192.193) through the VPN.
Works for websites that keep nagging you for age verification too.
But seriously, it's been more emotional than I'd expected to get my cat memes back.
Yeah, doing it with OpenWRT and PBR is definately much simpler than this approach. However by using hard-coded IP addresses you are at risk of breakage if they change in the future.
Also fastly-hosted services are a bit awkard to configure IP ranges to cover whole blocks as they seem to not use normal CIDR-blocks for different customers.
But you use PBR's ntfset functionality to have your dns server automatically update a set whenever an DNS entry is resolved, then set the policy rules based on the set.
Another thing that you can do when you have the IP address range is just run a traditional split-tunnel. A simple way to do that is to run Wireguard on a cheap VPS, then have only traffic to those fixed IPs go to that tunnel. The nice thing about this is that tiny WiFi routers (e.g. hAP AX S) these days support Wireguard at pretty decent speeds. Then anyone on your network gets this, and if you want it while you roam you can just run the Wireguard VPN on your phone as well with the same rules.
Great work! Perhaps not the appropriate OSI layer, but would be cool if this could pull the imgur blob from the wayback machine if unavailable on imgur proper. You'd still need this networking setup, as archive.org is blocked as well in the UK per ground truth from others on HN.
> as archive.org is blocked as well in the UK per ground truth from others on HN
I am in the UK.
archive.org is not blocked — not the Library or the Wayback Machine.
ETA: I just checked re: the comment toomuchtodo linked to, and it actually is blocked by default on my mobile phone as adult content, because I've never bothered to disable the adult content lock on that device. I get redirected to a page operated by my mobile network where I can undo the lock by giving them info; I might do that one day, might not.
For non-UK users: UK mobile phone providers all block adult content by default at the account level as a simple parental control measure, and have done for some time, largely because PAYG data is really rather cheap here.
Interesting but not particularly bothersome. Apparently this decision is about eleven years old.
> Second, even if I installed a VPN on my main machine, what about my phone? My laptop? My desktop? Every device would need the VPN running, and I’d have to remember to connect it before browsing. It’s messy.
This is what routers are for. My router (a cheap fanless box with several network ports running linux) is the only thing on my network that knows there's a VPN. I can selectively route whatever I want through it, including having a separate SSID/VLAN from which everything is routed through the VPN. It's wireguard based so there's no "installing a VPN", just an interface/network configured in systemd-networkd (once, on the router).
Edit: Routing by domain name could be tricky, though. I haven't had a need for that, and a proxy with local DNS override (as in the article) might needed if it came to that. I'd still do it on the router, though.
You can just use FoxyProxy instead of a separate browser instance. This firefox addon will use a proxy based on URL patterns.
You don't even need an extension - FF can do it natively via proxy file
> a cheap fanless box with several network ports running linux
Do you remember the name of the product?
Two devices I use - both running Debian, and both being open-source hardware to some degree or other:
PC Engines APU2, AMD x86_64, 4-core, 4GiB, 3x Gigabit Ethernet, 3 x mini PCIe, SIM slot, USB 3, Serial, SATA ports. Mine has dual band WiFi in one mPCIe, SSD in another.
Turris Mox, Marvel aarch64. This can expand via plug and go via a range of extension modules. I've got one with 25 Gigabit (3 x 8-port modules) Ethernet, 1 x SFP, 5 x USB3, Wifi, Serial.
2 replies →
Qotom is a good chinesium brand for small cheap fanless multi-NIC PCs: https://qotom.net
I was hoping, from the title ("Geo-Unblocked") that this would be about arranging an IP address block that wasn't associated with the UK, rather than just selectively running some traffic through a VPN.
If you're your own ISP you can be wherever you want to be
https://blog.lyc8503.net/en/post/asn-5-worldwide-servers/
Sometimes. You can publish whatever geolocation data file you want, but others aren't required to respect that file. It's known that geolocation providers run pings and traceroutes from different locations as well as looking at BGP data.
1 reply →
I don't think that would work though. If you changed your WAN address it wouldn't be dissimilar from changing your IP to a different schema on a machine in a given network, no? It just wouldn't work at all.
"Is this overkill for viewing the occasional Imgur image? Probably."
