Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my office, I have set up a linux machine as router and provide internet connectivity to all clients. Behind this linux router I have set up a cisco wireless router, with which I have made internet connectivity available to mobile phones of some employees in my office.

Now i want to block access to WhatsApp and other IM services (we chat, line). Is it possible to block these android applications using iptables?

share|improve this question
What is the name of the application you are trying to block? – MadHatter Dec 2 '13 at 8:25
whats app, we chat, line – amrit Dec 2 '13 at 8:26
OK. I'm not familiar with those particular apps, but the way this usually works is that you have to find out how those apps communicate with the internet. If it's to a particular centralised server or block of servers, you can block those with iptables by IP address. If it's to particular ports, you can block those ports. But if they use, say, regular HTTP to port 80, iptables can't help you, because it doesn't operate at the application layer. So step one is: find out how those apps communicate. – MadHatter Dec 2 '13 at 8:28
i know but it is quit difficult to get the ip addresses of theirs server. – amrit Dec 2 '13 at 8:30
The fact that its difficult doesn't alter the fact that this is what you need to do if you want to use IPtables. If you want to easily block these kind of web apps then you need to look at devices that allow you to filter by web app traffic pattern. – RobM Dec 2 '13 at 8:35

It looks like this application has been designed to try and avoid being blocked.

You could block this at layer 8 using an AUP that employees sign up to, which excludes using your equipment for services like this and which details sanctions for breach of said policy. This is the best solution as, when all is said and done this is a management issue not a technical one.

You could try layer 7 blocking DNS packets that request addresses in the domains (sro.whatsapp in particular may be useful to block).

It uses ports 80,443,5222,5223 and 5228. You may get some mileage blocking some of them but it's unlikely you'll be able to block 80,443 reasonably.

I've read that some people have had success by blocking the whole of 184.173/16 but if that's a bit blunt then have a list too.

share|improve this answer

Apply a filter using the official IP list:

Use QoS instead of blocking.

share|improve this answer

Like @Iain says, this should be solved at layer 8. But if you insist on a technical solution, you can also mandate that all wireless traffic must go through a proxy you control, and you can block WhatsApp traffic on that proxy.

share|improve this answer
i found the ip address and port using tcpdump......i am trying to block this ip and port. – amrit Dec 2 '13 at 10:38
now ip is different and port is different , so block ip is not a solution. – amrit Dec 2 '13 at 12:18

I'm not sure how relevant this will be, but I wanted to block of WeChat from the network. What I did to achieve this was trace the connection and lookup the IP device were using to connect to the chat server. After obtaining this IP, I did a IP range lookup and simply block the whole range this IP came from.

It's been working like a charm.

I assume you can do the same for any other chat applications.

For Wechat is the range ' -' which is own by Tencent which is the company that owns Wechat.

I think this IP range might change overtime, so might need to update once a while.

The IP range will most likely be different depending on your locale and region. The range above might not work for everyone.

Hope this is helpful for someone down the road.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.