This has to be a false statement. Some sites blacklist subnets they believe to belong to VPN services, that's true. No web site has the information to know the difference between a tunneled packet and a non-tunneled packet. They could try looking at MTU but then they'd block all sorts of "legitimate" traffic due to use of PPPoE and so on inside ISP networks.

I assume you mean a "Proxy as a Service" when you say "VPN," right?

Without that focus, web sites would have a lot of trouble identifying IP traffic routed over a personal VPN from any other traffic. I suppose they could just block entire clouds, for those who run VPN servers on AWS, Azure, et al. But that would cause a lot of other problems.

I just route all of my devices through a single node I run at one physical location that appears like a genuine client node. I've never seen anything blocking it.

The one specific example I'm aware of is Delta Airlines seemingly blocking traffic that exits from my Digital Ocean droplet running OpenVPN... a service that, annoyingly, I mostly use when I am traveling and on public access points.

Because unfortunately bots hide behind them in mass and the easy way of handling that is to block the VPN ips.

Is this true for self-operated VPNs? I run an openVPN instance on an old laptop in my apartment that also handles a pi hole instance and a minecraft server -- I'd think that any "VPN blocking" could apply to VPNs as a service, but not a VPN that I rolled and hosted myself.

You never get captchas and other annoying "security" measures when using openvpn? I get them all the time, but I assume that it's because the IP addresses are from mullvad and not as trusted as your ISP. What you have is a good setup for working in various untrusted environments but it's not the same for those people who do torrenting or say skipping past oppressive governments where they're trying to be anonymous via VPN.

I'm self-hosting a VPN server on Digital Ocean, and whenever I'm using it, some websites notice that my IP address belongs to a hosting provider, so I start to get lots of CAPTCHAs. So yes, at least Google and Cloudflare detect that.

Just curious, how do they detect the fact that the connection is from a VPN? Are they subscribing to IP blacklists, or is there some other method?

IP addresses are assigned in blocks, and these blocks are assigned to registered companies - Long story short you can roughly determine whether an IP address is from a datacenter or is "residential" without too much issue - All DigitalOcean droplets are given IP addresses within DO's range for example.

Basically if the IP is from a datacenter - it's likely a VPN.

Yes, it's IP blacklists AFAIK.

And for sites with a lot of traffic, you probably don't even need an external subscription, you can deduce the ranges yourself simply by checking for IP addresses that wind up having logged-in users from all over the world in a short time frame.

Pretty easy to do accurately with a short set of heuristics.

Many geo-ip services also offer VPN or server detection (e.g. is the IP in one of the EC2 ranges).

In a previous job at an online gambling company we found that a large percentage of fraudulent user accounts came from VPNs so ended up banning them at the geo lookup stage.

Easy. How many users are logging in from the same IP address is a big clue.

Also some non-web services can act weirdly with them. In my personal experience Google's voice to text including Assistant commands and transcription often just fails to go through, or takes tens of seconds to get a response over a VPN.