Firewall to block Facebook but allow WhatsApp?

Hi,
I’m not a super-user, so getting the firewall rules working was a learning curve. They are, however, now working, and I can schedule them as I need. Basically, I want to block access to social media when we should all be sleeping. And I’ll probably restrict myself even further.

However: with a load of Meta IP addresses in the address list, WhatsApp becomes slow. It connects eventually, but that’s not ideal. I want WhatsApp to be allowed always.

But my understanding is that Meta uses a bunch of IP addresses and all their different services use them. So is there a way of blocking Facebook but not WhatsApp?

(I was steered away from Layer7 blocking to avoid CPU loading.)

Is there an elegant way to do it, please?

How do the users get their access, if by WIFI, then turn off access point or WLANs at a certain time.

I’m using AdList in combination with a social media list I gathered. During a specific time (I enable/disable the list with scheduler) these (social media) names are resolved to 0.0.0.0. This way you can target names instead of IP addresses. Disadvantage is the TTL and caching you have to take into account. Besides having clients set their DNS statically…

WiFi. Can’t turn the wifi off, for multiple reasons. Too many things in the house rely upon it, automation etc. And my other half uses it for work at odd times, so that wouldn’t play well. On top of that, phones would then fall back to mobile phone coverage, which works well enough.

No, in this instance, it’s primarily a self discipline issue for myself. And while there are multiple ways I could defeat it, of course, there is for some reason enough friction to help me avoid things like Facebook.

This is beyond my current level of "expertise"!

I'll do some googling...

https://help.mikrotik.com/docs/spaces/ROS/pages/37748767/DNS#DNS-adlistAdlist
http://forum.mikrotik.com/t/dns-adlist/182701/1

You can compare it to AdGuard and PiHole, it’s a way to prefend users from accessing all kind of content through DNS.

Without a router with (DPI) and like services that looks at encrypted packets there is no foolproof way…

Who am I to judge? No one, of course.

Delete Facebook and fix the problem.
If it’s addictive, it will surely ruin your life in one way or another.
If you don’t have enough willpower, deactivating Facebook on this way (if possible),
is like putting the bottle on the high shelf at a certain time for an alcoholic.
Hypothetically in the alcoholic’s mind the effort to reach the bottle should make him give up, but the very existence of the bottle for the addict is a reason for craving.

How long do you think you can survive without Facebook, when you just need to turn off wifi on your smartphone and use mobile data directly?

I use this firewall on my router, so far its work, cmiw

/ip firewall layer7-protocol
add name=facebook regexp=“^.+(www.facebook.com|facebook.com|login.facebook.com
|api.facebook.com|www.login.facebook.com|fbcdn.net|www.fbcdn.net|fbcdn.com
|www.fbcdn.com|static.ak.fbcdn.net|static.ak.connect.facebook.com|connect.
facebook.net|www.connefacebook.net|apps.facebook.com|id-id.facebook.com|we
b.facebook.com).*$”


/ip firewall address-list
add address=dixonscarphone.facebook.com list=facebook
add address=edge-mqtt-p46-shv-01-hkg3.facebook.com list=facebook
add address=edge-snaptu-http-p4-shv-01-amt2.facebook.com list=facebook
add address=edge-star-mini-shv-02-gru2.facebook.com list=facebook
add address=edge-star-mini6-shv-01-nrt1.facebook.com list=facebook
add address=edge-star-z-mini-shv-01-gru2.facebook.com list=facebook
add address=fbonly-test-bgp-02-sin6.facebook.com list=facebook
add address=livestream-edgetee-upload6-shv-02-ort2.facebook.com list=facebook
add address=star.facebook.com list=facebook
add address=a.ns.facebook.com list=facebook
add address=b.ns.facebook.com list=facebook
add address=c.ns.facebook.com list=facebook
add address=d.ns.facebook.com list=facebook
add address=edge-star-mini-shv-01-frx5.facebook.com list=facebook
add address=edge-star-mini-shv-01-nrt1.facebook.com list=facebook
add address=edge-star-mini-shv-01-sea1.facebook.com list=facebook
add address=edge-star-mini-shv-02-lax3.facebook.com list=facebook
add address=edge-star-mini6-shv-01-frx5.facebook.com list=facebook
add address=edge-star-mini6-shv-01-sea1.facebook.com list=facebook
add address=edge-star-mini6-shv-02-gru2.facebook.com list=facebook
add address=edge-star-mini6-shv-02-lax3.facebook.com list=facebook
add address=www.facebook.com list=facebook
add address=m.facebook.com list=facebook
add address=star.c10r.facebook.com list=facebook
add address=star-mini.c10r.facebook.com list=facebook
add address=facebook.com list=facebook
add address=mqtt.c10r.facebook.com list=facebook


/ip firewall mangle
add action=mark-connection chain=prerouting comment=FB dst-address-list=
facebook dst-port=80,443 new-connection-mark=facebook_conn passthrough=
yes protocol=tcp src-address-list=local
add action=mark-connection chain=prerouting dst-address-list=facebook
dst-port=80,443 new-connection-mark=facebook_conn passthrough=yes
protocol=udp src-address-list=local
add action=mark-packet chain=prerouting connection-mark=facebook_conn
new-packet-mark=facebook passthrough=no


/ip firewall filter
add action=drop chain=forward dst-port=80,443 layer7-protocol=facebook
protocol=tcp src-address-list=local
add action=drop chain=forward dst-address-list=facebook dst-port=80,443
protocol=tcp src-address-list=local
add action=drop chain=forward dst-address-list=facebook dst-port=80,443
protocol=udp src-address-list=local
add action=drop chain=forward packet-mark=facebook



And set dns-static :
/ip dns static
add address=127.0.0.1 name=facebook.com