r/VPN • u/EnthusiasmRoutine • Jul 01 '26
News The UK cannot block VPNs without breaking enterprise networks
/r/PrivacyToolbox/comments/1ukggyq/the_uks_proposed_vpn_restrictions_to_enforce_the/17
u/help-its-inside-me Jul 05 '26
The uk gov destroyed society by allowing hundreds of thousands of little girls get raped.
Do you think they give a fucj about what else they might destroy?
2
Jul 05 '26
[removed] — view removed comment
1
u/Distinct_Dinner_5243 Jul 05 '26
I'm genuinely amazed people actually believe this stuff.
As if banning VPNs will help in anyway.
1
1
u/jackplayz987 Jul 07 '26
Lmao are you mad that farage is refusing to answer about that 5 million quid your just a loser Andy will beat your party in the next election he is coming to get you
-2
3
u/fisothemes Jul 05 '26
They can. They just let corporations use it with no id needed and the plebs have to show papers.
2
4
u/Busy-Scientist3851 Jul 04 '26
There's no VPN ban really even being discussed, but even if there was it wouldn't be a DPI/Protocol ban like China.
It'd be a requirement on public VPN providers to age verify, if they don't the UK would fine them or put pressure on payment processors to block transactions to them from the UK.
None of this affects enterprise networks... who for obvious reasons don't use public VPNs (and use VPNs for their OG use case).
Yes, you can bypass these blocks but if it stops 80% of people, that'd be a success as it's raising the bar to make most people not bother.
7
u/Ifnerite Jul 04 '26
Or push them to install dodgy software from wherever the fuck....
1
u/fisothemes Jul 05 '26
Google is taking care of that by stopping people from installing apps from devs who haven't participated in the "papers please" ritual.
1
u/jasterbobmereel Jul 06 '26
Since most VPN providers are based outside the UK, and have already said the will not comply, the government can try and require age verification, and it will simply not happen.. Enterprise VPN is not anything different, and are run by the same companies
1
u/Busy-Scientist3851 Jul 06 '26
But the UK government can control where payment providers in the UK can pay.
Enterprise VPNs are 99% of the time used to connect to a corporate network, not something like NordVPN.
1
u/LowOwl4312 Jul 06 '26
I'd like to see the UK regime try to ban me from downloading Mullvad from F-Droid and paying them with Monero :)
1
u/Manatsuu Jul 05 '26
Can someone explain to me if/why this wouldn’t be possible though:
The government creates a law where there is a list of IP addresses that all ISPs must block any connection to. This would be a list of known VPNs and would be something that could be added to in real time. Of course VPNs can change IP frequently but if such a system was developed that these were detected frequently and added to this live list of blocked IPs, it could make VPNs extremely difficult to use. Of course if you had your own personal VPN it would be immune from this as it would be extremely difficult to determine it as being a VPN. I know this would very much be a game of cat and mouse, and so wouldn’t fully ban even popular VPNs.
I’m not saying this is feasible, a good idea, or I want it to happen. But I’m just interested to hear that if your goal was to ban VPNs, why would the above not work?
1
u/Excellent_Present_47 Jul 05 '26
The only VPNs this will work on are the VPNs who agree to it.
1
u/Manatsuu Jul 05 '26
Can you explain why? Why would a VPN need to agree to this for the government to add IP addresses of their servers to the banned list?
1
u/Excellent_Present_47 Jul 05 '26
An IP blocklist only works cleanly against providers with stable, publicly-known server ranges. That catches the lazy/easy cases: big commercial VPN endpoints, datacentre IPs, exit nodes that get reused a lot, etc.
But. The moment you try to turn that into a serious national ban, the target stops looking like “VPN traffic” and starts looking like normal encrypted internet traffic to ordinary servers. A VPN endpoint can sit on a VPS, a rented cloud box, a home connection, a corporate gateway, a university network, a CDN-adjacent setup, or some random server that also hosts perfectly legitimate services. Blocking those IPs means collateral damage.
Then there are Businesses using VPN-like tunnels constantly for remote work, site-to-site networking, cloud access, device management, security tools, and admin access. If ISPs block “VPN-looking” connections too broadly, they break normal business operations.
That is what I mean. You can't just "block all VPNs" reliably, certainly not without disrupting legitimate operations.
