It's all just an effort to control the 90%.

> Folks would just host their own vpns various places and this would be pointless

In the real world, very few people have that capability.

Detection can be based on the IPs themselves, no packet tricks required. Plenty of services can do that: https://focsec.com/

Now of course, if your VPN is a home-lab style VPN where you are connecting to a little wireguard box sitting in your own home, that is a totally different story.

You can do for free with tailscale exit nodes. Just have a friend in a different location host for you or buy some compute space somewhere

That's not the same. You get blocked because the IP address you're coming from is associated with a VPN list, not because they're analyzing the traffic in detail.

The simplest methods block known datacenter IP ranges like you thought. More will score it based on several heuristics and a reputation over time. If you get 100 different users connecting from a single IP, it's probably not someone's home internet connection.

Mozilla VPN runs on Mullvad who are transparent and publish active server and IP lists https://mullvad.net/en/servers.so trivial to block them without blocking all of Azure/GCP/AWS[1]

There are also third party providers of IP annotations to classify known VPN address ranges that content providers typically subscribe to blanket block providers.

The reason for this aggressive approach is streaming apps all need your IP as core signal for tagging your region and all content licensing is region locked (even on YT).

Netflix are/were the most relaxed about it , and for long time would only buy content if they got global distribution rights, but not anymore. Many VPN ads specifically used to market that you can watch Netflix geolocked content.

[1] IME they block DC IPs too although not needed for blocking professional VPN, even self hosted OpenVPN on cloud box usually gets flagged.

My home internet is on a CGNAT, so I experience a lot of the same. Ironically, sometimes a VPN will get through.

Yeah but the state of Utah could just tell them to knock it off because they're the state.

Isn't this kind of what Apple's Private Relay is?

I’ve been using different VPNs for years for work. I’m starting to come around to the value of a residential proxy service.

It’s starting to get annoying that things aren’t working. They’re shooting themselves in the foot though.

If they didn’t block VPNs, they would at least know what category to group them in.

That was what the law attempted to do: Ban porn in Utah.

There is a very vocal anti-porn group in Utah. They do things like put up massive billboards that say "[Store name] sells porn." (Which is basically free advertising instead of shaming.)

There are sooo many people out there who are clamped to something far lower than 1500. MTUs below 1280 are not that exotic either.

On the other hand, using Masque for TCP transfers will probably fool a server to believe the MSS is 1500.

Sounds like the great firewall of China. Pretty wild how much we are regressing in the states to say this out loud.

Let’s block traffic on the internet blindly just in case someone is looking at an adult website.

A lot of law is adjudicated based on the intent, not the black-and-white definition. Proxying your traffic thru a friend's house (VPS in another location, etc) would be considered a "VPN" by a court. Definitional hacks, for the most part, don't fly with judges.

To handle the matter technically Utah would need a "great firewall of Utah" and a legislative mandate that all ISPs route thru it. Somehow they'd have to factor-in signals from cellular sites neighboring states and satellites.

This requires a lot of extra work though, and extra work is downward pressure on the behavior (underage people looking at pornography) that the state of Utah is trying to exert downward pressure on.

The inability to immediately and perfectly eliminate a behavior is not a good enough reason to be against any attempt to eliminate that behavior.

Yes but isn't it suspicious that all your traffic goes to the friend's house and not to Facebook and Reddit? If you claim it is not a VPN does it mean your friend is providing illegal unlicensed hosting? That's even worse.

Or they’re on a computer that’s doing something intensive, swapping, or in low power mode. Or they have a browser extension that does stuff before scripts run. Or their cache is emptier than usual and they’re spending a long time doing an initial fetch of the latest ad tracking package your site installed. The list goes on. That’s far too noisy a signal to decide block-or-not based on. Good enough to try to sell someone faster gear, maybe, but not more than that.