1

I'm using /etc/hosts to block domains that I don't want to be accessible, and it works for most domains. However it doesn't seem to be working for the Telegram webchat (web.telegram.org).

I have the following lines in my file:

0.0.0.0 web.telegram.org
0.0.0.0 www.telegram.org
0.0.0.0 telegram.org

But I am still able to go on the site and use the full functionality of the web app. Am I doing something wrong?

  • 5
    Checking with a Web browser? Many browsers these days have their own resolvers/caches, not respecting/utilizing the system resolvers/caches. – Christopher Apr 26 '17 at 17:41
  • Yes, the purpose is to make it inaccessible to the web browser. Is there any way around it? It works for gmail, facebook, and other sites. – milo Apr 26 '17 at 18:13
  • 1
    Use your firewall for that job, e.g. iptables: iptables -A OUTPUT --destination www.telegram.com -j DROP – Thomas Apr 26 '17 at 18:19
3

Since you are editing /etc/hosts, you have root access. The best and most elegant way is to use iptables (ie block packets leaving the box to www.telegram.org)

You can test by entering iptables commands on the command line.

# iptables -A OUTPUT -d www.telegram.org -j REJECT

You can see that you added the rule with:

# iptables -S OUTPUT

-P OUTPUT ACCEPT
-A OUTPUT -d 149.154.167.120/32 -j REJECT --reject-with icmp-port-unreachable

And you can test an attempted access to it with:

# wget  web.telegram.org                                                     
--2017-04-26 14:38:01--  http://web.telegram.org/
Resolving web.telegram.org... 149.154.167.120, 2001:67c:4e8:fa60:3:0:811:140
Connecting to web.telegram.org|149.154.167.120|:80... failed: Connection refused.
Connecting to web.telegram.org|2001:67c:4e8:fa60:3:0:811:140|:80... failed: Network is unreachable.

You didn't tell us what OS you are running so you may not have a newer version of iptables and thus you may be lacking the -S switch. You can use -L:

# iptables -L OUTPUT

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             149.154.167.120     reject-with icmp-port-unreachable 

If you want to delete the rule you just added simply replace the -A with -D in the command above.

Note: if you want these rules to be permanent upon reboot you have to do iptables-save > /etc/sysconfig/iptables or manually add them to /etc/sysconfig/iptables.

iptables is quite complicated but the man pages are quite helpful.

(I'm running CentOS 6 and 7 on my servers. firewalld is the new default front-end on CentOS 7 but I installed iptables-services and use it instead which is completely supported.)

  • So it seems that 'wget web.telegram.org' can be blocked by either /etc/hosts or iptables, however Chromium can still easily connect to it. – milo Apr 26 '17 at 20:13
  • Firefox is also unable to connect, but I haven't used telegram on it previously. – milo Apr 26 '17 at 20:13
  • Firefox has the same problem after I open telegram there for the first time. @Christopher you are probably right, but how can I deal with it? – milo Apr 26 '17 at 20:24
  • The IPs for web.telegram.org and www.telegram.org, are blocked by iptables. I think it must get packets from another IP – milo Apr 26 '17 at 20:28
  • Thanks, added 2 more IPs, and now the app can't connect! – milo Apr 26 '17 at 20:46
1

BTW, I'd be setting the host to be 127.0.0.1 instead of 0.0.0.0....this might be your original problem.

Anyway another trick is to add a special route for the offending IP number(s):

 # route add -host 10.11.12.13 dev lo

You'd have to add these into your rc.local (or equivalent) so that these rules are recreated at reboot time.

I used this to block people who attempted password cracking for my website company.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.