Bypass Netflix sharing policy with WireGuard

There is an easy way to bypass Netflix sharing policy, where you would normally get this message when trying to access Netflix from another location.

What do we need?

• Linux server to install Wireguard
• Internet connection
• Access to router configuration page (could be for example 192.168.1.1)

That’s all? Yes that is all we need now lets set up our Linux server with WireGuard. We will trick Netflix that whenever we watch Netflix that we are watching it from home.

I have a Proxmox environment at home but you could use Raspberry or an old computer, this won’t make the PC / Pi go crazy on disk/cpu/ram usage.

Choose your distro, in my case I am going to use Debian.

sudo apt update
sudo apt install wireguard
sudo apt install iptables

Now let’s generate some keys so we can start the WireGuard service.

Grab the private key and public key and write it down somewhere you will need in the next configuration.

wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee
/etc/wireguard/publickey

Check the interface name of our server we need the name to add it to the configuration file:

ip -o -4 route show to default | awk '{print $5}'

Let’s create the configuration file now:

nano /etc/wireguard/wg0.conf

Add the following, adjust the IP range as you wish. (eth0 should be the name of your interface, you get that with the command above)

Set Privatekey that you generated before.

[Interface]
Address = 10.0.0.1/24
SaveConfig = true
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j
MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j
MASQUERADE

Let’s start the wireguard with wg0 configuration

wg-quick up wg0

Output should be something like this:

[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.0.1/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j
MASQUERADE

Running the command “wg show wg0” will show more information such as currently connected peers and how much data is going trough the vpn.

Now let’s add the ipv4 forwarding so the clients can connect and have internet access though the server.

sudo nano /etc/sysctl.conf

// net.ipv4.ip_forward=1 > net.ipv4.ip_forward=1 (remove comment "//")

sysctl -p

net.ipv4.ip_forward = 1

Now when this is done we can now create a client configuration file.

nano /etc/wireguard/wg1.conf

You can use wg genkey to generate client keys as well.

umask 077 && wg genkey | tee /home/user/keys/privatekey | wg pubkey > /home/user/keys/publickey

Now in the configuration file let’s add those keys paste the following info and change the key and IP.

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY (you can find it under /home/user/keys/privatekey)
Address = 10.0.0.2/24
DNS = 1.1.1.1, 8.8.8.8
[Peer]
PublicKey = SERVER_PUBLIC_KEY 
Endpoint = SERVER_IP_ADDRESS:51820 (this is server IP adress in this case you public IP from your router to find out your IP vist "https://ipv4.icanhazip.com/"
AllowedIPs = 0.0.0.0/0

Now we used 10.10.0.1 for the WireGuard server and 10.10.0.2 for the client, to allow that client to connect run the following command.

wg set wg0 peer CLIENT_PUBLIC_KEY allowed-ips 10.0.0.2

Perfect now we have one last step and that is to port forward our server so you can give this configuration to someone who is using your Netflix.

Open up your router configuration page you can find this in cmd / terminal by running ipconfig or ip a in my case my IP is 10.10.0.1

Navigate to Port forward and add the following rule. Change the IP to your server IP now this should be your local IP.
Default port for wireguard is: 51820

To change the port go to your wg0 configuration and change the ListenPort = 51820 to your preferred IP.

Last part is to connect to the VPN, keep in mind you can’t connect to this VPN when you are on the same network, so to try this out let’s connect to the VPN from our phone with 4g network.

Let’s install qrencode so we can generate qr code for the configuration.

apt install qrencode

qrencode -t ansiutf8 < /etc/wireguard/wg1.conf

Install WireGuard on your phone and add a tunnel with QR code, scan the generated QR code and go to https://ipv4.icanhazip.com/ you should have same IP as your devices that are running at home.

So now, let’s say your brother that lives in an other city wants to use the same Netflix. You just need to guide him to install WireGuard on his android tv / android box / phone / computer does not matter what device and give him the QR code. Make sure he is connected to the VPN whenever he wants to watch Netflix. With other words, you are now in the same “house” with the same IP.