Block some website in Linux machine

Question

In my office all are using facebook and some other site that we don't want to be. Form the server pc, I used to share my net through the /ect/rc.local file. I edited the file with this line:

#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE

So that my network has been shared by all. To do the filtering so that no one can access the facebook I modify the rc.local file and add those two line:

iptables -I INPUT 1 -s facebook.com -j DROP
iptables -I INPUT 2 -d facebook.com -j DROP

My /etc/rc.local file is now like this:

#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -I INPUT 1 -s facebook.com -j DROP
iptables -I INPUT 2 -d facebook.com -j DROP
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE

But the server yet cannot block the facebook access from all pc. Can any one please tell me how can I block all the access of facebook from my server

Answer 1

If you're the boss:

Any technical solution to this problem will not solve the actual problem, which is people in your office being bored and wanting to browse facebook / look at porn / whatever instead of working.

This is a management issue, and needs to be resolved through the use of management tools, such as clear corporate acceptable internet use policies that detail clearly what is, and isn't acceptable, and what happens if they're broken. If a guy's using facebook all day rather than doing his job, don't block facebook, fire his ass*.

*Juristictional / local legal environment and restrictions notwithstanding.

If you're the technical guy the boss has asked to do this:

This is really dodgy ground. You can't effectively censor the internet without a lot of resources, expertise and control. What will end up happening is that you'll implement some sort of hack (your iptables posting indicates you might not have all the expertise required to do this), your users will work around it and now you've got an angry boss who demands to know why you can't do your job right.

You need to set expectations with your management that while you can implement something given the resources and skills you have, it's probably not going to be effective and therefore a waste of your time.

Answer 2

If your users are clever, then your task may be difficult to fully enforce, and iptables cannot easily and reliably do what you want. Here are a few considerations.

1. Your iptables rules block filter traffic based on IP addresses and ports. Facebook presents multiple IP addresses, and may change those IP addresses from time to time.

2. Your users can always use an open proxy to access Facebook, bypassing limitations based on IP address.

3. You should enact a corporate policy governing the use of internet access at the workplace and specify what usage is regarded as appropriate or inappropriate.

4. You can gain some control if you're managing your company's DNS servers, which would enable you to redefine the IP address of facebook.com for your users. There are some decent firewalls and services that provide categorization (Fortinet Fortigate-60, OpenDNS, BlueCoat, etc.). You also might try a proxy like Squid to do such filtering if you're looking for a free solution on existing equipment.

Answer 3

Since your Linux box is the gateway, why don't you setup Squid as a transparent proxy and then add .facebook.com to a squid blacklist file like so:

In /etc/squid/blacklist_domains:

.facebook.com
.whatever.com

In your squid.conf:

acl BLACKLIST_DOMAINS dstdom_regex -i "/etc/squid/blacklist_domains"
http_access deny BLACKLIST_DOMAINS

Answer 4

If the users at the office aren't so tech savvy, you can just change their hosts file, with something like this facebook.com 127.0.0.1 and add a line for the www too.

If you are dealing with a techi users, (whom can access facebook with an IP address), it is more difficult to do. as @TryTryAgain suggested untangle can do that.

Answer 5

Squid requires the "acl localhost src 127.0.0.1/8 " above this line "acl lan src 202.51.176.42 192.168.10.1/24" in squid.conf.

Answer 6

It sounds like Untangle may be what you're looking for. Take a look at it and propose it to your boss.

Answer 7

I have been using OpenDns based dns blocking system. Though most of the users in my company are not all that tech savy.