From the last couple of weeks of researching some stuff, it makes perfect sense - I keep stumbling across blogs and documentation that uses Imgur, and it's really quite annoying that I can't see the screenshot or image that is being referenced. It hasn't /quite/ hit the point to put something in place, but this is super helpful for the final straw - when it comes!
I've found it a bit harder than I thought to bypass but veepn free with the location set to Singapore kind of works, if slowly.
It's been eye-opening how far-reaching Imgur really is - for example, some of the images on the Core Devices (the new Pebble folks) website are actually on Imgur.
This simple block is relatively trivial to bypass - but if they disappear tomorrow, a lot of things break.
> but if they disappear tomorrow, a lot of things break.
Tale as old as time, long-running forums are graveyards of dead Photobucket, Tinypic and Imageshack embeds. Imgur has lasted longer than most but the cycle will probably repeat eventually, especially since they were acquired by faceless corpos a few years ago.
4 replies →
makes me thankful for imgur deleting anonymous uploads a year or 2 ago
that made multiple forums I've been on rush to download everything to their servers
it will certainly not stop at Imgur
also, if foreign servers notice no real loss of traffic because people just circumvent draconian censorship measures from authoritarian regimes, then they can more safely ignore them without real repercussions
the EU seems to be following soon, so it's important that people have readily available tools so the power dynamics change and it doesn't become economically unfeasible to refuse censorship pressures
This is such a deep rabbit hole! Other alternatives include CDN and residential proxies, no VPN required
I feel like I'd rather solve this with a proxy PAC file. I recently started using this on airplane Wi-Fi where they'd block VPNs, but strangely not SSH. Dynamic forwarding with a good PAC to "direct" connect the onboard entertainment and flight tracking hosts/URLs works great!
> First, I just upgraded to 2.5 Gbps internet and I don’t want to route all my traffic through a VPN and take the speed hit. I have this bandwidth for a reason
You don't have to. You create a container which runs openvpn to connect to your vpn provider, and also hosts an ssh daemon. The ssh daemon receives incoming SOCKS5 connections from a firefox portable browser, which has been configured to use the proxy (your Docker openvpn-container) for browsing and DNS resolution, and pipes it through the VPN tunnel.
So you have that one browser just to surf imgur. if that's your thing. And you could also use Firefox on Android (maybe also iOS) with those proxy settings (a secondary Firefox browser, like the beta version).
So you get very high control about what you are using the VPN for, you don't just pipe your entire OS's network traffic through the VPN.
This would have the exact problem mentioned immediately after the paragraph you quoted. Every computer, phone, etc. would need specific setup. The author is clear about their goal:
> I wanted something cleaner: a solution that works for every device on my network, automatically, without any client-side configuration.
https://addons.mozilla.org/en-US/firefox/addon/container-pro...
You can default route domains through a VPN using a Firefox tab container, you don’t need a separate browser instance running!
That doesn't seem very practical. The issue is that imgur links are everywhere and you wouldn't want to switch browsers whenever you encounter one. Not to mention it requires per device setup. Author's solution is much better than what you describe.
This is a great idea except for me (and for the author I suspect) I regularly come across attachment of Imgur hosted images on sites (like a post on a DIY forum but not all of them) so it wouldn't solve my issue unless I were to use your browser in the container all the time (I suspect the author also doesn't just 'surf imgur' but randomly comes across images hosted on imgur linked to from other locations).
In that case FoxyProxy's proxy by URL pattern would be what you'd want to use.
Nope, security/privacy is always a trade off. It's much much safer just to route all your traffic through a VPN. I get ~200-500 Mbps with Mullvad, that seems good enough. Sucks if you upgraded to 2.5 Gbps before checking, but oh well
I've done similar. But I just used PBR (policy based routing) on my OpenWRT router. Took about 15 minutes to set it up. You can pick which domains go through VPN. Works great.
I wonder how did you overcome https. As I understand the request that goes to rerouted Imgur proxy will have different cert.
Presumably TLS still only happens at the browser and at the Imgur origin server. Everything in between just routes the request without being able to read any of the encrypted stuff. This is no different than using your browser while your computer is connected to the web via a VPN, except that in this case only a small subset of requests go through the VPN.
What's annoying about this block is that Imgur detects Telegram's server for image previews as coming from the UK but they are in the Netherlands so when someone sends an imgur link through Telegram with the little preview attached you now only get the "not available" image as prevew...
a-ha, if you happen to have a Unifi router then a simpler setup would be to do policy based routing by hostnames through a vpn client maintained in the router config
For some reason T-Mobile in the Bay Area can get randomly geoIPed to the UK so imgur just randomly breaks on my phone. Marvelous
Nice work.
