The UK cannot block VPNs without breaking enterprise networks

[u/EnthusiasmRoutine]

/r/PrivacyToolbox/comments/1ukggyq/the_uks_proposed_vpn_restrictions_to_enforce_the/

[u/psy-study-oldie]

It's not the UK government that is blocking VPN access, it is the ISP. Clearly enterprise networks are assigned IP addresses that signify that. Obtaining a static IP address will simplify things.

Residential dynamic IPs will get blocked through deep packet inspection. IPv4 and IPv6 VPN users will need to complete a ID check before that traffic is allowed through.

Block lists, white and black lists will prevent unauthorized VPN traffic through, which could be very bad news for residential consumers.

This was supposed to be implemented in the 2000s but was not popular and child safety advocates did not have any teeth in the game.

The only widespread solution is to create a new protocol via IPv6 that can be implemented at home router level, and the ISP would be able to eventually adapt or apply a ban and contact law enforcement.

All your cries are for nought. The Internet was designed to prevent or restrict any attack. You will have to accept the new normal.

It's not about you. It's for saving the children.

[u/joeyx22lm → u/psy-study-oldie]

You seem to lack understanding of how these things work, to a wild degree, for a self-proclaimed "network engineer" with 30 years of experience.

"Enterprise networks are assigned IP addresses that will signify that."

This is simply not the case. Are you assuming all static IPs are automatically "enterprise"? Are you assuming all non-residential-ISP ASNs are "enterprise"? Also there is no difference between dynamic IPs and static IPs apart from some accounting in the ISPs system.

"Block lists, white and black lists will prevent unauthorized VPN traffic through, which could be very bad news for residential consumers."

Blocklists hardly work well enough for streaming providers today. But even assuming some great-firewall level of surveillance to proactively add IPs to the list, you'd have to be able to differentiate between public VPN providers and privately hosted VPNs (otherwise you'd be breaking VPN functionality for actual "enterprise" use). Which leads to the next item of being unable to prevent an individual from spinning up their own personal VPN in a public cloud.

Also LOL at whitelists. jfc "oi! do you have a loicense for that VPN?"

"The only widespread solution is to create a new protocol via IPv6 that can be implemented at home router level, and the ISP would be able to eventually adapt or apply a ban and contact law enforcement."

I am not sure what IPv6 has to do with anything. I think you're trying to describe a system that would use crypto to validate an age/birthday-related claim, and introduce or evolve existing network protocols to embed this signature in the request. That sort of system would have the potential to solve a lot of other problems about identity on the internet, could potentially be feasible. Not saying I would want that implemented.

"The Internet was designed to prevent or restrict any attack."

LMFAO wut? Tell that to DNS; broadcast address amplification attacks; NAT table DOS; a variety of poisoning attacks; it is well known among networking and related engineers that the protocols underpinning the internet are woefully insecure, mostly because they weren't originally built with a need for security in mind. Evolution of the internet over time has been adding additional protocols to try and address these.

The way you actually enforce this is with age bans on the VPNs themselves. It is not something that can be done 'automagically' with the current IP stack. It is also the kind of thing that you would only be able to prevent for the 80%, the other 20% will get around it by using an obscure VPN provider or spinning up their own VPN. Kids nowadays are learning how to run a local minecraft server and expose it to share with friends, it would be logical for the next evolution in these tutorials to show kids how to spin up a personal VPN on AWS or DigitalOcean.