3

we're building a landing page to use with Unifi (v3-beta). The landing page should show a facebook (and later LinkedIn) button to login.

After they login with fb (or allow our app) they get unlimited access to the internet.

We can whitelist facebook's IP adresses using this: https://developers.facebook.com/docs/ApplicationSecurity/#facebook_scraper

Facebook uses Akamai as CDN. And for Akamai, it's not that easy. They have a lot more IPs and have different AS numbers.

Is there a way to get a list of all IPs behind "fbstatic-a.akamaihd.net"?

# nslookup fbstatic-a.akamaihd.net
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
fbstatic-a.akamaihd.net canonical name = fbstatic-a.akamaihd.net.edgesuite.net.
fbstatic-a.akamaihd.net.edgesuite.net   canonical name = a1168.dsw4.akamai.net.
Name:   a1168.dsw4.akamai.net
Address: 195.10.11.64
Name:   a1168.dsw4.akamai.net
Address: 195.10.11.43

Should we just whitelist ALL of Akamai's network (thousands of IPs)?

What would be the best solution for this?

Improve this question

2 Answers 2

Reset to default
1

Akamai does DNS-based global load balancing, so your nslookup would only give you a set of result out of many possible results. Relying on these would be too flakey because routes could change, Akamai could relocate resources, etc.

Whitelisting all of Akamai's network is one method.

The other way is to build a transparent proxy using squid and then configure ACL based on URL (i.e. hostname portion of the URL must be "fbstatic-a.akamaihd.net"). Transparent proxy wouldn't work well with SSL though, so you might want to advertise proxy settings via DHCP (e.g. using a PAC file)

Improve this answer
3
  • We've thought about using a proxy. Do mobile devices such as Android & iOS take the PAC file into account? Will pushing it via DHCP enforce it?
    – Tuinslak
    Aug 1, 2013 at 16:17
  • And on the other hand, as we'd roll out in existing networks as well, we don't always have the ability to enforce DHCP options (some networks have standard ISP routers, for example).
    – Tuinslak
    Aug 1, 2013 at 16:19
  • You're right, Android and iOS support (and possibly others like Blackberry) for WPAD/PAC would be tricky. I have not actually tried them myself but from Googling there are mixed report. It appears that iOS does support it, but Android doesn't (code.google.com/p/android/issues/detail?id=1273)
    – Wil Tan
    Aug 2, 2013 at 0:40
-3

One option I have found useful is giving temporary access to a guest and asking him to login for continued access.

Check my portal if you want to see exact implementation https://github.com/unifispot

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .