Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

guide me for IPTABLES blocking any specific domain over https

Posted on 2010-11-08
6
Medium Priority
?
518 Views
Last Modified: 2012-06-27
i want to block a block of public ip/domain for access over my network, the traffic goes over https as transperant squid doesnot block by creating list of blocked list, please guide
0
Comment
Question by:daniluv
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 11

Expert Comment

by:jgiordano
ID: 34088249
Squid will block domains, maybe the syntax you are using is wrong


Q. How do I block any website accessing the Internet using squid proxy server?

A. You can simply use squid ACL to block access to any web site. There are 3 steps:

#1. Create a text file with blocked domain name list such as baddomain1.com, mail.yahoo.com, gmail.com and so on

#2. Define Acl

#3. Restart squid

First, create a file called /etc/squid/blocked.domains.acl
# vi /etc/squid/blocked.domains.acl

Append domain names,
gmail.com
baddomain.com
sex.com
mail.yahoo.com

Save and close the file. Open squid.conf file:
# vi /etc/squid/squid.conf

Create acl called blockeddomain:
acl blockeddomain dstdomain "/etc/squid/blocked.domains.acl"

Deny http access, enter:
http_access deny blockeddomain

Close and save the file. Restart squid proxy server:
# /etc/init.d/squid restart
0
 

Author Comment

by:daniluv
ID: 34088585
actually i want to block facebook and this way problem still persist, all i want is to work my iptables to drop the packets for a specift domain/ip which is not being able to be blocked through https...
0
 
LVL 12

Expert Comment

by:mccracky
ID: 34094716
iptables doesn't know about domains, on ip addresses.

You might try something like OpenDNS (www.opendns.com) to block "social networking" sites.
0
Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

 
LVL 1

Expert Comment

by:aartha
ID: 34126851
Use squid acl to block instead of IPTABLE
create a text file using any editor named block.txt in /etc/squid/


####Create acl called block:
acl block url_regx -i "/etc/squid/block.txt"

#Do the following in appropriate place
http_access deny block

#Reconfigure squid proxy server:
squid -k reconfigure
0
 
LVL 4

Accepted Solution

by:
Thankxx earned 1500 total points
ID: 34202841
Hello daniluv,

Try this to block facebook using iptables for both 443(SSL) and 80 port:

sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 66.220.144.0-66.220.159.255 --dport 443 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 69.63.176.0-69.63.191.255 --dport 443 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 204.15.20.0-204.15.23.255 --dport 443 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 66.220.144.0-66.220.159.255 --dport 80 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 69.63.176.0-69.63.191.255 --dport 80 -j REJECT
sudo /sbin/iptables -I FORWARD -m tcp -p tcp -m iprange --dst-range 204.15.20.0-204.15.23.255 --dport 80 -j REJECT
0
 

Author Closing Comment

by:daniluv
ID: 37006755
because squid does not judge the https traffic
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction We as admins face situation where we need to redirect websites to another. This may be required as a part of an upgrade keeping the old URL but website should be served from new URL. This document would brief you on different ways ca…
Setting up Secure Ubuntu server on VMware 1.      Insert the Ubuntu Server distribution CD or attach the ISO of the CD which is in the “Datastore”. Note that it is important to install the x64 edition on servers, not the X86 editions. 2.      Power on th…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial
Suggested Courses

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question