Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up a home server to work as a router/NAT. This is done with IPtables forwarding rule.

Now I'd like to block certain websites, like facebook. I thought I could just add to /etc/hosts on the server, but the client (my) computer could still access/ping the domain.

I'm also running bind, maybe it could be done with that? Thanks for you help.

share|improve this question

closed as off-topic by Falcon Momot, Ward, MDMarra, Bryan, Scott Pack Jul 6 '13 at 13:00

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about hardware or software used in a home setting are off-topic because they require answers that may not be practical for the business and support professionals here. You should try asking on Super User instead." – Falcon Momot, Ward, MDMarra, Bryan, Scott Pack
If this question can be reworded to fit the rules in the help center, please edit the question.

And if anyone is curious, I'd like to block facebook to stop me from checking it all the time :( – Znarkus Jun 8 '11 at 13:59
up vote 1 down vote accepted

(Assuming bind is the DNS server on the router, and that your computer is using said router for DNS resolution. Edit: If your computer is using your ISPs DNS servers directly, this won't work at all. Skip to the iptables section.)

Bind isn't going to use the local server's /etc/hosts to find out what facebook is. If you want to break facebook you'd need to tell bind that it's authoritative for the domain, and set up a zonefile with (for example) as the A record for and

A simpler approach might be to add iptables rules for the IPs used by facebook.

iptables -I FORWARD -s <computer IP> -d -p tcp -j REJECT
iptables -I FORWARD -s <computer IP> -d -p tcp -j REJECT
iptables -I FORWARD -s <computer IP> -d -p tcp -j REJECT

That or self-control :-P.

share|improve this answer
I vote for self-control. – wolfgangsz Jun 8 '11 at 14:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.