Note: I wrote this hours ago, but I am in Sandy's path so I walked away and forgot to press the submit button
So there are two ways to accomplish this, and both do something different. It is going to be impossible to truly block Facebook as anyone could use a proxy site and get around your restrictions. They could also SSH tunnel out to a server that isn't restricted. None-the-less here we go...
bash$ sudo iptables -A OUTPUT -p tcp -d 184.108.40.206 --dport 443 -j REJECT
bash$ sudo iptables -A OUTPUT -p tcp -d 220.127.116.11 --dport 443 -j REJECT
bash$ sudo iptables -A OUTPUT -p tcp -d 18.104.22.168 --dport 443 -j REJECT
bash$ sudo iptables -A OUTPUT -p tcp -d 22.214.171.124 --dport 443 -j REJECT
bash$ sudo iptables -A OUTPUT -p tcp -d 126.96.36.199 --dport 443 -j REJECT
Downside is this doesn't stop Facebook from adding a new IP address for facebook.com to resolve to. You could write a script to constantly run and get the latest:
for i in $(host facebook.com | grep "has address " | cut -d' ' -f4)
do iptables -A OUTPUT -p tcp -d $i --dport 443 -j REJECT
Note: this does need a little modification as it can produce errors
This solution isn't perfect either. DNS is just the base of the naming system, hitting the IP address directly would win. If you own the Internal name server for your network, you could setup an entry for facebook.com to resolve somewhere else. I'd use this in conjunction with the iptables one above.
sslstrip -- not recommended at all
We could even go one step further. If you own all the machines in the network that you are trying to block facebook for, you could generate a Root CA certificate, install the public key on all the machines. Man-in-the-middle all SSL traffic resign all websites with your certs and actively kill facebook connections. However, this is a dangerous idea and has privacy implications (especially in a corporate environment).