Netflix 4K and v17

Hi,

I solved it as follows:

1. Create/enhance the Netflix FQDN Group with the following FQDNs:

*.nflximg.com
*.nflxvideo.com
*.nflxso.com
*.netflix.com
*.nflxext.com
*.nflximg.net
*.nflxso.net
*.nflxvideo.net

2. Create a dedicated FW rule for NetFlix FQDN Group and your TV:

Services: HTTP & HTTPS

Web Malware: everything disabled

IPS: can be enabled

Web Policy: None

And now the very important hint if it is still not working: Simply retry to play the video after 1-2 minutes if it was not working at first. This is some kind of a bug with the FQDNs, I've opened a thread for this here: First FQDN host resolution happens to late when used in FW rule

Best Regards

Dom Nik

The other thing that we have discovered is that you need to make sure that your TV and your XG are using the same DNS server.  Some ISPs have co-located Netflix streaming boxes so that if you do DNS via the ISP DNS you go to one set of servers and if you do DNS via something else (eg Google, OpenDNS) you get a different set of servers.

Michael Dunn said:

The other thing that we have discovered is that you need to make sure that your TV and your XG are using the same DNS server.  Some ISPs have co-located Netflix streaming boxes so that if you do DNS via the ISP DNS you go to one set of servers and if you do DNS via something else (eg Google, OpenDNS) you get a different set of servers.

Micheal,

Thank you for brining that up.  I've run into that issue too.  Some smart TVs won't "smartly" use your gateway DNS nor let your change its DNS.

Most likely they are doing DHCP and getting the DNS settings from DHCP.  So if they getting their address from the XG I think they should be using the XG as their DNS server and everything is good.  If they are using your home ADSL router's DHCP then they are going to use that as the DNS server, which then will go up however your modem is configured.  At which point you should make sure that you modem and XG are configured the same.  The worst may be things like PVRs and Set Top boxes provided by the telco/cableco.  Since they are only ever intended to work on their network, they could potentially be configured to use some specific DNS server or even worse (ignore DNS and use a completely different mechanism to determine what servers to connect to).

I haven't had time to play with it since I posted so haven't been able to do more testing.  As noted the error was ONLY with 4K programs.  I could watch HD (1080p) all day with no problems.  My first quick thought is that Netflix keeps chunks on different servers (for caching) and my show switched to a different server to finish.  That is just a guess.

The LG is DHCP handled by the XG firewall and uses my ISP DNS.

I might try to force a Google DNS when I test again. I will also try the specific exclusions listed.  The built-in v17 Netflix exclusion had no affect.

Michael Dunn said:

Most likely they are doing DHCP and getting the DNS settings from DHCP.  So if they getting their address from the XG I think they should be using the XG as their DNS server and everything is good. 

I know for a fact that roku has hard coded google 8.8.8.8/8.8.4.4 dns servers. That is why every beta I ask for the ability to DNAT (which is available in SG) any dns traffic to anywhere back to XG for certain devices. Every device including most IoTs and phones also try to connect to NTP servers all day long all over the place but that is separate discussion although it still comes under my DNAT feature request.

In any case always nice to hear your input Michael.

Michael,

I fully understand this issue. I was saying thank you for bringing it up because I forgot to mention it to Robert Davis.

I have run into this issue on earlier generations of smart TVs built for home users who did not have home networking, because they used cellular internet or were not "connected" at all.  Once they got a smart TV an internet service was now required to be installed or the streaming came through MoCA.

I haven't seen this in 4k models because I'm sure that, by default, they get their instruction from the network router that most homes have now.

Oh god I just looked up Roku dns....  I *think* it actually changes the DNS settings based on the region of the account that is logged in.  There are instructions for non-US people to use DNS tricks to create a US account, which then gets you US-based DNS settings on the Roku.  Which suggests that the region of the Roku account will change what DNS it uses.  Some packet sniffing might prove this.

In any case, the underlying thing issue is:

Netflix (on some devices) will do a DNS lookup and then connect directly to IPs.  These IPs may be owned by Netflix or may be owned by the ISP.

The XG will do DNS lookups (part of FQDN Host Group) to get list of IPs.

If the two lists do not match, then the XG can have problems.

Solution 1)

Make sure they match (use same DNS)

Solution 2)

Have a failing stream.  Look at Web Logs for errors (will be status code 416).   Manually add those IPs to the Netflix FQDN group or Exception (whichever method you are using).

Oh god I just looked up Roku dns....  I *think* it actually changes the DNS settings based on the region of the account that is logged in.  There are instructions for non-US people to use DNS tricks to create a US account, which then gets you US-based DNS settings on the Roku.  Which suggests that the region of the Roku account will change what DNS it uses.  Some packet sniffing might prove this.

In any case, the underlying thing issue is:

Netflix (on some devices) will do a DNS lookup and then connect directly to IPs.  These IPs may be owned by Netflix or may be owned by the ISP.

The XG will do DNS lookups (part of FQDN Host Group) to get list of IPs.

If the two lists do not match, then the XG can have problems.

Solution 1)

Make sure they match (use same DNS)

Solution 2)

Have a failing stream.  Look at Web Logs for errors (will be status code 416).   Manually add those IPs to the Netflix FQDN group or Exception (whichever method you are using).