I'm using Squid Proxy 3.1 as transparent proxy server, I want to block facebook.com but while listed in blocked list , Some user's accessing facebook using https, how can i block only https for facebook

  • 2
    You need to block all the IP addresses it maps to. With https, you don't get to see the name of the server they're trying to reach, only the IP address. – David Schwartz Feb 14 '14 at 5:37
  • I Have used every IP's Of facebook too Here are the list .facebook.com – Babin Lonston Feb 14 '14 at 6:02
  • 1
    Why does it need to be a transparent proxy? As a configured proxy, you'll be able to actually work with the HTTPS requests sent by clients. – Shane Madden Feb 14 '14 at 6:04
  • If i mentioned the proxy settings in Browser user's used to change it, so what i need to use it, And my squid Server have 2 Ethernet to route – Babin Lonston Feb 14 '14 at 6:16
  • If i mentioned the proxy settings in Browser user's used to change it - Update your firewall so if they do change it they won't be able to access the Internet. That means block all outgoing traffic that doesn't pass through the proxy. You can make exceptions for a few sites you explicitly whitelist. – Zoredache Feb 14 '14 at 8:22

I think you can get the most up-to-date list of Facebook IP addresses using the folowing query

 whois -h whois.radb.net '!gAS32934'

The current list is somewhat longer than the one in your comment above. It should be fairly easy to parse the output of that query and load it into your firewall.

| improve this answer | |

And if you decide to go explicit proxy way, be sure to setup ICAP web filtering with Squid and (possibly) HTTPS/SSL bumping. In this case SquidGuard will be able to filter actual HTTPS urls. If it is not possible to perform HTTPS filtering - use qlproxy to block access to CONNECT:443 request for facebook.com domain name only as you require.

| improve this answer | |

Try this in squid.conf:

acl blockfb dstdomain -i ".facebook.com"
http_access deny blockfb

Since the initial CONNECT request still comes through as HTTP, it should be able to catch it and block it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.