Getting Netflix to work with IPv6

Haven't update the blog for a while as I was busy at work, study and personal live.  During Christmas I want to watch a movie, and I've subscribed Netflix as a result.  I assume what I need to do is simply go to the Netflix website and choose the movie that I want, and watch it.  However, life is not as simple as you think.  I am keep on getting error saying that I have some kind of network connection / proxy issue to prevent me from watching the movie.

After some digging, seems Netflix doesn't like IPv6, especially the setup in my home, where I have my v6 connectivity tunnel through Hurricane Electric.  To verify what IPv6 address Netflix is using:

$ dig -t AAAA cbp-us.nccp.netflix.com

; <<>> DiG 9.8.3-P1 <<>> -t AAAA cbp-us.nccp.netflix.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- 64879="" id:="" noerror="" opcode:="" query="" span="" status:="">

;; flags: qr rd ra; QUERY: 1, ANSWER: 10, AUTHORITY: 4, ADDITIONAL: 2

;; QUESTION SECTION:

;cbp-us.nccp.netflix.com. IN AAAA

;; ANSWER SECTION:

cbp-us.nccp.netflix.com. 0 IN CNAME cbp-us.nccp.geo.netflix.com.

cbp-us.nccp.geo.netflix.com. 0 IN CNAME cbp-us.nccp.us-west-2.prodaa.netflix.com.

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::36ba:c314

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3270:4b38

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::340a:2bb5

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3695:797a

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3645:db3d

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3420:816

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::3459:e8e6

cbp-us.nccp.us-west-2.prodaa.netflix.com. 60 IN AAAA 2620:108:700f::36bb:40b9

;; AUTHORITY SECTION:

prodaa.netflix.com. 68907 IN NS ns-1606.awsdns-08.co.uk.

prodaa.netflix.com. 68907 IN NS ns-1489.awsdns-58.org.

prodaa.netflix.com. 68907 IN NS ns-375.awsdns-46.com.

prodaa.netflix.com. 68907 IN NS ns-749.awsdns-29.net.

;; ADDITIONAL SECTION:

ns-375.awsdns-46.com. 68861 IN A 205.251.193.119

ns-749.awsdns-29.net. 68861 IN A 205.251.194.237

;; Query time: 63 msec

;; SERVER: 218.252.0.24#53(218.252.0.24)

;; WHEN: Sun Dec 25 22:13:54 2016

;; MSG SIZE  rcvd: 507

This is the ACL I've implemented in my 1941 router to filter out the IPv6 address block of Netflix.  With this workaround I am now able to watch some movies during the festive season!

sh access-list block-netflix

IPv6 access list block-netflix

    deny ipv6 any 2620:108:700F::/48 (412 matches) sequence 20

    permit ipv6 any any (1804317 matches) sequence 30

interface GigabitEthernet0/1

 ! My LAN side interface

 ipv6 traffic-filter block-netflix in

end

IPv6 Tunnel Broker Setup on IOS router

My environment: Cisco 2801 router

IOS version: 12.4(24)T1 Advanced Enterprise

I have registered an account on Hurricane Electric, it is free and you will get an tunnel IPv6 address and a routed /64 block IPv6 address. Follow the below steps to get your tunnel working:

1. Enable IPv6 unicast routing

 ipv6 unicast routing

2. Configure your tunnel to HE

interface Tunnel0
description IPv6 tunnel to HE Tunnel Broker
no ip address
ipv6 address <Your Tunnel IPv6 Address>
ipv6 enable
tunnel source <Your Internet facing interface>
tunnel destination <HE tunnel destination IPv4 address>
tunnel mode ipv6ip

3. Configure your LAN-facing interface

interface FastEthernet0/0
ip address <LAN IP address>
ipv6 address <The routed /64 address provided by HE>
ipv6 enable
ipv6 nd prefix <The prefix of the routed /64 address>

4. Create a IPv6 default route

ipv6 route ::/0 Tunnel0

5. If you doesn’t have a fixed Internet IP address, you can use the DDNS service to update the tunnel IP address

ip ddns update method v6tunnelbroker
HTTP
  add &pass=this_is_your_password_md5&user_id=this_is_your_userid_md5&tunnel_id=your_tunnel_id">https://ipv4.tunnelbroker.net/ipv4_end.php?ipv4b=<a>&pass=this_is_your_password_md5&user_id=this_is_your_userid_md5&tunnel_id=your_tunnel_id
interval maximum 1 0 0 0
interval minimum 1 0 0 0

interface FastEthernet0/1
ip ddns update v6tunnelbroker host ipv4.tunnelbroker.net

 

You should be able to access the IPv6 Internet now!  Try to access http://ipv6.google.com from a PC behind the router!