I have been searching for a solution to notify the browser on user that the request is Rejected so stop loading it. Because I have blocked facebook and every page that have a facebook plugin is stacked at loading for 1 min, leading in confusion.

When I use this rule: iptables -A FORWARD -p tcp -m iprange --src-range192.168.1.50- --dport 443 -j REJECT. I have to add this code --reject-with tcp-resetto do the request below, so the browser was noticed instantly for the rejection and didn't wait in loading any more.

Now my question is how can I do the same with this new rule I have added recently that block facebook using L7 information?

iptables -A FORWARD -m string --string "facebook.com" --algo bm --from 1 --to 600 -j REJECT

The blocking part work very well but the problem is that the hole pages that contains any facebook plugin or part stay in loading for +5 sec without interrupting any work on main page, only that the load symbol on browser tab lead to misunderstanding on user experience

  • 1
    Facebook uses SSL/TLS encryption, so you cannot block it by matching strings in IPTables, because there is no cleartext version of "facebook.com" in the request. Also, if you match string "facebook.com" and block all those requests, you could block many more things. You need to install a transparent proxy in order to control access to Facebook. – Tero Kilkanen Nov 14 '14 at 10:43
  • this is working, blocks the certificate before it goes to the browser. I am not questioning the function because I know it works I have applied and tested. I want a way for browser not to be stacked on loading. I have a transparent proxy but only for http – emirjonb Nov 14 '14 at 12:00
  • And all pages that have "facebook.com" string embedded in the HTML code work also after that? – Tero Kilkanen Nov 14 '14 at 15:53
  • Yes they work, normally the facebook part is inserted as <iframe> and this rule doesn't affect this pages, only that the hole page stay in loading for +5 sec without interrupting the main page, only that the load symbol on browser tab lead to misunderstanding on user experience. I find a hard solution making a dns entry to resolve facebook.com to so i eliminated the timeout until we find a way to respond by ubuntu iptables – emirjonb Nov 14 '14 at 16:09
  • Tero is right though, depending on where "facebook.com" is located on the page you'll end up blocking many more things than just Facebook. What happens if you reject without the tcp reset? – gparent Nov 14 '14 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.