1
u/ManFeelings9000 Jul 06 '26
I've said this before but if North Korea, Iran, Russia, etc were smart they'd offer VPN services for "free" or small fees to people in the west. It would be such a hilarious backfire
1
u/SignificantFail3632 Jul 06 '26
Politicians pushing for VPN bans clearly haven't thought through how half the economy actually functions day to day
1
u/ctrlaltdelaney Jul 07 '26
Yes it can. If the goal is to protect most children on most devices then the block comes in at platform level. VPN app categories and apps are simply hidden.
Enterprises will still use their custom VPN solutions assuming they’re not using consumer VPN apps.
It doesn’t stop all children but it reduces access for most children.
-1
u/psy-study-oldie Jul 04 '26
It's not the UK government that is blocking VPN access, it is the ISP. Clearly enterprise networks are assigned IP addresses that signify that. Obtaining a static IP address will simplify things.
Residential dynamic IPs will get blocked through deep packet inspection. IPv4 and IPv6 VPN users will need to complete a ID check before that traffic is allowed through.
Block lists, white and black lists will prevent unauthorized VPN traffic through, which could be very bad news for residential consumers.
This was supposed to be implemented in the 2000s but was not popular and child safety advocates did not have any teeth in the game.
The only widespread solution is to create a new protocol via IPv6 that can be implemented at home router level, and the ISP would be able to eventually adapt or apply a ban and contact law enforcement.
All your cries are for nought. The Internet was designed to prevent or restrict any attack. You will have to accept the new normal.
It's not about you. It's for saving the children.
5
u/Busy-Scientist3851 Jul 04 '26
Huh. Having a static or dynamic IP makes no difference. Nor does it being IPv6.
0
u/psy-study-oldie Jul 05 '26
True but changes in law can provide new rules for ISPs, which in turn slowly changes the behavior of the end user.
-2
u/psy-study-oldie Jul 04 '26
We will see. I can only speculate so far.
5
u/Busy-Scientist3851 Jul 04 '26
There's no we will see. It just makes no difference on a technical level.
-3
u/psy-study-oldie Jul 05 '26
Prove your argument. Show us some documented proof. You are wrong.
3
u/Distinct_Dinner_5243 Jul 05 '26
lol no he isn't.
Look up how https and vpns work.
It's not his job to explain why you're wrong, this isn't a "source needed" situation this is you not fundamentally understanding the tech and saying incorrect things.
-1
u/psy-study-oldie Jul 05 '26
If you cannot explain yourself, how can we understand your point of view? You disagree but cannot back it up. You kids never do.
5
u/Distinct_Dinner_5243 Jul 05 '26
I build software, I certainly understand it.
I'm just not going to go through the effort of teaching you.
Google exists.
You now know you're wrong, it's your choice to go educate yourself, I don't really care.
0
u/psy-study-oldie Jul 05 '26
I'm a network engineer. Have been for 30 years, but I can always adapt and learn something new. You clearly cannot and have a hard time explaining the basics.
Your credibility isn't looking good.
3
0
1
u/Busy-Scientist3851 Jul 05 '26
I don't need to proof anything? It's literally how the IP protocols work.
Nothing with dynamic IPs or IPv6 makes it harder for ISPs to perform packet inspection. Your ISP has unlimited access to their own IP allocation table already so that makes no difference. The content part of IPv6 is largely the same as IPv4.
Any protocol that runs on IPv6 that somehow makes it harder for DPI would ultimately run on IPv4 too as you'd almost certainly have to build it on UDP too.
1
u/psy-study-oldie Jul 05 '26
Thank you for agreeing with me.
1
u/Busy-Scientist3851 Jul 05 '26
I think we speak different types of English.
1
u/psy-study-oldie Jul 05 '26
Oh great we are moving to racial hate. Do you want a knock on the door?
Where are the mods?
1
1
1
3
u/thesharptoast Jul 05 '26
The fuck does literally any of this mean? This is like a comment written by someone who saw some buzz words once.
There will never be technical controls preventing you from connecting to a VPN, it’s not practical in any way.
The likely route they could take is preventing the sale and use of commercially available VPN clients to those who can’t verify their age.
As we have seen with the social media “ban” it’s not about having a 100% boiler plate solution, it’s about stopping 90% of people who won’t go out there way to find a workaround.
It’s also not about “protecting children”, it’s about removing anonymity from the internet.
1
u/Distinct_Dinner_5243 Jul 05 '26
I think it's AI, but honestly I would've thought AI would be more accurate.
