From time to time we get a customer who calls up to order a connection specifically for a VPN. They know exactly what they need. They won't listen. I try to steer them to a less expensive package that is perfectly adequate for a VPN. They'll have none of it. They want a bunch of special add-ons because they have done this all before with other ISPs and they know the ropes. They have no idea how a VPN even works, and they've never even heard of our company before, but they know exactly what they want.

I try to politely point out that I could help them save money and still guarnantee it will work without problems. But I won't argue with the customer. If they want to pay 5x for a bunch of custom stuff they don't need, I can do that.

In the end, they are very happy. They have outsmarted the greedy, conniving ISP, and got themselves a rock-solid service. I make a mental note to try to find a local contact for them with whom we can build a relationship of trust and perhaps persuade down the road that they could actually pay less without compromising their service.

This is not always the case, but it is the most common case.

So when a customer demands a dedicated static IP address, I wonder if they really need that. We charge extra for that because we have a limited pool of public IPv4 addresses. We can do it, but it is usually unnecessary, and better to avoid unless you really need it.

I'd assume they're restricting access further by only allowing certain ips thru a firewall in front of the VPN server, or requiring extra auth factors from unknown ips, or something.

There are other valid reasons for restricting the IP. I ask about those. I'm not arguing with the customer. I'm trying to be helpful.

Unless the customer doesn't want help.

When you have a corporate IT rep who is clueless about the options, they are not in a great position to build the optimal solution.

When you have an ISP rep who is clueless about the requirements, they are not in a great position to build the optimal solution.

When you have an ISP rep who is not willing to explain the options, you have a problem. When you have a corporate IT rep who doesn't know the requirements, is unwilling to explain the requirements, or is unwilling to learn about the options, you are unlikely to achieve the optimal solution.

When you have a helpful and capable ISP rep and a cooperative and capable IT rep, the world is a brighter place. But some levels of trust require either naivety or time and shared experiences. That's difficult when every contact between the customer and the ISP involve different people each time.

So, again, just like everything else, try to work with as small and local of an entity as possible to get the job done. This is true for government, auto dealers, ISPs, or anything else. Only scale up when there is an advantage to doing so.

It's twice the money for half the bandwidth, but I have enough bandwidth and I sleep better at night. Shouldn't be necessary, but . . .

This is a goldmine for ISPs. Over the last five-ish years they decided to think of themselves as "advertising" companies. FCC repealed the internet privacy rule last April, and what are they doing now? They're functioning as data brokers. We should expect this trend to continue and assume that ISPs will take advantage of Pai's NN repeal as soon as possible.

Comcast currently extracts almost $100 a month from me, in addition to the ~$10 I pay for a VPN exit node to hide traffic from their surveillance machine. Why wouldn't they want another $10 or so to "allow" VPNs, given regulators who are loudly, publicly giddy about screwing consumers?

I think the most efficient way to hide your service would be to tunnel it over HTTPS given that it's not really realistic to drop that when you're an ISP. Still, a relatively simple traffic analysis tool won't have too much difficulty differentiating between proper web browsing and something fishy over HTTPS even it it just looks at the shape of the traffic.

It's a 15 minutes task for good admin to start dropping VPN connections (not to block, but to interrupt every 5 minutes, but blocking is even easier).

One important info: - ISP can't see your VPN traffic. But they can see that you are connecting to specific IP (VPN service's IP) at specific port. Once you're connected to VPN you probably pass ALL the connection through it. So ISP can see only single connection to single point. That is more than enough.

So how can they block VPNs: 1) Most VPNs uses standard VPN ports. Just dropping connections to that port is a good start. 2) Dropping connections to a servers when this is your (almost) only, long standing connection. This is a good moment to store that IP as VPN service IP. 3) Reverse DNS on IPs you're connecting to. A lot of services will reveal that they belongs to VPN services. 4) Public list of VPN IPs. Some provides them. Some are already noted somewhere on the internet.

ISPs can even share their databases with each other to be better at VPN dropping.

This is very easy thing to do.

It would be REALLY hard to hide your connection to a VPN service. One thing that came to my mind, to hide your VPN servers you would have to: - use VPN services at random ports - change VPN IP every few minutes at random factor, so dropped connections will occur anyway - in the background you should keep direct (un-VPNed) connections to random servers at random ports, passing random data around (it will look encrypted just like VPN connection)

This would require huge infrastructure though. Really huge.

But still - if ISP notice behavior like that - it means you're probably trying to do something shady, like walk around their VPN dropping rules - so they could just throttle your connections even more, just in case :)

So in general - you're fu^Hat very bad situation. I'm from Europe. I'm "safe" now, but we are also going to have bad law for net neutrality soon.

If we can open up these rules while radically increasing enforcement of quality of service then this might be a good thing. It might be good to replace "up to 75Mbps" with "guaranteed 50-75Mbps and 5-15ms ping to nearest public internet junction, 95% of the time during peak hours." I'm sure some folks might even sign onto world-beating five-nines performance guarantees too.

But this is probably just a dream and we'll see the ugly product differentiation you're describing.

Hell yeah. I would happily pay extra for a decent service that advertised it’s minimum speeds instead of its maximum because in reality, the theoretical maximum speed of my connection is really not a useful metric unless I’m hitting it 99% of the time. I have a fast connection but I still typically get a good 50 Mb/s less than advertised (which luckily still leaves me with 200 Mb/s or so) making the advertised amount completely inconsequential and useless. Telling me the lowest I should expect, on the other hand, is actually helpful and allows me to do some rudimentary capacity planning to see if it’s suitable for me or not.

No.

A 'Netflix QoS package' is not a QoS package. That's against Net Neutrality.

A 'Video Streaming' package that offers high quality video streaming with low latency, but doesn't care about things like picking up dropped packets - and doesn't discriminate between content sources - this would be 'net neutral'.

"Because in order to sell you onto these bullshit packages they will end up making your regular connection hellish"

This is a completely separate issue and has nothing to do with NN really. They can (and probably do) this already today with their regular package offers.

Let's not confuse general ISP stupidity with actual NN.

Net Neutrality doesn't exist any more. Did you not read the article? This isn't hypothetical, it was allowed to expire as of today. It's no longer the law, ISPs can legally do whatever they want now, including a "Netflix QoS package".

I am admittedly not a lawyer, but I'm reasonably well informed on the topic and completely open to being corrected if you know better.

Yes, the US law requiring a certain kind of Network Neutrality did expire.

The point is: service providers charging for differentiated QoS (such as different packages for latency) is well within the concept of Network Neutrality.

What is 'out of bounds' for NN is charing for customers based on the content of those packages.

So:

> A low latency service (designed for gaming in mind), is NN

> A low-latency service 'for games only' - is not NN

> If the ISP charges you money to access 'Steam' games, but not for others - that is not NN.