posted in Selfhosted

UK/EU homelabbers: would you host a hardened Pi so I can watch baseball I already pay for?

Unusual request, so let me be straight about what it is before I ask for anything.

The short version: I pay for MLB.tv, but the league geo-restricts games depending on the IP you watch from. The one setup that unlocks every game (no local blackouts, and none of the “this game is a Netflix/Roku/Peacock exclusive” carve-outs) is MLB.tv International, which needs a UK or EU IP. I’ve built a small Raspberry Pi that lets my stream appear to originate from a home internet connection over there, and I’m looking for someone willing to plug one into a spare ethernet port and forget it exists.

The honest part: this works around MLB’s geo-restrictions, which is against their terms of service. I’m doing it with a fully paid subscription to watch games I’ve already paid for, but if that’s not something you want on your connection, totally fair, no hard feelings, stop reading here. I’d rather you pass than feel misled.

Still with me? Here’s everything.

First, the thing you actually care about: it barely touches your connection

It is NOT a 24/7 relay, and it does NOT stream whole games through your line. MLB only checks your location at the moment a stream starts. So my usage is:

  • I switch it on only at game time, for a game I’m actually blocked from.
  • The stream starts, the check passes, and after under ~5 minutes I switch it back off
  • The game then keeps playing over my own connection, not yours.

Net effect on you: a WireGuard handshake and a few minutes of video per game I watch. A few MB, not hours. I use a Home Assistant script to enable/disable the VPN Client in UniFi, so it’s guaranteed to shut off after a few minutes. No accidentally leaving it on forever and using your connection

Why a residential UK/EU IP, specifically

I’ve already done the homework, and residential is the only door left open:

  • I already run this through a family member’s connection in the US, and it works flawlessly. But a US IP still leaves me blocked from national-broadcast games (the ESPN/Fox/Peacock/Apple/Netflix exclusives), because those are carved out of US MLB.tv at the product level no US IP fixes them. MLB.tv International has no such carve-outs, hence UK/EU.
  • Commercial VPNs are blocked. I tried Mullvad, Proton, Nord and others… MLB blocks their IP ranges outright; streams fail to start.
  • Datacenter/VPS IPs are blocked too. Hetzner, OVH, etc… same story, flagged as non-residential and refused.

A real residential connection is the only thing MLB treats as a legitimate viewer. That’s why I need a person with a spare port, not a server I can rent.

How it works (the technical bit)

  • The Pi runs WireGuard, dialing outbound to a small cloud relay I rent (it never listens for inbound, so your router never needs to forward a port to it).
  • It also runs Tailscale as an independent, outbound-only management door, so I can maintain it without ever asking you to touch it.
  • The OS is a hardened Raspberry Pi: deny-all-inbound firewall, key-only SSH, no passwords over the wire, automatic security updates, and self-healing tunnel watchdogs.
   [ my home, Starlink / CGNat ]  
          │   WireGuard  (encrypted, outbound)  
          ▼  
   [ small VPS I rent ]   ◀─ only forwards encrypted frames; sees nothing  
          │   WireGuard  (encrypted)  
          ▼  
   [ My Pi in your home ]   ── dials OUT only, never listens; firewall blocks your LAN entirely  
          │  
          ▼  
   [ your home internet ]  ──▶  MLB.tv  (only ever sees your residential UK/EU IP)  

   ( my paid stream flows back up the same path to my TV — I switch the tunnel  
     off after the first few minutes, so most of it never crosses your line )  

What I’d send, and what you’d do

A Raspberry Pi in a small case. You give it power (~3–5 W, ~£0.50/month of electricity) and one ethernet port. That’s the entire job… no router config, no port forwarding, no software on your devices, no accounts.

What it can’t do on your network

The firewall denies all inbound, and for forwarded traffic it drops every private-network destination before allowing anything out. In plain terms: traffic from my tunnel physically cannot reach your LAN… not your PCs, NAS, printer, or router admin page. It can only reach the public internet.

Two things make trusting me cheap:

  • Put it on a guest/IoT VLAN if you have one. Isolating it costs it nothing and then the guarantee above is enforced by your gear, not my word.
  • Unplug it whenever. Nothing on your end depends on it.

Trust but verify

Send me your SSH public key and I’ll set you up a read-only account. One command, sudo host-verify, prints the live firewall rules, the tunnel status, and every connection the box currently has open — so you can confirm all of the above any time. That account can’t change anything or reach the rest of the box; it’s there purely so you don’t have to trust me blind. Happy to walk through the whole config with you too.

What’s in it for you

Mostly my genuine gratitude willingness to reciprocate in kind: host something for you, help on a homelab project, or whatever feels fair.

If you’re in the UK or EU and up for it (or just have questions) reply or DM. Cheers, and thanks for reading either way.

enPage

Replying to @⁨BuckFutter@timeyak.com⁩

I believe, from long-ago reading, that you can pick a region. I don’t use it myself, though.

