iptables to block https websites

Question

I wish to block a few websites that also run upon https, like facebook, twitter, and gmail, in my organization. Squid is not supposed to be used here as per the orders from higher management. We can use Untangle Lite Package and iptables.

Is there any option other than Squid to do this? Also some iptables rule to block this kind of traffic would be really helpful.

I found this

iptables -t filter -I INPUT -m string --string facebook.com -j LOG --algo bm
iptables -t filter -I INPUT -m string --string facebook.com -j REJECT --algo bm

but https still works on machines except the local machine.

Answer 1

Instead of matching based on the URL, try matching based on contents of the certificate.

iptables -t nat -I INPUT --sport 443 -m string \
                 --string www.facebook.com --algo bm -j REJECT

You can also match on the fingerprint but if the destination changes or updates their certificate, it will invalidate your rule.

Answer 2

The firewall cannot control which HTTPS URLs the client is trying to access, because the URL is encrypted. The firewall can only control which sites the client is connecting to, using IP addresses, but this doesn't help if the HTTP and HTTPS versions of the site are at the same URL (and even if they aren't, you'd have to maintain a huge list of IP addresses).

The only realistic way to block HTTPS is to block it altogether. Insist that all connections must be valid HTTP (i.e. the client starts by sending an HTTP line, and so on). This can't be done with just IPtables, you need an actual protocol-aware proxy such as Squid. (I don't know what Untangle Lite is capable of.)

You can block most HTTPS traffic by blocking outgoing traffic to port 443, since almost all HTTPS servers are on that port. Or, following a whitelist approach, only allow outgoing traffic to port 80 (the normal HTTP port).

A different approach would be to proxy all HTTP and HTTPS connections. Then you can match by URLs. This require conducting a man-in-the-middle attack on the clients. You can do that if you deploy your own certification authority to all client machines and register it there as a root of trust. This may be considered unethical.

No matter what you do, determined users will set up a proxy outside your environment and run IP over HTTP or something like that.

You appear to be either trying to fix a social problem with technical means, which hardly ever works, or to be doing your best to implement a silly requirement from management (in which case, I'd go with blocking port 443, perhaps only for certain IPs, which would allow you to report that you've done your job, no matter how useless).

Answer 3

I know of one option.

If you have internal DNS servers for use, then put some static references in your TLD zone data that resolve the domains (that you do not wish to establish the outside connections) to just 127.0.0.1. This way, all the hosts using the central DNS within your network will resolve ( facebook.com/twitter.com per se) domains into loopback address, which will lead nowhere.

This will work if you have total authoritative control on your network's client machines resolver configuration. If the workstations/clients have permissions to change/edit either /etc/hosts, or /etc/resolv.conf then they may circumvent this option.

Answer 4

An option is to blackhole routes to network blocks: (Listed are for FB)

ip route add blackhole 69.171.224.0/19
ip route add blackhole 74.119.76.0/22 
ip route add blackhole 204.15.20.0/22
ip route add blackhole 66.220.144.0/20
ip route add blackhole 69.63.176.0/20
ip route add blackhole 173.252.64.0/18

Answer 5

Plain content filter can not block ssl site.

Use intrusion protection tools like snort/suricata.

Sample IPS rule : For blocking ssl URLS for specific IP address.

drop ip any 443 -> 192.168.3.30 any (content:".facebook.com"; msg:"Simplewall Ssl block for User30 : Urls => .facebook.com " sid:26648513;rev:1;)

drop ip any 443 -> 192.168.3.30 any (content:".fbcdn.net"; msg:"Simplewall Ssl block for User30 : Urls => .fbcdn.net " ;sid:11469443;rev:1;)

drop ip any 443 -> 192.168.3.30 any (content:".youtube.com"; msg:"Simplewall Ssl block for User30 : Urls => .youtube.com " ;sid:13989722;rev:1;)

Download Simplewall : In simplewall policy rules shared by Squid + Suricata IPS.

Answer 6

You should put this on FORWARD chain, e.g.

iptables -I FORWARD  -m string --string "facebook.com" \
                     --algo bm --from 1 --to 600 -j REJECT

It will affect other systems on the network, except firewall.