Good day! Let me know if this post is not relevant to this community and I’ll take it down.
I am using a VPN provider whose IP addresses are mostly blocked by streaming services and YouTube. This is not a problem for me, since I can often just obfuscate the address with some of their proxy solutions.
Without having any real understanding of how third party VPN providers work under the hood, my questions is, would it be possible for the VPN provider to implement an end user function, like a “vote button” or the likes, that reports when a certain address is blocked by a certain web service and then - for instance, when enough end users have reported a specific IP address as blocked - simply rotate/exchange that IP address to circumvent the blockage?
I’d like to suggest this to my provider if it’s viable at all.
For many VPN providers that essentially implement NAT so that X number of subscribers are sharing Y number of IP addresses, there is oversubscription when X > Y. Fortunately, as a practical matter, oversubscribing NAT is both commonplace and not really a problem. A home NAT is oversubscribed in the sense that there might be 10 devices in the LAN but only 1 public IP address.
However, for VPN providers to make money, they need to keep expenses down. So if their acceptable NAT oversubscription ratio was, say, 30:1, and they have 3000 users, they must own 100 IP address. Although some providers also offer IPv6 addresses, it is IPv4 addresses that are in short-supply. And thus the cost is from the number of IPv4 addresses they must have. The current going rate for IPv4 addresses is somewhere around $10-$25 each, so 100 addresses would add up.
A proposal to allow user-input on when to rotate an address would have financial and practical impacts on a VPN provider. Firstly, if “rotate” means to swap amongst the 100 addresses they already have, then that just pushes the problem to some other group of 30 users. But if “rotate” means selling that one IP address and acquiring a fresh one from the market, one which isn’t blocked by external services, then that’s going to increase expenses.
As it happens, the market for IP addresses can be automated for fast sales, but generally it is impermissible to sell singular IP addresses. Instead, the minimum quantity to buy or sell is a /24, which represents 256 IPv4 addresses. So the VPN provider would have to keep a bunch of IP addresses, unused, in order to “rotate” any quantity less than 256 addresses. That’s just not economical.
Finally, from a technical perspective, it’s not terribly difficult to reconfigure their NAT to use different outbound IP addresses, amongst the pool that the VPN provider has already provisioned. But there may be legal effects from undertaking such technical manoeuvres.
In jurisdictions like the USA, VPN providers (based here or overseas) have a legal defense that they do not knowingly facilitate contravention of geolocking or other blocking mechanisms. They simply sell a product and the users use it however they want. But once a VPN provider explicitly allows users to influence the service, such as by suggesting an IP rotation because the current one has been blocked, the legal defense starts to break down. YouTube or whoever could potentially sue a domestic or overseas VPN, on the claim that they’re shifting their IP address to harm or overload the YouTube servers. The USA federal laws on computer abuse are arcane but very punitive, so this would be unpleasant if it ever came to be.
Note well: a VPN that already rotates their IP addresses without user-input can still claim the defense of not knowingly facilitating circumvention. All NATs eventually rotate, so the rate of rotation is a configurable option, one that is set for business or technical reasons. But once a provider is intentionally helping out users by taking input, the legal doors are thrown open.
TL;DR: multiple reasons preclude a VPN provider from switching out IP addresses based on user input
The minimum quantity depends on what level you’re buying at. A retail isp will go as small as a /29. I don’t think I’ve ever seen them do a /30, but it’s been a while. The biggest they would probably do is a /24.
Now if you were talking to a big-name IP address broker, you could probably get as big as an /8 and as small as a /24. But an /8 would probably cost billions of dollars, if anyone is willing to sell at all. You’d probably have to buy the whole company.
At this point, anyone that is even thinking of acquiring a /8 should instead spend that money on building IPv6 infra instead. And they’d still have tens of millions of dollars leftover.
I would be thrilled if one day, the only remaining customers for Legacy IP addresses are the hyperscalar cloud providers. Let them hoard them all, so long as everyone else has a viable IPv6 Internet to use.
Thank you for a quick and amazingly insightful reply, covering both legal and technical aspects. I learned a lot!
You’re most welcome!
