Blocking telegram using /etc/hosts

Question

I'm using /etc/hosts to block domains that I don't want to be accessible, and it works for most domains. However it doesn't seem to be working for the Telegram webchat (web.telegram.org).

I have the following lines in my file:

0.0.0.0 web.telegram.org
0.0.0.0 www.telegram.org
0.0.0.0 telegram.org

But I am still able to go on the site and use the full functionality of the web app. Am I doing something wrong?

Answer 1

Since you are editing /etc/hosts, you have root access. The best and most elegant way is to use iptables (ie block packets leaving the box to www.telegram.org)

You can test by entering iptables commands on the command line.

# iptables -A OUTPUT -d www.telegram.org -j REJECT

You can see that you added the rule with:

# iptables -S OUTPUT

-P OUTPUT ACCEPT
-A OUTPUT -d 149.154.167.120/32 -j REJECT --reject-with icmp-port-unreachable

And you can test an attempted access to it with:

# wget  web.telegram.org                                                     
--2017-04-26 14:38:01--  http://web.telegram.org/
Resolving web.telegram.org... 149.154.167.120, 2001:67c:4e8:fa60:3:0:811:140
Connecting to web.telegram.org|149.154.167.120|:80... failed: Connection refused.
Connecting to web.telegram.org|2001:67c:4e8:fa60:3:0:811:140|:80... failed: Network is unreachable.

You didn't tell us what OS you are running so you may not have a newer version of iptables and thus you may be lacking the -S switch. You can use -L:

# iptables -L OUTPUT

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             149.154.167.120     reject-with icmp-port-unreachable 

If you want to delete the rule you just added simply replace the -A with -D in the command above.

Note: if you want these rules to be permanent upon reboot you have to do iptables-save > /etc/sysconfig/iptables or manually add them to /etc/sysconfig/iptables.

iptables is quite complicated but the man pages are quite helpful.

(I'm running CentOS 6 and 7 on my servers. firewalld is the new default front-end on CentOS 7 but I installed iptables-services and use it instead which is completely supported.)

Answer 2

BTW, I'd be setting the host to be 127.0.0.1 instead of 0.0.0.0....this might be your original problem.

Anyway another trick is to add a special route for the offending IP number(s):

 # route add -host 10.11.12.13 dev lo

You'd have to add these into your rc.local (or equivalent) so that these rules are recreated at reboot time.

I used this to block people who attempted password cracking for my website company.