Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've set up a home server to work as a router/NAT. This is done with IPtables forwarding rule.

Now I'd like to block certain websites, like facebook. I thought I could just add facebook.com to /etc/hosts on the server, but the client (my) computer could still access/ping the domain.

I'm also running bind, maybe it could be done with that? Thanks for you help.

share|improve this question
And if anyone is curious, I'd like to block facebook to stop me from checking it all the time :( –  Znarkus Jun 8 '11 at 13:59
add comment

closed as off-topic by Falcon Momot, Ward, MDMarra, Bryan, Scott Pack Jul 6 '13 at 13:00

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about hardware or software used in a home setting are off-topic because they require answers that may not be practical for the business and support professionals here. You should try asking on Super User instead." – Falcon Momot, Ward, MDMarra, Bryan, Scott Pack
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 1 down vote accepted

(Assuming bind is the DNS server on the router, and that your computer is using said router for DNS resolution. Edit: If your computer is using your ISPs DNS servers directly, this won't work at all. Skip to the iptables section.)

Bind isn't going to use the local server's /etc/hosts to find out what facebook is. If you want to break facebook you'd need to tell bind that it's authoritative for the facebook.com domain, and set up a zonefile with (for example) as the A record for facebook.com and www.facebook.com.

A simpler approach might be to add iptables rules for the IPs used by facebook.

iptables -I FORWARD -s <computer IP> -d -p tcp -j REJECT
iptables -I FORWARD -s <computer IP> -d -p tcp -j REJECT
iptables -I FORWARD -s <computer IP> -d -p tcp -j REJECT

That or self-control :-P.

share|improve this answer
I vote for self-control. –  wolfgangsz Jun 8 '11 at 14:14
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.