I want to block some https website like youtube.com, facebook.com.

I know that we can't block that using url rules. since the url is encrypted.

So I tried to block all DNS queries which contain the domain I want to filter. So I added the following rule:

iptables -A OUTPUT -p udp --dport 53 -m string --domain yahoo.com -j DROP

But the youtube keep running. But after some time of inactivity (about 15 min) youtube is blocked.

Are there some explanation?

How I can force youtube to be blocked immediately?

  • 1
    Messing up with DNS in that way is not a good idea. Have a look at transparent proxies. – Rui F Ribeiro Jan 29 '18 at 17:53
  • To add to @RuiFRibeiro comment, have a look at this study on DNS censorship: afnic.fr/medias/documents/conseilscientifique/… – Patrick Mevzek Jan 31 '18 at 2:18
  • As for DNS filtering directly with iptables (for the case where you really need it like facing a DDOS attack) it is far more complicated than your simple rule. First you need to handle UDP and TCP. Then, DNS messages have compressed parts and hence their elements do not have a fixed predefined position in the packet, making filtering a complicate manner. – Patrick Mevzek Jan 31 '18 at 2:20
  • @PatrickMevzek IMO, the best part of the document is the Conclusion. – Rui F Ribeiro Jan 31 '18 at 9:00

But the youtube keep running. But after some time of inactivity (about 15 min) youtube is blocked.

This is likely to do with caching the response. If I've already asked some nameserver for the address of example.com only 5 minutes ago, I'm fairly sure it hasn't changed. yahoo.com IN A has a Time-to-live (TTL) of 21 minutes so the record can be cached up-to 21 minutes in this case.

Filtering HTTPS traffic isn't an easy task since any information can be contained within the TLS stream, even a connection to a proxy server where your filter isn't active.

One option would be to block all packets to the IP address(es) corresponding to example.com. This would probably suit what you want, but say if example.org is a website on the same IP address(es), then you unintentionally block that too.

If you are the administrator of the machine that these requests are originating from, then there are many more options, however iptables wouldn't be of any use in those situations as it will only be in contact with TLS traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.