Solved

guide me for IPTABLES blocking any specific domain over https

Posted on 2010-11-08
6
489 Views
Last Modified: 2012-06-27
i want to block a block of public ip/domain for access over my network, the traffic goes over https as transperant squid doesnot block by creating list of blocked list, please guide
0
Comment
Question by:daniluv
6 Comments
 
LVL 11

Expert Comment

by:jgiordano
ID: 34088249
Squid will block domains, maybe the syntax you are using is wrong


Q. How do I block any website accessing the Internet using squid proxy server?

A. You can simply use squid ACL to block access to any web site. There are 3 steps:

#1. Create a text file with blocked domain name list such as baddomain1.com, mail.yahoo.com, gmail.com and so on

#2. Define Acl

#3. Restart squid

First, create a file called /etc/squid/blocked.domains.acl
# vi /etc/squid/blocked.domains.acl

Append domain names,
gmail.com
baddomain.com
sex.com
mail.yahoo.com

Save and close the file. Open squid.conf file:
# vi /etc/squid/squid.conf

Create acl called blockeddomain:
acl blockeddomain dstdomain "/etc/squid/blocked.domains.acl"

Deny http access, enter:
http_access deny blockeddomain

Close and save the file. Restart squid proxy server:
# /etc/init.d/squid restart
0
 

Author Comment

by:daniluv
ID: 34088585
actually i want to block facebook and this way problem still persist, all i want is to work my iptables to drop the packets for a specift domain/ip which is not being able to be blocked through https...
0
 
LVL 12

Expert Comment

by:mccracky
ID: 34094716
iptables doesn't know about domains, on ip addresses.

You might try something like OpenDNS (www.opendns.com) to block "social networking" sites.
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 
LVL 1

Expert Comment

by:aartha
ID: 34126851
Use squid acl to block instead of IPTABLE
create a text file using any editor named block.txt in /etc/squid/


####Create acl called block:
acl block url_regx -i "/etc/squid/block.txt"

#Do the following in appropriate place
http_access deny block

#Reconfigure squid proxy server:
squid -k reconfigure
0
 
LVL 4

Accepted Solution

by:
Thankxx earned 500 total points
ID: 34202841
Hello daniluv,

Try this to block facebook using iptables for both 443(SSL) and 80 port:

sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 66.220.144.0-66.220.159.255 --dport 443 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 69.63.176.0-69.63.191.255 --dport 443 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 204.15.20.0-204.15.23.255 --dport 443 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 66.220.144.0-66.220.159.255 --dport 80 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 69.63.176.0-69.63.191.255 --dport 80 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 204.15.20.0-204.15.23.255 --dport 80 -j REJECT
0
 

Author Closing Comment

by:daniluv
ID: 37006755
because squid does not judge the https traffic
0

Featured Post

Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

Join & Write a Comment

How many times have you wanted to quickly do the same thing to a list but found yourself typing it again and again? I first figured out a small time saver with the up arrow to recall the last command but that can only get you so far if you have a bi…
Introduction We as admins face situation where we need to redirect websites to another. This may be required as a part of an upgrade keeping the old URL but website should be served from new URL. This document would brief you on different ways ca…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now