EDIT: Sounds like it.

forum.torproject.org/t/…/14080

How to select certain country for exit node?

You need to modify your torrc and use ExitNodes.

It allows the use of fingerprints (if you want to use a specific exit relay) or country codes, which is what you are looking for.

Note the following warning from the man page:

Note that if you list too few nodes here, or if you exclude too many exit nodes with ExcludeExitNodes, you can degrade functionality. For example, if none of the exits you list allows traffic on port 80 or 443, you won’t be able to browse the web.

Tor Project ForumHow to select certain country for exit node?I want to use Tor Browser (on Windows 10). It works. However I found currently no way to define a certain country for the exit node. How can I achieve this (in Tor Browser)?

Replying to @⁨habitualTartare@lemmy.world⁩

en.wikipedia.org/…/Wikipedia:Signs_of_AI_writing

That’s the probably most unhelpful and stupid thing I saw in quite some time. The AI or Not Quiz right at the beginning in particular regularly links the exact same things to human or to AI (404 links are a sign or AI hallucination or just natural link decay that show it’s from a human; wonky grammar is a sign for AI unless the text is human-written where it’s just bad english that LLMs would not produce intentionally…).

Yes, spotting AI by clear attributes isn’t easy. If it was those points would be changed first in training of AI. But lengthily discussing tell–tale signs then interpreting them in contrary ways depending on source is absolute bullshit.

en.wikipedia.orgWikipedia:Signs of AI writing - Wikipedia

Replying to an earlier post

What it basically comes down to is this: do I trust some random guy off the Internet to use my Internet connection which is tied to my legal government name and the legal reprocussions that comes with that to access the Internet as if they were me?

The only way I would do that is if I gave it its own vlan and only allow Internet traffic to specific whitelisted ips. Even then my legal protection insurance definitely won’t cover that.

Replying to an earlier post

“MLB only checks your location at the moment a stream starts.”

This is/was what Pandora.com did, and the solution was to run a small proxy that directed the exact login url through Tor with a Merican endpoint while stream was normal, but you can just select an EU/UK endpoint instead.

I used a Tor proxy - privoxy, I think - from the openwrt package repo, but others exist, and for other platforms…

Replying to an earlier post

This seems like the perfect scam for Lemmy for setting up a fresh IP for launching a cyber attack/scam with a real residential IP. Helping a community member while circumventing shitty corporations. (Not saying OP is, just that it would be a decent scam)

This requires either an insane amount of trust in a random person or gullibility. Plugging a random mailed device into your network, even behind a VLAN.

I definitely would never do this if I didn’t have absolute full and complete access to every part of the pi’s software, or preferably set it up myself (optionally in collaboration with the requester) and the requester only had read-only access to it.

Replying to @⁨JustEnoughDucks@slrpnk.net⁩

That or AI scraping. (It was a game I was wrong)

xda-developers.com/smart-tv-apps-residential-prox…

XDAThat innocent-looking game on your smart TV might be quietly routing someone else's internet traffic through your homeThousands of smart TV apps contained proxy software that could route strangers’ internet traffic through unsuspecting users’ home connections.

Replying to an earlier post

This is a cool idea, and I love the hacker energy behind it, but I agree with some of the other comments that the receiver would have to trust you quite a bit to allow hardware into their house. Even with the SSH view-only accounr, you could be putting the SSH server in a VM so that the client thinks they’re seeing the whole OS but they aren’t.

Alternative idea would be to provide an open source ansible script or docker compose file to spin up everything you need, and let them verify and deploy it themselves. Then they give you the wireguard configs to remote in.

Replying to @⁨blueduck@piefed.social⁩

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters SSH Secure Shell for remote terminal access VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)

[Thread #88 for this comm, first seen 26th Aug 2026, 14:50] [FAQ] [Full list] [Contact] [Source code]

Hachyderm.ioImran Nazar ~ عمران نزر (@Two9A@hachyderm.io)2.93K Posts, 306 Following, 268 Followers · Front-end #typescript developer and general keyboard tapper; author of Internet RFC 7168 (Hypertext Coffeepot Control Protocol for teapots); occasional plumber, more than occasional #c64 #retrocomputing enthusiast, terrible at classical #piano. Header photo is a verdant scene looking over the landscape near Buxton, England, taken from a single-track country road.

Replying to @⁨blueduck@piefed.social⁩

Honestly i feel like i would trust a custom application for this more than random hardware.

Something like Cloudflares warp bit for this where the hoster approves what you get access to.

Warp is(probably) boringtun <-> smoltcp <-> pingora.

Edit. As many have said pirating is easier.

And the application would have to allow list IPs and tls retermination too since sni could be forged.

Well it could be fine with sni validation and target IP filtering, but I still don’t like the idea