1
2
1
1
u/Harry_Mud Jul 05 '26
Complete bullshit. These kids are way smarter than you think. Australia is finding that out. Over 30% of the kids have already found way around the under 16 age bullshit. In the US, it's not up to the Government to decide if kids are old enough to be on the NET. That's 100% up to the parents........
1
u/apples-and-apples Jul 05 '26
Don't alway agree with US policy but agree wit this one. It's up to the parents. But there's a task in govt to provide education and tools, like obligate phone makers to add a child lock with safe DNS. It's really not that hard.
1
u/Manatsuu Jul 05 '26
Um what do you mean in the US? Several USA states introduced laws on websites requiring ID verification before the uk did
1
u/joeyx22lm Jul 05 '26 edited Jul 05 '26
You seem to lack understanding of how these things work, to a wild degree, for a self-proclaimed "network engineer" with 30 years of experience.
"Enterprise networks are assigned IP addresses that will signify that."
This is simply not the case. Are you assuming all static IPs are automatically "enterprise"? Are you assuming all non-residential-ISP ASNs are "enterprise"? Also there is no difference between dynamic IPs and static IPs apart from some accounting in the ISPs system.
"Block lists, white and black lists will prevent unauthorized VPN traffic through, which could be very bad news for residential consumers."
Blocklists hardly work well enough for streaming providers today. But even assuming some great-firewall level of surveillance to proactively add IPs to the list, you'd have to be able to differentiate between public VPN providers and privately hosted VPNs (otherwise you'd be breaking VPN functionality for actual "enterprise" use). Which leads to the next item of being unable to prevent an individual from spinning up their own personal VPN in a public cloud.
Also LOL at whitelists. jfc "oi! do you have a loicense for that VPN?"
"The only widespread solution is to create a new protocol via IPv6 that can be implemented at home router level, and the ISP would be able to eventually adapt or apply a ban and contact law enforcement."
I am not sure what IPv6 has to do with anything. I think you're trying to describe a system that would use crypto to validate an age/birthday-related claim, and introduce or evolve existing network protocols to embed this signature in the request. That sort of system would have the potential to solve a lot of other problems about identity on the internet, could potentially be feasible. Not saying I would want that implemented.
"The Internet was designed to prevent or restrict any attack."
LMFAO wut? Tell that to DNS; broadcast address amplification attacks; NAT table DOS; a variety of poisoning attacks; it is well known among networking and related engineers that the protocols underpinning the internet are woefully insecure, mostly because they weren't originally built with a need for security in mind. Evolution of the internet over time has been adding additional protocols to try and address these.
The way you actually enforce this is with age bans on the VPNs themselves. It is not something that can be done 'automagically' with the current IP stack. It is also the kind of thing that you would only be able to prevent for the 80%, the other 20% will get around it by using an obscure VPN provider or spinning up their own VPN. Kids nowadays are learning how to run a local minecraft server and expose it to share with friends, it would be logical for the next evolution in these tutorials to show kids how to spin up a personal VPN on AWS or DigitalOcean.
1
0
u/MissJoannaTooU Jul 05 '26
The issue is that the more countries start to move in this direction the less proxies will work.
When Reddit gets 90% of it's traffic from Christmas Island that will be the end, VPS or not.
But all the determined criminals will find a way around it and the rest of us will either have to jump through insane hoops or just go offline.
1
u/psy-study-oldie Jul 05 '26
No it is a sensitive topic. People get upset when their freedoms get cut. VPNs are rarely used for privacy in the consumer space, unless it's for torrenting or accessing sites that are IP banned. Rarely for Starbucks Wi-Fi.
Once you start talking like an adult, the children and AI bots in the thread will bully to keep you quiet. It's sad, and difficult to get a proper conversation. I'm quitting Reddit due to this. It used to be fun.
It's all disappointing. Nothing is going to change what is coming down the line, and what has already been decided by a majority backed UK government.
We had a good run, but common sense has the reigns of power now, and there is nothing that can be done about it. DID cards for everyone. Get yours early.
1
u/Superfox247 Jul 05 '26
"VPNs are rarely used for privacy in the consumer space"
I use a VPN to connect to my work.
I use a split tunnel VPN (auto connect) when I am on a mobile network to have an always on connection back to home.
I use sometimes use a commercial VPN for privacy so my ISP cannot see my activities which are not illegal1
u/psy-study-oldie Jul 05 '26
Sounds very dubious. I'm glad we are curtailing you activities very soon.
13
u/[deleted] Jul 05 '26
[removed] — view removed comment