Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We would like to block users from accessing sites like facebook and all from our network. All the connections are through our router(linux machine). What would be the best way to block the sites on the linux router ?

share|improve this question
2  
Unplug the internet. –  Nerdling Jul 21 '10 at 12:44

3 Answers 3

up vote 9 down vote accepted

I've been using Squid as a transparent proxy and using the proxy to filter access to website and as a local cache. The big advantage of it is that you can rules based on regular expression on the whole URL (meaning you can restrict access to portion of site if you want to).

There's a bunch of good tutorial about it around the web. You can find a somewhat old howto floating around. I have not verified if it's still accurate enough but it was my reference when I learned how to set it up. The Squid website has a good section on how to setup transparent proxying

share|improve this answer
    
+1 Proxying is the only way to do this, just blocking DNS is no solution as the users would simply have to change their DNS server or write down the relevant IP (which they could add to their local HOSTS file if they wanted to). Using a proxy is a far better way to sort this problem. –  Chopper3 Jul 21 '10 at 13:04
1  
on a good network a user shouldnt be able to edit his dns... –  jer.salamon Jul 21 '10 at 13:05
    
Proxying is what you want. I don't like transparent proxies but your mileage may vary. –  coredump Jul 21 '10 at 13:17

DNS filtering works well unless you have smart employees. opendns.com provides you with editable dns.

share|improve this answer

The simplest method is throwing a spanner in the DNS to make sure that sites you don't want showing never resolve. You can do this by using somebody like OpenDNS (there are other services that do the same) or you can keep it local and just edit the local machine's hosts file (which would be enough if your users have limited accounts and no personal computers).

A more robust method involves forcing all web traffic through a proxy like squid and having a filter like dansguardian running on top. The two together do work well and you'll find plenty of tutorials around the web. The issue with this is you'll need a machine to have this installed on - you can't just squeeze it onto a router (unless you have a separate machine as your router).

The added benefit of a proxy is it can cache data at network level to save you some external bandwidth and it can speed things up quite a bit if lots of users are using the same sites.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.