6 ms·

You could just ignore AS32934: https://www.radb.net/query/?keywords=AS32934 https://www.radb.net/query/?keywords=AS32934 ..? ...which includes the downtown Pal

You could just ignore AS32934: https://www.radb.net/query/?keywords=AS32934 https://www.radb.net/query/?keywords=AS32934 ..? ...which includes the downtown Palo Alto address, hah. It’s linked from facebook.com/peering/ Here’s a list of the IP prefixes: https://bgp.he.net/AS32934#_prefixes https://bgp.he.net/AS32934#_prefixes https://bgp.he.net/AS32934#_prefixes6 https://bgp.he.net/AS32934#_prefixes6

xurukefi 6y ago
Programmatically retrievable via whois -h whois.radb.net -- '-i origin AS32934' | grep ^route Source: https://developers.facebook.com/docs/sharing/webmasters/crawler https://developers.facebook.com/docs/sharing/webmasters/craw...
- dontchooseanick 6y ago
  Done, and used daily : https://github.com/smigniot/smigniot.github.io/blob/master/install_20210123_rules.sh https://github.com/smigniot/smigniot.github.io/blob/master/i... For the google part I had to recurse through the AS list first, and perform cidr merging
  - megous 6y ago
    Wouldn't ipset be easier to use and potentially faster?
    - dontchooseanick 6y ago
      Probably yes. It seems easier to write. As it's a set of IPs instead of a set of rules it should be faster. Thanks. However I can't seem to find the --match-set option for my Android's iptables version. I Will test.
- megous 6y ago
  Dunno if it's enough, for example: https://whois.arin.net/rest/net/NET-63-150-141-224-1.html https://whois.arin.net/rest/net/NET-63-150-141-224-1.html is Facebook's range not included above.
  - dontchooseanick 6y ago
    $ sudo nmap -sn 63.150.141.224-231 [sudo] password for alice: Starting Nmap 7.40 ( https://nmap.org ) at 2021-02-11 06:41 CET Nmap done: 8 IP addresses (0 hosts up) scanned in 9.15 seconds
    - megous 6y ago
      Well, good, though that doesn't mean other 50 similar FB IP ranges in other collocation facilities are also not responding to ping.
      - dontchooseanick 6y ago
        https://search.arin.net/rdap/?query=FACEBOOK https://search.arin.net/rdap/?query=FACEBOOK The links contain the IP ranges (4 and 6). Testing all those should be sufficient.
        megous 6y ago
        What about other continents? Are FB addresses all under ARIN, even in EU? There are some small ranges in RIPE too: https://apps.db.ripe.net/db-web-ui/query?searchtext=facebook https://apps.db.ripe.net/db-web-ui/query?searchtext=facebook
specialist 6y ago
Sorry, am noob, ELI5 please. Those RADb responses include this line: mnt-by: MAINT-AS32934 AS32934 is the account maintaining Facebook's public presence(s)? How'd you figure that out? Using routing table mainteners to DNS entries seems like a terrific why to create those ad-blocking lists. Is this how it's done? I always assumed those lists are manually collated and curated.
- gorgoiler 6y ago
  Version 4 of The Internet (the popular one that blew up in the 1990s) is made up of 32 bit numeric addresses attached to physical things to which data has to be routed. In the 80s these would be bunched up by org in nice ways just like how phone numbers that were all in the same place would share an area code. MIT would be 1.1.x.y and you’d route their data to Cambridge MA. IBM would be 2.x.y.z and you’d route to them and let them deal with it internally. Some small outfit in France might’ve gotten 173.4.5.q: you’d send their data into the Atlantic fibre because “173.something” meant “Europe” and let the other end figure it out. In the 90s it all got messy because 32bits wasn’t enough to keep things in a clean hierarchy that reflected how data was routed around the net. Orgs ended up accumulating fragments of IP address space from all over the place for the hosts at their physical site. The hierarchy of the address couldn’t tell you how to route traffic and the rules for routing became highly extensive and dynamic. Enter Autonomous Systems Numbers and BGP. It’s a layer on top of IP addressing that only matters to internet core routers with many choices as to how to your traffic (“multi homed” sites). It helps map IP addresses to actual places — internet peers, aka fellow ISPs — so they can agree with each other how traffic should be routed. BGP lets peers keep these routes updated and let’s you know who owns what. None of this matters if you have a single internet connection. Routing is easy: it’s either “local” or you send it to your ISP. But if you’re an ISP in the centre how do you know who gets what? You use The [Internet] Routing Table as maintained by the BGP system. Some companies have so much traffic they have their own ASN. Because the internet is open, you get to see all the IP addresses which are bundled up inside that ASN, which is what I was linking to. It only works because FB is its own self-serving ISP with its own ASN. (With IPv6 this should all have gone away not because of the number of addresses, but because the address space was 128-bits wide. You could hierarchically route 256 towns in 256 counties in 256 states in 256 countries and still only have used half the hierarchy. ISPs usually get a /32 of this but Facebook announce a bunch of /48s which I don’t understand.)
Jiocus 6y ago
Edit: A warm mention of Steven Black's hosts, https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts for those interested in more of OP's subject. Use both methods instead of just one. They differ in nature, and can be implemented at different perimeters of your network. Maybe there exists certain chokeholds in the network where multiple devices can be protected in one go? Personally, I would have pure IP blackhole routing performed in the router providing WAN access to internal networks. A blanket protection for all desktops and 802.11 devices inside. Many devices today are locked-down and editing hosts records can be untrivial. Instead of relying on 0.0.0.0 routing through hosts, the same effect can be obtained by setting up a personal DNS server e.g. bind9 with RPZ's listing the targeted domains[1]. Why all that hassle? Because an unrooted smartphone with a Wireguard link to the DNS server (or full-on VPN using that DNS server), can have lookups made through the server you control. And that DNS service is available to use on any local network/Wi-Fi one has to use. IIRC 3G/4G/5G WAN routes were harder to get right, but I think it was possible. One could always route all traffic through a purposeful VPN. Defense in depth. --- [1]: fb.rpz.zone: ;RPZ $TTL 10 @ IN SOA rpz.zone. rpz.zone. ( 37; 3600; 300; 86400; 60 ) IN NS localhost. .facebook.com IN A 0.0.0.0 .facebook.net IN A 0.0.0.0 .fbcdn.com IN A 0.0.0.0 .fbsbx.com IN A 0.0.0.0 .fbcdn.net IN A 0.0.0.0 .edgesuite.net IN A 0.0.0.0

xurukefi 6y ago

Programmatically retrievable via whois -h whois.radb.net -- '-i origin AS32934' | grep ^route Source: https://developers.facebook.com/docs/sharing/webmasters/crawler https://developers.facebook.com/docs/sharing/webmasters/craw...

dontchooseanick 6y ago
Done, and used daily : https://github.com/smigniot/smigniot.github.io/blob/master/install_20210123_rules.sh https://github.com/smigniot/smigniot.github.io/blob/master/i... For the google part I had to recurse through the AS list first, and perform cidr merging
- megous 6y ago
  Wouldn't ipset be easier to use and potentially faster?
  - dontchooseanick 6y ago
    Probably yes. It seems easier to write. As it's a set of IPs instead of a set of rules it should be faster. Thanks. However I can't seem to find the --match-set option for my Android's iptables version. I Will test.
megous 6y ago
Dunno if it's enough, for example: https://whois.arin.net/rest/net/NET-63-150-141-224-1.html https://whois.arin.net/rest/net/NET-63-150-141-224-1.html is Facebook's range not included above.
- dontchooseanick 6y ago
  $ sudo nmap -sn 63.150.141.224-231 [sudo] password for alice: Starting Nmap 7.40 ( https://nmap.org ) at 2021-02-11 06:41 CET Nmap done: 8 IP addresses (0 hosts up) scanned in 9.15 seconds
  - megous 6y ago
    Well, good, though that doesn't mean other 50 similar FB IP ranges in other collocation facilities are also not responding to ping.
    - dontchooseanick 6y ago
      https://search.arin.net/rdap/?query=FACEBOOK https://search.arin.net/rdap/?query=FACEBOOK The links contain the IP ranges (4 and 6). Testing all those should be sufficient.
      - megous 6y ago
        What about other continents? Are FB addresses all under ARIN, even in EU? There are some small ranges in RIPE too: https://apps.db.ripe.net/db-web-ui/query?searchtext=facebook https://apps.db.ripe.net/db-web-ui/query?searchtext=facebook

