How can I block HTTPS web sites (e.g. Facebook) in our Local Area Network without using a firewall?
closed as too broad by S.L. Barth, DKNUCKLES, techraf, Anders, Neil Smithline Jul 20 '16 at 14:50
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Facebook can be blocked in many ways:
- On proxy like squid / sslbump mentioned
- On Firewall and DNS
Facebook is using it's own netwo
rk ranges and there's more than just Facebook, but all is social essentially like Instagram.
You need also to think what to do with "requests to Facebook". You can setup a zone on your local DNS server "facebook.com" and direct all traffic to dummy server with no webserver on it, so it returns "connection refused". This is because when you block on the firewall, this might block web browsers. You need to setup all "top-level" facebook domains like "*.facebook.com, *.fbcdn.net" and so on. You can also make DNS to not respond anything at all.
See the list of Facebook domains: https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all
Instead of the DNS, you can make firewall not slowing down browsers by sending "connection refused" response by itself. This can be done by doing redirection to local port or to dummy server with no port open. Here's some example but that's not for router, it's for stand-alone host, but it shows that to block website without slowing-down browser you need to tell the browser that the port is closed using TCP/IP and not just ICMP. This can be done by redirecting outgoing port to local port:
[root@localhost ~]# telnet 220.127.116.11 443 Trying 18.104.22.168... Connected to 22.214.171.124. Escape character is '^]'. ^] telnet> q Connection closed. [root@localhost ~]# iptables -t nat -A OUTPUT -d 126.96.36.199 -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:777 [root@localhost ~]# telnet 188.8.131.52 443 Trying 184.108.40.206... telnet: connect to address 220.127.116.11: Connection refused
This is very reliable way of doing it. Some firewalls may be able to block the port in such a way that the redirection is not needed.
So you can use both Firewall and DNS (or just the Firewall), or you can use the proxy option.
Going with the proxy option is good when you have it already in place. This is big change for the company and it might introduce issues with privacy, for example, someone might break into the proxy and sniff all the traffic to the cloud like Gmail and Office365 as it's re-encrypted there.
Blocking Facebook usually doesn't provide positive results as many people do need it for work of all sorts, so such decision is usually shortly over-turned.