Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In my office, I have set up a linux machine as router and provide internet connectivity to all clients. Behind this linux router I have set up a cisco wireless router, with which I have made internet connectivity available to mobile phones of some employees in my office.

Now i want to block access to WhatsApp and other IM services (we chat, line). Is it possible to block these android applications using iptables?

share|improve this question
    
What is the name of the application you are trying to block? –  MadHatter Dec 2 '13 at 8:25
    
whats app, we chat, line –  amrit Dec 2 '13 at 8:26
    
OK. I'm not familiar with those particular apps, but the way this usually works is that you have to find out how those apps communicate with the internet. If it's to a particular centralised server or block of servers, you can block those with iptables by IP address. If it's to particular ports, you can block those ports. But if they use, say, regular HTTP to port 80, iptables can't help you, because it doesn't operate at the application layer. So step one is: find out how those apps communicate. –  MadHatter Dec 2 '13 at 8:28
    
i know but it is quit difficult to get the ip addresses of theirs server. –  amrit Dec 2 '13 at 8:30
2  
The fact that its difficult doesn't alter the fact that this is what you need to do if you want to use IPtables. If you want to easily block these kind of web apps then you need to look at devices that allow you to filter by web app traffic pattern. –  RobM Dec 2 '13 at 8:35

2 Answers 2

It looks like this application has been designed to try and avoid being blocked.

You could block this at layer 8 using an AUP that employees sign up to, which excludes using your equipment for services like this and which details sanctions for breach of said policy. This is the best solution as, when all is said and done this is a management issue not a technical one.

You could try layer 7 blocking DNS packets that request addresses in the whatsapp.net/.com/.whatever domains (sro.whatsapp in particular may be useful to block).

It uses ports 80,443,5222,5223 and 5228. You may get some mileage blocking some of them but it's unlikely you'll be able to block 80,443 reasonably.

I've read that some people have had success by blocking the whole of 184.173/16 but if that's a bit blunt then ipdb.at have a list too.

share|improve this answer

Like @Iain says, this should be solved at layer 8. But if you insist on a technical solution, you can also mandate that all wireless traffic must go through a proxy you control, and you can block WhatsApp traffic on that proxy.

share|improve this answer
    
i found the ip address and port using tcpdump......i am trying to block this ip and port. –  amrit Dec 2 '13 at 10:38
    
now ip is different and port is different , so block ip is not a solution. –  amrit Dec 2 '13 at 12:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.