I advocate for iptables instead of DNS filtering. Process of enumerating and rej... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		dontchooseanick on March 21, 2018 \| parent \| context \| favorite \| on: Blocklist Facebook domains I advocate for iptables instead of DNS filtering. Process of enumerating and rejecting facebook IPs : * Query the RAD http://radb.net/query/ , search for AS32934 * Enumerate ip ranges by http://radb.net/query/?advanced_query=1 * Check inverse query by origin, use AS32934 * Grep the response route and route6 CIDR ranges * Build a netfilter script with REJECT Gives those scripts for iptables (updated once in a while) : * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... * https://cdn.rawgit.com/smigniot/mu/ea0f32867907b855063c56ae8... To enable : * iptables -I OUTPUT -j no_facebook_out * iptables -I INPUT -j no_facebook_in * ip6tables -I OUTPUT -j no_facebook_out * ip6tables -I INPUT -j no_facebook_in By design, instagram and connect-with-facebook get muted too.

DavideNL on March 22, 2018 [–]

To get a list of all Facebook ip's:

  whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > facebook.list
  whois -h whois.radb.net '!6AS32934' | tr ' ' '\n' | grep '::' >> facebook.list

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact