Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In my office we have a DrayTek Vigor 2920 router, with CSM setup to only allow certain keywords (keyword objects) to certain IP groups. This all works fine, however we've discovered that all HTTPS websites are allowed.

i.e, http:www.facebook.com will be blocked, but https://www.facebook.com will be allowed.

Is there any setting to stop this, I've looked through all settings?

share|improve this question

2 Answers 2

This is happening because you have configured filters based on keywords in the URL. When accessing https://www.facebook.com, an encrypted connection is established with facebook's servers and your router cannot inspect the URL anymore.

You should try blocking facebook's IP range

Following IP address ranges are known to be used by Facebook:

66.220.144.0 - 66.220.159.255

69.63.176.0 - 69.63.191.255

69.171.224.0 - 69.171.255.255

204.15.20.0 - 204.15.23.255

Additional IP ranges which may be assigned to Facebook Inc.

65.201.208.24/29

65.204.104.128/28

66.92.180.48/28

66.93.78.176/29

66.199.37.136/29

67.200.105.48/30

74.119.76.0/22

173.252.64.0/18

IP list from here


UPDATE: If you are able to change your infrastructure, then you can consider using a web proxy or a SSL proxy as GdD pointed out.

share|improve this answer
1  
This is certainly advice that will work, my comment would be that maintaining a list of all the IP address ranges that are used by social networking sites, gambling, etc is a large management overhead. If you have a real issue consider installing a proxy –  GdD Jan 15 '13 at 16:28
    
Thanks for the answer, I'll have a go with the IP blocking, we also want to block Twitter so I'll try and find the IP's for that. Infrastructure wise it's pretty confusing, lots of ethernet switches linked to the draytek router, so not sure where I'd start at integrating a PC with a web proxy/software. –  Alexander Wigmore Jan 15 '13 at 16:45
    
I know there are solutions where they use the domain name and port. NetTutor does it (not something you'd probably be interested in using), but you can maybe try specifying https or :443. –  demize Sep 2 '13 at 1:28
up vote 0 down vote accepted

Possibly not the best wide-usage answer, but definitely answered my problem specifically:

Draytek have now released a firmware upgrade for the router that solves the issue with HTTPS sites not getting filtered.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.