1

I'm using Squid Proxy 3.1 as transparent proxy server, I want to block facebook.com but while listed in blocked list , Some user's accessing facebook using https, how can i block only https for facebook

7
  • 2
    You need to block all the IP addresses it maps to. With https, you don't get to see the name of the server they're trying to reach, only the IP address. Feb 14, 2014 at 5:37
  • I Have used every IP's Of facebook too Here are the list .facebook.com 66.220.144.0/20 66.220.144.0/21 66.220.152.0/21 66.220.159.0/24 69.63.176.0/20 69.63.176.0/21 69.63.176.0/24 69.63.184.0/21 69.171.224.0/19 69.171.224.0/20 69.171.239.0/24 69.171.240.0/20 69.171.255.0/24 74.119.76.0/22 103.4.96.0/22 173.252.64.0/18 173.252.64.0/19 173.252.70.0/24 173.252.96.0/19 204.15.20.0/22 31.13.24.0/21 31.13.64.0/18 31.13.64.0/19 31.13.64.0/24 31.13.65.0/24 31.13.66.0/24 31.13.67.0/24 31.13.68.0/24 31.13.69.0/24 31.13.70.0/24 31.13.71.0/24 31.13.72.0/24 31.13.73.0/24 Feb 14, 2014 at 6:02
  • 1
    Why does it need to be a transparent proxy? As a configured proxy, you'll be able to actually work with the HTTPS requests sent by clients. Feb 14, 2014 at 6:04
  • If i mentioned the proxy settings in Browser user's used to change it, so what i need to use it, And my squid Server have 2 Ethernet to route Feb 14, 2014 at 6:16
  • If i mentioned the proxy settings in Browser user's used to change it - Update your firewall so if they do change it they won't be able to access the Internet. That means block all outgoing traffic that doesn't pass through the proxy. You can make exceptions for a few sites you explicitly whitelist.
    – Zoredache
    Feb 14, 2014 at 8:22

3 Answers 3

3

I think you can get the most up-to-date list of Facebook IP addresses using the folowing query

 whois -h whois.radb.net '!gAS32934'

The current list is somewhat longer than the one in your comment above. It should be fairly easy to parse the output of that query and load it into your firewall.


0

And if you decide to go explicit proxy way, be sure to setup ICAP web filtering with Squid and (possibly) HTTPS/SSL bumping. In this case SquidGuard will be able to filter actual HTTPS urls. If it is not possible to perform HTTPS filtering - use qlproxy to block access to CONNECT:443 request for facebook.com domain name only as you require.

3
0

Try this in squid.conf:

acl blockfb dstdomain -i ".facebook.com"
http_access deny blockfb

Since the initial CONNECT request still comes through as HTTP, it should be able to catch it and block it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .