6 ms·
Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to faceb
by marios 10y ago
Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets).
If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables are your friend. With netfilter, consider using ipset.
- Borating 10y agoLike this [1], More details at [2] [1] http://www.commandlinefu.com/commands/view/16096/block-all-facebook-traffic http://www.commandlinefu.com/commands/view/16096/block-all-f... [2] http://www.tcpiputils.com/browse/as/32934 http://www.tcpiputils.com/browse/as/32934
- bogomipz 10y agoWhy would you wait and drop the traffic inbound? Why would you let your browser send the SYNs at all? This rule doesn't make any sense.
- jethro_tell 10y agoBecause most people don't block outbound and certainly not in a stateful way which means it's a poor place or a blacklist. To get this to work outbound, you need to allow all other traffic out (fine that's probably what you are doing already) or have a curated whitelist of other traffic allowed out. I assume this package doesn't want to make that assumption so the safe thing to do is to make an inbound blacklist.
- hueving 10y agoThat doesn't make any sense. You can block outbound just fine by having your block rules followed by a default allow. You don't need anything to be stateful when you are blocking whole IP addresses.
- jethro_tell 10y agoSo this has to assume that it's not a whitelisting setup and put a default allow. Which if you do outbound whitelisting, kinda fucks things up.
- AnthonyMouse 10y agoNothing prevents you from having explicit deny rules followed by explicit allow rules followed by default deny. And if you're already doing outbound whitelisting (which is generally much more trouble than it's worth) then unless you put Facebook on the whitelist you don't need to do anything anyway.
- wmccullough 10y agoO[1]k[2] [1] https://en.m.wikipedia.org/wiki/O https://en.m.wikipedia.org/wiki/O [2] https://en.m.wikipedia.org/wiki/K https://en.m.wikipedia.org/wiki/K
- droopyEyelids 10y agoFacebook only has one AS?
- bogomipz 10y agoThat's not uncommon.
- jzwinck 10y agoMost likely yes. There are only about 50k public autonomous systems on the entire Internet. The problem of course is already mentioned by another commenter: some FB assets are in other ASes. https://en.m.wikipedia.org/wiki/Autonomous_system_(Internet) https://en.m.wikipedia.org/wiki/Autonomous_system_(Internet)
- coderholic 10y agoYes, http://ipinfo.io/AS32934 http://ipinfo.io/AS32934. True for most organizations: http://ipinfo.io/countries/us http://ipinfo.io/countries/us
- dredmorbius 10y agoThat's fairly typical. An AS (identified by an ASN) is an autonomous system. It's comprised of multiple CIDR blocks, contiguous regions of IP addresses. The network definition (by CIDR block) is fairly dynamic, as blocks can be added, deleted, or consolidated. An autonomous system is a single administrative domain over public IP space. Essentially, autonomous systems are what the Internet is inter-networking between, through BGP (border gateway protocol). BGP and AS are what Cisco (and other router) gear are ultimately all about. So yes: organisations typically have one AS. Exceptions are typically the result of corporate mergers (not uncommon) or government space (where the domains are large). (Disclaimer: I'm not a networking bithead, don't muck with routers much, and have a rough knowledge of much of this, though it should be vaguely accurate.)
- mioelnir 10y agoAnd if you end up with more than one AS due to a merge, you usually pick one them as your primary and connect the other ones to it, then announce their prefixes from your primary, ie. your primary AS becomes transit for your other ones. That way you only have to maintain one external border.
- Ueland 10y agoSmart, even this list forgets national domain names belonging to Facebook. For example Facebook.no which is owned by a rather anonomous company (lovellsnames.org /Low Gravity Limited), yet the domain appears to be used by FB and God knows how many subdomains under there again there are.
- puddintane 10y agoVery interesting after looking up the AS number [1] you provided it includes domains that are not on that GitHub list - as you mentioned. I would have to agree with this being the better method to blocking facebook. [1] http://www.tcpiputils.com/browse/as/32934 http://www.tcpiputils.com/browse/as/32934 * note there are more than average ads on this site and it's a bit plain but this was the only one I could find that, with my brief searching, showed ip prefixes associated to the AS number. If anyone has a better lookup tool that'd be great! edit: Should also note that since other users are mentioning they might be under multiple AS number's maybe the ticket would be to setup a GitHub that collected these AS numbers for FB. edit 2: found a less ad filled site! http://ipduh.com http://ipduh.com Search AS32934 click "prefixes" at top
- deleted 10y ago[deleted]
- coderholic 10y agohttps://ipinfo.io/AS32934 https://ipinfo.io/AS32934 You can also confirm this is the only ASN for Facebook by searching for Facebook at https://ipinfo.io/countries/us https://ipinfo.io/countries/us
- jlgaddis 10y agoIt's also possible that Facebook has prefixes they use that are announced by ASNs other than their own.
- simunaga 10y agowhat's AS number? how can I find out what a AS number for a domain or ip address is?
- coderholic 10y agoYou can use https://ipinfo.io https://ipinfo.io - either search at https://ipinfo.io/countries/us https://ipinfo.io/countries/us, or use the API (note the org field): $ curl ipinfo.io/`dig +short facebook.com | head -n1` { "ip": "69.171.230.68", "hostname": "edge-star-mini-shv-17-prn1.facebook.com", "city": "Menlo Park", "region": "California", "country": "US", "loc": "37.4590,-122.1781", "org": "AS32934 Facebook, Inc.", "postal": "94025" } See https://ipinfo.io/developers https://ipinfo.io/developers for more details
- simunaga 10y agoipinfo.io retrieves this information from somewhere. can I and how obtain this information myself, from the very source?
- Symbiote 10y agohttp://lmgtfy.com/?q=AS+number http://lmgtfy.com/?q=AS+number etc.
- jlgaddis 10y agohttps://en.wikipedia.org/wiki/Autonomous_system_(Internet) https://en.wikipedia.org/wiki/Autonomous_system_(Internet)
- simunaga 10y agomaybe you know. can I and how obtain this information myself, from the very source, for a given domain name or company or whatever it is?
- dredmorbius 10y agoI'm surprised that AS-based blocking tools aren't already more prevalent and readily available. AS information isn't trivially available, though you can do a pretty good job through tools like the CIDR Report and ASN Routeviews. There are quite substantial portions of the Internet to which I'd generally provide very little or very limited access if I had my druthers.
- jlgaddis 10y agoARIN, et al, provide WHOIS servers that will map IP address information to ASNs. The list of all registered ASNs is also public. Also, there are routing registries which can provide even more information on which ASNs announce which prefixes. Most of what you'd want is out there, but you might have to obtain it all and doing a bit of work to combine/correlate i all.
- dredmorbius 10y agoThat's kind of what I was trying to say.
- Animats 10y agoRight. Since Facebook has fdda274d380ki4frcgi-rumjfjai1460158783-sonar.xx.fbcdn.net there are probably many more like that.
- cloudjacker 10y agoI was at a hackathon a few weekends ago, and to my surprise I needed to register a domain name and get an SSL certificate for it. I thought I was unreconcilably blocked for the duration of the hackathon, as DNS propagation disclaimers give itself 72 hours, and SSL certificates require who knows what. I was able to get a completely new domain with Amazon Route 53 and Amazon's free SSL certificates in 20 minutes. So yeah, I would say these blocklists are futile now, in OP's format.
- throwaway_exer 10y agoDNS propagation on the public Internet has been 20 minutes or less for the past decade (unless you set a long TTL on an existing zone record, obviously.) You can get a cheapo SSL certificate in about 5 minutes if you've made one recently, otherwise it takes me about 30 minutes to jump through all the hoops.
- Thaxll 10y agoIf they use a CDN that CDIR doesn't belong to FB you're screwed. afair they're using Akamai
- jmdugan 10y agocompletely agree. unfortunately dnsmasq, firewalls, running your own bind, or PF, table, or the other solutions you mention -- these all require a level of technical expertise far, far beyond the norm, or even 2 standard deviations above the norm of Internet users' technical ability (for some of them, including me). I had maintained the Facebook blocklist for hosts files because it was super simple for me to use, and to share with others. definitely not ideal, not even complete, and requires work - BUT, nearly any Internet user can implement the solution done this way. It would be really interesting to autogenerate the domain lists by running background scripts on AS numbers, polling DNS for every IP in the range, and cataloging the domains by script - say, daily, and then printing the list into a 0.0.0.0 prefixed hosts list. Thank you! disclaimer: github user maintaining linked resource
- __DarkBlue 10y agoBlocking at the firewall works best for me. If any OS X users want to know how, I've covered it here: https://www.perpetual-beta.org/weblog/blocking-facebook-on-os-x.html https://www.perpetual-beta.org/weblog/blocking-facebook-on-o...
- DavideNL 10y agoAwesome, thanks for posting this, i have been searching for exactly this...!
- __DarkBlue 10y agoYou're very welcome. :-)