How to block https facebook site using iptables [duplicate]

Question

Possible Duplicate:
iptables to block https websites

I am using Zentyal Os as a firewall, it working fine like blocking http sites and but I am not able to block https facebook site. My only aim is need to block https facebook site, like need to block 443 port.

So is there any chance control using iptables with transparent mode.

Please anyone help me to resolve.

Answer 1

this rule should work for you

iptables -A OUTPUT -d facebook.com -dport 443 -j REJECT --reject-with tcp-reset

EDIT: if your version of iptables for some reason doesnt like urls in place of address you can do something like this since facebook can resolve to multiple ips:

 for blockip in `resolveip facebook.com | cut -d " " -f 6`; do
 iptables -A OUTPUT -o eth0 -p tcp -m tcp -d $blockip -j REJECT --reject-with tcp-reset
 done

Answer 2

As I believe zentyal comes with integrated support for the snort IDS, you could add a snort rule that detects and blocks the SSL packet which contains the server certificate based on a common name that contains facebook.com. That could also address accesses through a proxy (as long as the connection to the proxy itself is not encrypted).

Another approach could be to force all DNS traffic through your DNS server (block domain traffic except to your DNS server) and return something bogus for queries of any facebook.com domain (would not stop access through a proxy though).

Answer 3

Note: I wrote this hours ago, but I am in Sandy's path so I walked away and forgot to press the submit button

So there are two ways to accomplish this, and both do something different. It is going to be impossible to truly block Facebook as anyone could use a proxy site and get around your restrictions. They could also SSH tunnel out to a server that isn't restricted. None-the-less here we go...

iptables

bash$ sudo iptables -A OUTPUT -p tcp -d 69.171.247.21 --dport 443 -j REJECT
bash$ sudo iptables -A OUTPUT -p tcp -d 66.220.149.88 --dport 443 -j REJECT
bash$ sudo iptables -A OUTPUT -p tcp -d 66.220.152.16 --dport 443 -j REJECT
bash$ sudo iptables -A OUTPUT -p tcp -d 69.171.234.21 --dport 443 -j REJECT
bash$ sudo iptables -A OUTPUT -p tcp -d 69.171.237.16 --dport 443 -j REJECT

Downside is this doesn't stop Facebook from adding a new IP address for facebook.com to resolve to. You could write a script to constantly run and get the latest:

#!/bin/bash
for i in $(host facebook.com | grep "has address " | cut -d' ' -f4)
do iptables -A OUTPUT -p tcp -d $i --dport 443 -j REJECT
done

Note: this does need a little modification as it can produce errors

dns

This solution isn't perfect either. DNS is just the base of the naming system, hitting the IP address directly would win. If you own the Internal name server for your network, you could setup an entry for facebook.com to resolve somewhere else. I'd use this in conjunction with the iptables one above.

sslstrip -- not recommended at all

We could even go one step further. If you own all the machines in the network that you are trying to block facebook for, you could generate a Root CA certificate, install the public key on all the machines. Man-in-the-middle all SSL traffic resign all websites with your certs and actively kill facebook connections. However, this is a dangerous idea and has privacy implications (especially in a corporate environment).