specialist 6y ago

Sorry, am noob, ELI5 please. Those RADb responses include this line: mnt-by: MAINT-AS32934 AS32934 is the account maintaining Facebook's public presence(s)? How'd you figure that out? Using routing table mainteners to DNS entries seems like a terrific why to create those ad-blocking lists. Is this how it's done? I always assumed those lists are manually collated and curated.

gorgoiler 6y ago
Version 4 of The Internet (the popular one that blew up in the 1990s) is made up of 32 bit numeric addresses attached to physical things to which data has to be routed. In the 80s these would be bunched up by org in nice ways just like how phone numbers that were all in the same place would share an area code. MIT would be 1.1.x.y and you’d route their data to Cambridge MA. IBM would be 2.x.y.z and you’d route to them and let them deal with it internally. Some small outfit in France might’ve gotten 173.4.5.q: you’d send their data into the Atlantic fibre because “173.something” meant “Europe” and let the other end figure it out. In the 90s it all got messy because 32bits wasn’t enough to keep things in a clean hierarchy that reflected how data was routed around the net. Orgs ended up accumulating fragments of IP address space from all over the place for the hosts at their physical site. The hierarchy of the address couldn’t tell you how to route traffic and the rules for routing became highly extensive and dynamic. Enter Autonomous Systems Numbers and BGP. It’s a layer on top of IP addressing that only matters to internet core routers with many choices as to how to your traffic (“multi homed” sites). It helps map IP addresses to actual places — internet peers, aka fellow ISPs — so they can agree with each other how traffic should be routed. BGP lets peers keep these routes updated and let’s you know who owns what. None of this matters if you have a single internet connection. Routing is easy: it’s either “local” or you send it to your ISP. But if you’re an ISP in the centre how do you know who gets what? You use The [Internet] Routing Table as maintained by the BGP system. Some companies have so much traffic they have their own ASN. Because the internet is open, you get to see all the IP addresses which are bundled up inside that ASN, which is what I was linking to. It only works because FB is its own self-serving ISP with its own ASN. (With IPv6 this should all have gone away not because of the number of addresses, but because the address space was 128-bits wide. You could hierarchically route 256 towns in 256 counties in 256 states in 256 countries and still only have used half the hierarchy. ISPs usually get a /32 of this but Facebook announce a bunch of /48s which I don’t understand.)

Jiocus 6y ago

Edit: A warm mention of Steven Black's hosts, https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts for those interested in more of OP's subject. Use both methods instead of just one. They differ in nature, and can be implemented at different perimeters of your network. Maybe there exists certain chokeholds in the network where multiple devices can be protected in one go? Personally, I would have pure IP blackhole routing performed in the router providing WAN access to internal networks. A blanket protection for all desktops and 802.11 devices inside. Many devices today are locked-down and editing hosts records can be untrivial. Instead of relying on 0.0.0.0 routing through hosts, the same effect can be obtained by setting up a personal DNS server e.g. bind9 with RPZ's listing the targeted domains[1]. Why all that hassle? Because an unrooted smartphone with a Wireguard link to the DNS server (or full-on VPN using that DNS server), can have lookups made through the server you control. And that DNS service is available to use on any local network/Wi-Fi one has to use. IIRC 3G/4G/5G WAN routes were harder to get right, but I think it was possible. One could always route all traffic through a purposeful VPN. Defense in depth. --- [1]: fb.rpz.zone: ;RPZ $TTL 10 @ IN SOA rpz.zone. rpz.zone. ( 37; 3600; 300; 86400; 60 ) IN NS localhost. .facebook.com IN A 0.0.0.0 .facebook.net IN A 0.0.0.0 .fbcdn.com IN A 0.0.0.0 .fbsbx.com IN A 0.0.0.0 .fbcdn.net IN A 0.0.0.0 .edgesuite.net IN A 0.0.0.0