Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In my office all are using facebook and some other site that we don't want to be. Form the server pc, I used to share my net through the /ect/rc.local file. I edited the file with this line:

#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE

So that my network has been shared by all. To do the filtering so that no one can access the facebook I modify the rc.local file and add those two line:

iptables -I INPUT 1 -s facebook.com -j DROP
iptables -I INPUT 2 -d facebook.com -j DROP

My /etc/rc.local file is now like this:

#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -I INPUT 1 -s facebook.com -j DROP
iptables -I INPUT 2 -d facebook.com -j DROP
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE

But the server yet cannot block the facebook access from all pc. Can any one please tell me how can I block all the access of facebook from my server

share|improve this question

migrated from stackoverflow.com Dec 26 '11 at 7:27

This question came from our site for professional and enthusiast programmers.

5  
Worst boss ever. Also, off-topic for Stack Overflow. –  meagar Dec 26 '11 at 6:48
    
Why worst boss? I think it is fine if he is blocking Facebook in office. –  Vinayak Garg Dec 26 '11 at 6:49
4  
iptables works on... well.. "IPs". You'd have to block out all of facebooks webserver IPs. But it won't get you far if your users are then switching to proxy (either a normal proxy or a web-based). –  vstm Dec 26 '11 at 6:52
    
It does not matter whether they are using proxy or not. I need to block the domain name facebook. So that normally any of user cannot able to login into facebook. Can you please tell me how can i do this? –  tanvir Dec 26 '11 at 6:59
1  
@meagar - the only way this qualifies as "worst boss" is in the sense they think there are technical solutions to behavioural problems. You (or for that matter, I) may not agree with how they want their IT resources to be used, but fundamentally its their resource and therefore their choice. –  RobM Dec 27 '11 at 0:17

7 Answers 7

If your users are clever, then your task may be difficult to fully enforce, and iptables cannot easily and reliably do what you want. Here are a few considerations.

  1. Your iptables rules block filter traffic based on IP addresses and ports. Facebook presents multiple IP addresses, and may change those IP addresses from time to time.

  2. Your users can always use an open proxy to access Facebook, bypassing limitations based on IP address.

  3. You should enact a corporate policy governing the use of internet access at the workplace and specify what usage is regarded as appropriate or inappropriate.

  4. You can gain some control if you're managing your company's DNS servers, which would enable you to redefine the IP address of facebook.com for your users. There are some decent firewalls and services that provide categorization (Fortinet Fortigate-60, OpenDNS, BlueCoat, etc.). You also might try a proxy like Squid to do such filtering if you're looking for a free solution on existing equipment.

share|improve this answer
    
Came here to suggest OpenDNS and corporate policy. Emphasis on policy. Otherwise you're just making it difficult for them. If you set concrete repercussions, then they'll be playing with fire(d). –  Belmin Fernandez Dec 26 '11 at 7:38

It sounds like Untangle may be what you're looking for. Take a look at it and propose it to your boss.

share|improve this answer

If you're the boss:

Any technical solution to this problem will not solve the actual problem, which is people in your office being bored and wanting to browse facebook / look at porn / whatever instead of working.

This is a management issue, and needs to be resolved through the use of management tools, such as clear corporate acceptable internet use policies that detail clearly what is, and isn't acceptable, and what happens if they're broken. If a guy's using facebook all day rather than doing his job, don't block facebook, fire his ass*.

*Juristictional / local legal environment and restrictions notwithstanding.

If you're the technical guy the boss has asked to do this:

This is really dodgy ground. You can't effectively censor the internet without a lot of resources, expertise and control. What will end up happening is that you'll implement some sort of hack (your iptables posting indicates you might not have all the expertise required to do this), your users will work around it and now you've got an angry boss who demands to know why you can't do your job right.

You need to set expectations with your management that while you can implement something given the resources and skills you have, it's probably not going to be effective and therefore a waste of your time.

share|improve this answer
    
Have to agree with this. If technical tools must be used at all, they should be in support of, not instead of, HR policy. –  RobM Dec 27 '11 at 0:20
    
This is exactly the answer my company went back to a client with recently who asked us to do the same (we manage their IT). If staff are wasting their time online it's totally a management issue. It's not feasible to drop in a solution like this ad-hoc either. If they really want a technical solution, hand them the costs for WebSense or similar, and the use manual on how to control the blacklists once it's set up. –  SimonJGreen Mar 5 '12 at 23:54

If the users at the office aren't so tech savvy, you can just change their hosts file, with something like this facebook.com 127.0.0.1 and add a line for the www too.

If you are dealing with a techi users, (whom can access facebook with an IP address), it is more difficult to do. as @TryTryAgain suggested untangle can do that.

share|improve this answer

Since your Linux box is the gateway, why don't you setup Squid as a transparent proxy and then add .facebook.com to a squid blacklist file like so:

In /etc/squid/blacklist_domains:

.facebook.com
.whatever.com

In your squid.conf:

acl BLACKLIST_DOMAINS dstdom_regex -i "/etc/squid/blacklist_domains"
http_access deny BLACKLIST_DOMAINS
share|improve this answer

Squid requires the "acl localhost src 127.0.0.1/8 " above this line "acl lan src 202.51.176.42 192.168.10.1/24" in squid.conf.

share|improve this answer

I have been using OpenDns based dns blocking system. Though most of the users in my company are not all that tech savy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.