Skynet Best practice for unblocking limitless hosts on a domain

[Viktor Jaep]

It depends on how often the machine running the vpn client makes a dns query for the nordvpn hostname to dnsmasq.

My router kills and make a new connection with a different city each night at 1am. Most times, the hostnames it connects to are not the same as the night before.

Could it be that only the NordVPN IPs currently in use are being whitelisted?

Digging around, all appear under "Networks and IPs" on this Netify page, attributed to NordVPN - https://www.netify.ai/resources/applications/nordvpn. These aren't the IPs that appear in my OpenVPN clients (maybe to do with NordVPN's IP sharing?).

That doesn't seem the case. The ones I have listed are ones that I've whitelisted previously. And looking at the netify list, that does not seem right, or complete. NordVPN has servers for 15 cities within the US, and each of these cities have multiple vpn servers for each... There should be like a hundred entries in this list, at least?

 

[dave14305]

My router kills and make a new connection with a different city each night at 1am. Most times, the hostnames it connects to are not the same as the night before.


That doesn't seem the case. The ones I have listed are ones that I've whitelisted previously. And looking at the netify list, that does not seem right, or complete. NordVPN has servers for 15 cities within the US, and each of these cities have multiple vpn servers for each... There should be like a hundred entries in this list, at least?

What’s in /etc/resolv.conf?

 

[Viktor Jaep]

What’s in /etc/resolv.conf?

It just says:

nameserver 127.0.0.1

 

[dave14305]

It just says:

nameserver 127.0.0.1

If you’re using VPNMgr, is it updating the VPN Client with an IP or a hostname?

 

[Viktor Jaep]

If you’re using VPNMgr, is it updating the VPN Client with an IP or a hostname?

It updates it with an IP... and I'm pretty sure vpnmgr does all its calls through an API, so there may be very little DNS lookup going on...

 

[dave14305]

It updates it with an IP...

Ok, so the router never attempts to resolve the name to IP, because I think @Jack Yaz scrapes it from a ovpn file or something non-DNS related. Maybe vpnmgr can update Skynet’s whitelist or trigger a whitelist refresh.

 

[Viktor Jaep]

Ok, so the router never attempts to resolve the name to IP, because I think @Jack Yaz scrapes it from a ovpn file or something non-DNS related. Maybe vpnmgr can update Skynet’s whitelist or trigger a whitelist refresh.

Just found a great resource on how to pull all this NordVPN info through the API... https://sleeplessbeastie.eu/2019/02/18/how-to-use-public-nordvpn-api/

This would be the command to generate a list of US-based NordVPN servers:

curl --silent "https://api.nordvpn.com/v1/servers?limit=16384"  | jq --raw-output '.[] | select(.locations[].country.name == "United States") | .hostname'

Would there be any way to redirect the results of this command into the Skynet NordVPN whitelist?

 

[Viktor Jaep]

Would there be any way to redirect the results of this command into the Skynet NordVPN whitelist?

So I'm reading up... apparently I could output the results of this with a command like this to a text file:

curl http://{one,two}.example.com -o "file_#1.txt"

Then, possibly import this text file using this command:

firewall import whitelist myfile.txt

Sound viable? I'll give it shot...

 

[Viktor Jaep]

Sound viable? I'll give it shot...

OK... I figured it out. I'll get this added to my scripts...

To extract a list of US-based NordVPN server IPs and save it to a txt file:

curl --silent "https://api.nordvpn.com/v1/servers?limit=16384"  | jq --raw-output '.[] | select(.locations[].country.name == "United States") | .station' > NordVPN-US.txt

Then, using the firewall command to import said txt file:

firewall import whitelist NordVPN-US.txt

Bada bing.

 

[Jack Yaz]

Ok, so the router never attempts to resolve the name to IP, because I think @Jack Yaz scrapes it from a ovpn file or something non-DNS related. Maybe vpnmgr can update Skynet’s whitelist or trigger a whitelist refresh.

It should be easy enough to implement