Permanently blocking a domain in iptables

Question

Suppose I want to block Facebook permanently. To do this, I have followed following processes:

#host -t a www.facebook.com

Sample output:

www.facebook.com has address 69.171.224.40

Find CIDR

#whois 69.171.224.40 | grep CIDR

Sample output:

CIDR: 69.171.224.0/19

To prevent outgoing access to www.facebook.com

Approach 1:

#iptables -I FORWARD -p tcp -d 69.171.224.0/19 -j DROP

Approach 2:

#iptables -I FORWARD -p tcp -d www.facebook.com -j DROP

Both Approaches work well. In approach 1, IP address may be changed so it will not block Facebook permanently. I don't know about approach 2 whether it will block Facebook permanently or not. If above approaches are not right way to block a domain permanently, how can I do it?

Answer 1

Using squid following thing if you use it do the same.

# Mon to Fry time
acl blockfacebooktime time MTWHF 8:30-8:30
# Domain name
acl blockfacebookdotcom  dstdomain .facebook.com

Answer 2

Approach 2 will NOT work as you may think. You can read this from iptables manual:

[!] -s, --source address[/mask]
          Source specification. Address can be either a network name, a hostname (please note that specifying any name to be resolved with a remote query  such
          as  DNS  is  a  really bad idea), a network IP address (with /mask), or a plain IP address.

Of course, the same applies on destination option -d. This is because iptables will do DNS lookup only once and use the retrieved IP in the rule. So, it will not work if the IP is changed after that.

A better approach is to use a proxy server as suggested by @neolix. However, your users can try to bypass your proxy unless you are have really strict rules to prevent this.

Answer 3

I achieved the same by redirecting the host to a local IP.

Edit /etc/hosts and add something like this (non-routing IP):

10.0.0.1      www.facebook.com

Answer 4

Your are able to use autoscripting chain to block all the IPs for the domain. i.e. just list all the IPs for the domain and block them one-by-one. If the IP already exists in the table, insertion will be just skipped. Do as following:

# nslookup www.facebook.com|grep "^Address: [1-9]"| while read l; do ip=$(sed "s/Address://" <<< "$l"); if [ -z "$(iptables -n -L FORWARD|grep $ip)" ]; then iptables -I FORWARD -j DROP -d $ip; echo Blocked $ip; fi; done

This script can be called from a cron, for example each minute/hour, to renew the addresses.