I'm using /etc/hosts to block domains that I don't want to be accessible, and it works for most domains. However it doesn't seem to be working for the Telegram webchat (web.telegram.org).

I have the following lines in my file: web.telegram.org www.telegram.org telegram.org

But I am still able to go on the site and use the full functionality of the web app. Am I doing something wrong?

  • 5
    Checking with a Web browser? Many browsers these days have their own resolvers/caches, not respecting/utilizing the system resolvers/caches. Apr 26, 2017 at 17:41
  • Yes, the purpose is to make it inaccessible to the web browser. Is there any way around it? It works for gmail, facebook, and other sites.
    – milo
    Apr 26, 2017 at 18:13
  • 1
    Use your firewall for that job, e.g. iptables: iptables -A OUTPUT --destination www.telegram.com -j DROP
    – Thomas
    Apr 26, 2017 at 18:19

3 Answers 3


Since you are editing /etc/hosts, you have root access. The best and most elegant way is to use iptables (ie block packets leaving the box to www.telegram.org)

You can test by entering iptables commands on the command line.

# iptables -A OUTPUT -d www.telegram.org -j REJECT

You can see that you added the rule with:

# iptables -S OUTPUT

-A OUTPUT -d -j REJECT --reject-with icmp-port-unreachable

And you can test an attempted access to it with:

# wget  web.telegram.org                                                     
--2017-04-26 14:38:01--  http://web.telegram.org/
Resolving web.telegram.org..., 2001:67c:4e8:fa60:3:0:811:140
Connecting to web.telegram.org||:80... failed: Connection refused.
Connecting to web.telegram.org|2001:67c:4e8:fa60:3:0:811:140|:80... failed: Network is unreachable.

You didn't tell us what OS you are running so you may not have a newer version of iptables and thus you may be lacking the -S switch. You can use -L:

# iptables -L OUTPUT

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere        reject-with icmp-port-unreachable 

If you want to delete the rule you just added simply replace the -A with -D in the command above.

Note: if you want these rules to be permanent upon reboot you have to do iptables-save > /etc/sysconfig/iptables or manually add them to /etc/sysconfig/iptables.

iptables is quite complicated but the man pages are quite helpful.

(I'm running CentOS 6 and 7 on my servers. firewalld is the new default front-end on CentOS 7 but I installed iptables-services and use it instead which is completely supported.)

  • So it seems that 'wget web.telegram.org' can be blocked by either /etc/hosts or iptables, however Chromium can still easily connect to it.
    – milo
    Apr 26, 2017 at 20:13
  • Firefox is also unable to connect, but I haven't used telegram on it previously.
    – milo
    Apr 26, 2017 at 20:13
  • Firefox has the same problem after I open telegram there for the first time. @Christopher you are probably right, but how can I deal with it?
    – milo
    Apr 26, 2017 at 20:24
  • The IPs for web.telegram.org and www.telegram.org, are blocked by iptables. I think it must get packets from another IP
    – milo
    Apr 26, 2017 at 20:28
  • Thanks, added 2 more IPs, and now the app can't connect!
    – milo
    Apr 26, 2017 at 20:46

BTW, I'd be setting the host to be instead of might be your original problem.

Anyway another trick is to add a special route for the offending IP number(s):

 # route add -host dev lo

You'd have to add these into your rc.local (or equivalent) so that these rules are recreated at reboot time.

I used this to block people who attempted password cracking for my website company.


it's using websockets to get messages

add zws2.web.telegram.org

P.S. check how to debug websockets in chrome devtools

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.