I've thought about doing something similar as well! It drives me nuts this ban, everywhere I look I see these blocked images. I thought about making a chrome extension that proxies.
So you are just a simple GB citizen and some external site blocked access by country affiliation?! Is there any practical reason for blocking access to that site by geotargeting?
The UK’s “online safety act” means a number of medium sized sites have decided it’s not worth doing business in the UK.
This is not why imgur have left though, they didn't want to comply with Data Protection laws.
4 replies →
Could this be built into open source routers? If you wanted to get fancy you could even select the best VPN for the particular service.
OpenWRT supports PBR which makes this a breeze.
You can run the shadowsocks client on some routers and pass selected traffic via your external shadowsocks server.
I haven't needed to do this since I move to the US, but IIRC the rules were based on IP subnets.
The approach in TFA is more sophisticated and fine-grained.
gl.inet routers running OpenWRT do this easily in the newer firmware versions the last few months.
I've not managed to succesfully use a VPN to get around the geoblock. It seems that most of VPN exit nodes are also blocked (but in a different way)
Interesting. I have nextdns.io and VPN proxy and a unifi router. Is this possible for me?
This is quite easy with OpenWRT.
Install the Wireguard packages, create a connection to your VPN of choice in a nearby country (I chose Sweden). Then I used the "vpn-policy-routing" package to route Imgur IPs (199.232.196.193 199.232.192.193) through the VPN.
Works for websites that keep nagging you for age verification too.
But seriously, it's been more emotional than I'd expected to get my cat memes back.
Yeah, doing it with OpenWRT and PBR is definately much simpler than this approach. However by using hard-coded IP addresses you are at risk of breakage if they change in the future.
Also fastly-hosted services are a bit awkard to configure IP ranges to cover whole blocks as they seem to not use normal CIDR-blocks for different customers.
But you use PBR's ntfset functionality to have your dns server automatically update a set whenever an DNS entry is resolved, then set the policy rules based on the set.
Didn't even know it was possible. But thanks to this comment - got the same setup via my Unifi router too. Thanks!
Why not call it split tunneling, which is what it is.
because saying "i used a split tunnel to access geo-blocked resources" doesn't get you those sweet sweet internet points on hacker news, ofc
Another thing that you can do when you have the IP address range is just run a traditional split-tunnel. A simple way to do that is to run Wireguard on a cheap VPS, then have only traffic to those fixed IPs go to that tunnel. The nice thing about this is that tiny WiFi routers (e.g. hAP AX S) these days support Wireguard at pretty decent speeds. Then anyone on your network gets this, and if you want it while you roam you can just run the Wireguard VPN on your phone as well with the same rules.
Great work! Perhaps not the appropriate OSI layer, but would be cool if this could pull the imgur blob from the wayback machine if unavailable on imgur proper. You'd still need this networking setup, as archive.org is blocked as well in the UK per ground truth from others on HN.
> archive.org is blocked as well in the UK
it isn't
https://www.privateinternetaccess.com/blog/internet-archive-...
5 replies →
> as archive.org is blocked as well in the UK per ground truth from others on HN
I am in the UK.
archive.org is not blocked — not the Library or the Wayback Machine.
ETA: I just checked re: the comment toomuchtodo linked to, and it actually is blocked by default on my mobile phone as adult content, because I've never bothered to disable the adult content lock on that device. I get redirected to a page operated by my mobile network where I can undo the lock by giving them info; I might do that one day, might not.
For non-UK users: UK mobile phone providers all block adult content by default at the account level as a simple parental control measure, and have done for some time, largely because PAYG data is really rather cheap here.
Interesting but not particularly bothersome. Apparently this decision is about eleven years old.
Imagine having to install a vpn to browse the internet in a first world country.
Imagine deciding to pull out of a country because you refuse to comply with protecting the personal data of actual children.
[flagged]
that's a bit histrionic, isn't it?
1 reply →
[dead]
[dead]
[dead]
> ⌘+F, "vote", Not found
Seems the author forgot one step.
The law was drafted by the government of one party, enacted by the government of the other party.
And backed by popular support.
2 replies →