How to block facebook access

[Shamim Shahriar]

On 20/08/2017 12:44, Polytropon wrote:
> On Sun, 20 Aug 2017 07:30:40 -0400, Ernie Luzar wrote:
>> Polytropon wrote:
>>> On Sat, 19 Aug 2017 16:41:20 -0400, Ernie Luzar wrote:
>>>>> On 8/19/2017 2:20 PM, Ernie Luzar wrote:
>>>>>> Hello list;
>>>>>>
>>>>>> Running 11.1 & ipfilter with LAN behind the gateway server. LAN users
>>>>>> are using their work PC's to access facebook during work.
>>>>>>
>>>>>> What method would recommend to block all facebook access?
>>>>>>
>>>>   > Littlefield, Tyler wrote:
>>>>   > make your proxy just blacklist facebook.com and m.facebook.com?
>>>>   > Blocking it will just let them view it on their phones though, so
>>>>   > you're looking at a different issue altogether.
>>>>
>>>> Already blocking 15 facebook login ip address which can be added to or
>>>> changes by FB anytime.
>>> Yes, that is one of the core problems: You do not have control
>>> over Facebook's network configuration. :-)
>>>
>>> On the IP level, you can maintain a list of IPs to block. And
>>> you could use resolver modification to do this for you, for
>>> example when the IP for a certain Facebook service or page
>>> changes, using the resolver its new IP will be added to the
>>> block list. With this approach, you can block using both
>>> numeric IPs and domain name strings (which of course resolve
>>> to IPs, too).
>>>
>>> Maybe it would be a lot easier if you could just switch to
>>> whitelisting - define the IPs _allowed_ for the users. This
>>> will surely introduce new problems like "I cannot access a
>>> web site which I need for work, please verify and whitelist",
>>> which is something you cannot fully automate.
>>>
>> I am unfamiliar with the "resolver modification" you speak of.
>> Is this a function in ipfilter firewall?
>> Where and how is this done?
> It's a term I probably invented because I don't know the correct
> name - if it even has a specific name. :-)
>
> The idea is that IPs assigned to hosts may change, something you
> mentioned as a fully valid problem. Example: If you want to block
> login.example.com with the IP 123.456.789.100, you add that
> to your list - done. Now example.com changes it to 123.456.789.101,
> and in case you didn't block a full IP range (123.456.789.*),
> login.example.com can be reached again. So if you have a list
> of host names that you want to prohibit access to, put them into
> a list and let your resolver check them from time to time, for
> example using tools like dig, drill, or host, with a little
> postprocessing. If a new IP appears, just add it to the block
> list. In this example, 123.456.789.101 would be added, and
> login.example.com cannot be reached anymore. This approach is
> also helpful if example.com acquires a totally new IP range,
> for example now login.example.com becomes 123.987.258.654... ;-)
>
> Maybe the following resources will provide a good entry point:
>
> https://www.lifewire.com/what-is-the-ip-address-of-facebook-818152
>
> https://stackoverflow.com/questions/11164672/list-of-ip-space-used-by-facebook
>
>
>
>
Even then there are ways of mitigating those -- for example, using some 
kind of ToR browser or most simply using google services.

The only "slightly more effective" option I have come across so far is 
using squidguard or similar product, and forcing users to use squid 
(even with and specially for SSL connections) -- it involves installing 
your own CA to ALL the client machines, otherwise they will keep on 
getting error messages for all SSL sites. With squidguard you can also 
use regex or part of the URL and even that will be blocked, and you can 
redirect users to a notice page saying "this is forbidden from your work 
computer, your activity is being logged" :P

Hope this helps.
Regards