-3

How can I block HTTPS web sites (e.g. Facebook) in our Local Area Network without using a firewall?

closed as too broad by S.L. Barth, DKNUCKLES, techraf, Anders, Neil Smithline Jul 20 '16 at 14:50

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Use a proxy with https interception (ie squid w/ sslbump), push your interception cert to the clients via group policy and set their browsers to use the new proxy. – DKNUCKLES Jul 20 '16 at 10:08
  • 2
    Do you want to block all https (bad idea!) or only specific websites which use https? – Philipp Jul 20 '16 at 13:00
  • What are you trying to do? Do you want to force HTTP to make packet inspection easier? – Neil Smithline Jul 20 '16 at 14:49
  • This seems like an X Y problem. Maybe if you tell us what you are trying to accomplish we can help you. meta.stackexchange.com/questions/66377/what-is-the-xy-problem – AstroDan Jul 20 '16 at 14:54
1

Facebook can be blocked in many ways:

  • On proxy like squid / sslbump mentioned
  • On Firewall and DNS

Facebook is using it's own netwo


rk ranges and there's more than just Facebook, but all is social essentially like Instagram.

See this post on how to find out Facebook IP address

You need also to think what to do with "requests to Facebook". You can setup a zone on your local DNS server "facebook.com" and direct all traffic to dummy server with no webserver on it, so it returns "connection refused". This is because when you block on the firewall, this might block web browsers. You need to setup all "top-level" facebook domains like "*.facebook.com, *.fbcdn.net" and so on. You can also make DNS to not respond anything at all.

See the list of Facebook domains: https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all

Instead of the DNS, you can make firewall not slowing down browsers by sending "connection refused" response by itself. This can be done by doing redirection to local port or to dummy server with no port open. Here's some example but that's not for router, it's for stand-alone host, but it shows that to block website without slowing-down browser you need to tell the browser that the port is closed using TCP/IP and not just ICMP. This can be done by redirecting outgoing port to local port:

[root@localhost ~]# telnet 213.180.141.140 443
Trying 213.180.141.140...
Connected to 213.180.141.140.
Escape character is '^]'.
^]
telnet> q
Connection closed.
[root@localhost ~]# iptables -t nat -A OUTPUT -d 213.180.141.140 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:777
[root@localhost ~]# telnet 213.180.141.140 443
Trying 213.180.141.140...
telnet: connect to address 213.180.141.140: Connection refused

This is very reliable way of doing it. Some firewalls may be able to block the port in such a way that the redirection is not needed.

So you can use both Firewall and DNS (or just the Firewall), or you can use the proxy option.

Going with the proxy option is good when you have it already in place. This is big change for the company and it might introduce issues with privacy, for example, someone might break into the proxy and sniff all the traffic to the cloud like Gmail and Office365 as it's re-encrypted there.

Blocking Facebook usually doesn't provide positive results as many people do need it for work of all sorts, so such decision is usually shortly over-turned.

Not the answer you're looking for? Browse other questions tagged or ask your own question.