-2

In my office, I have set up a linux machine as router and provide internet connectivity to all clients. Behind this linux router I have set up a cisco wireless router, with which I have made internet connectivity available to mobile phones of some employees in my office.

Now i want to block access to WhatsApp and other IM services (we chat, line). Is it possible to block these android applications using iptables?

  • What is the name of the application you are trying to block? – MadHatter Dec 2 '13 at 8:25
  • whats app, we chat, line – amrit Dec 2 '13 at 8:26
  • OK. I'm not familiar with those particular apps, but the way this usually works is that you have to find out how those apps communicate with the internet. If it's to a particular centralised server or block of servers, you can block those with iptables by IP address. If it's to particular ports, you can block those ports. But if they use, say, regular HTTP to port 80, iptables can't help you, because it doesn't operate at the application layer. So step one is: find out how those apps communicate. – MadHatter Dec 2 '13 at 8:28
  • i know but it is quit difficult to get the ip addresses of theirs server. – amrit Dec 2 '13 at 8:30
  • 3
    The fact that its difficult doesn't alter the fact that this is what you need to do if you want to use IPtables. If you want to easily block these kind of web apps then you need to look at devices that allow you to filter by web app traffic pattern. – Rob Moir Dec 2 '13 at 8:35
8

It looks like this application has been designed to try and avoid being blocked.

You could block this at layer 8 using an AUP that employees sign up to, which excludes using your equipment for services like this and which details sanctions for breach of said policy. This is the best solution as, when all is said and done this is a management issue not a technical one.

You could try layer 7 blocking DNS packets that request addresses in the whatsapp.net/.com/.whatever domains (sro.whatsapp in particular may be useful to block).

It uses ports 80,443,5222,5223 and 5228. You may get some mileage blocking some of them but it's unlikely you'll be able to block 80,443 reasonably.

I've read that some people have had success by blocking the whole of 184.173/16 but if that's a bit blunt then ipdb.at have a list too.

3

Apply a filter using the official IP list: https://www.whatsapp.com/cidr.txt

Use QoS instead of blocking.

1

Like @Iain says, this should be solved at layer 8. But if you insist on a technical solution, you can also mandate that all wireless traffic must go through a proxy you control, and you can block WhatsApp traffic on that proxy.

  • i found the ip address and port using tcpdump......i am trying to block this ip and port. – amrit Dec 2 '13 at 10:38
  • now ip is different and port is different , so block ip is not a solution. – amrit Dec 2 '13 at 12:18
0

I'm not sure how relevant this will be, but I wanted to block of WeChat from the network. What I did to achieve this was trace the connection and lookup the IP device were using to connect to the chat server. After obtaining this IP, I did a IP range lookup and simply block the whole range this IP came from.

It's been working like a charm.

I assume you can do the same for any other chat applications.

For Wechat is the range '203.205.160.0 - 203.205.167.255' which is own by Tencent which is the company that owns Wechat.

I think this IP range might change overtime, so might need to update once a while.

The IP range will most likely be different depending on your locale and region. The range above might not work for everyone.

Hope this is helpful for someone down the road.

0

I'd suggest using netfilter_ndpi, which is basically a deep packet inspection module. You can get the source directly from github. After you've built the module for xtables (iptables & ipv6tables) you can just apply your rules like the following example:

iptables -N applied_filter

iptables -A FORWARD -j applied_filter

iptables -A applied_filter -m ndpi --proto whatsapp,whatsapp_voip -j REJECT

iptables -A applied_filter -j ACCEPT

The only issue with this is that you'll have to keep the module up-to-date manually, as protocols are not static and change frequently.

If you have already a set of iptables rules then you'll have to avoid the conntrack module, as ndpi needs a few sent packets to recognize the protocol and conntrack bypasses the ndpi module.

I hope that I was able to help.

-1

suggesting the ports TCP/5222, TCP/5223 and TCP/5228 as needed for Whatsapp.

So try to block those ports.

OR

c.whatsapp.net - WhatsApp Sever which is used for connection.

WhatsApp connects first then logs in, then reading/writing data will be done. So blocking this stops at the initial stage.

Don't have any idea of other IM's wechat, hike, line, etc but whatsapp network communition could be blocked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.