Community discussions

MUM Europe 2020
 
azimut
just joined
Topic Author
Posts: 5
Joined: Sat Jun 01, 2013 9:29 pm

Blocking facebook

Thu Mar 09, 2017 6:56 pm

Hi everybody,
I try to blocking facebook page at Mikrotik RB951G-2HnD. I used google and I found many manuals but I can not blocking FB. Mikrotik use bridge for ether2-ether5. Eth1 is wan port and using Masquerade. Here is my scripts for blocking web page:
/ip firewall layer7-protocol> add name=facebook7 regexp="^.+(facebook.com).*$"
and
/ip firewall filter> add chain=forward src-address=192.168.0.0/24 layer7-protocol=facebook7 action=drop
Can I ask you for help? Thank you. Azi
 
R1CH
Forum Veteran
Forum Veteran
Posts: 913
Joined: Sun Oct 01, 2006 11:44 pm

Re: Blocking facebook

Thu Mar 09, 2017 7:21 pm

If you really must do this, the best way is to block Facebook's IP range.

https://developers.facebook.com/docs/sh ... rs/crawler
 
tr00g33k
Frequent Visitor
Frequent Visitor
Posts: 84
Joined: Sun Mar 29, 2015 3:58 pm

Re: Blocking facebook

Thu Mar 09, 2017 7:30 pm

I do this whit quit good results, like this:
 
 /ip fire address-list add list=Facebook address=facebook.com
 /ip fire address-list add list=Facebook address=facebook.de
 
and .ru => or whatever country you live in .ru => russia .de => germany etc

and after that:
/ip firewall filter add chain=forward src-address=LAN-Address dst-address-list=Facebook action=drop
This is quite good and simple solution, that works from 6.37.1 or something like this (when they addred dynamic address list updating)
 
msatter
Forum Guru
Forum Guru
Posts: 1354
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Blocking facebook

Thu Mar 09, 2017 9:42 pm

You're not even close. Facebook has many names
posting.php?mode=quote&f=13&p=586318
Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running:
RouterOS 6.46.1 / Winbox 3.20 / MikroTik APP 1.3.9
Android device owners, use https://github.com/M66B/NetGuard/releases (no root required)
 
User avatar
Jotne
Forum Guru
Forum Guru
Posts: 1314
Joined: Sat Dec 24, 2016 11:17 am
Location: jo.overland at gmail.com

Re: Blocking facebook

Thu Mar 09, 2017 11:36 pm

I think he is pretty close.

Just use the link in the post and add those name.
 
How to use Splunk to monitor your MikroTik Router

MikroTik->Splunk
 
 
azimut
just joined
Topic Author
Posts: 5
Joined: Sat Jun 01, 2013 9:29 pm

Re: Blocking facebook

Fri Mar 10, 2017 2:56 pm

HI thank you for your help. I find out my configuration was ok but I don't restart routerboard. After routerboard was blocking fb page.
Regars, Azi
 
Temorizador
just joined
Posts: 16
Joined: Fri Aug 25, 2017 6:25 am

Re: Blocking facebook

Wed Sep 13, 2017 5:20 pm

I do this whit quit good results, like this:
 
 /ip fire address-list add list=Facebook address=facebook.com
 /ip fire address-list add list=Facebook address=facebook.de
and .ru => or whatever country you live in .ru => russia .de => germany etc

and after that:
/ip firewall filter add chain=forward src-address=LAN-Address dst-address-list=Facebook action=drop
This is quite good and simple solution, that works from 6.37.1 or something like this (when they addred dynamic address list updating)
Thank you very much for having worked perfectly, adding the website to block , dynamically added all the ips of the page in question and then with the rule in filter it is very easy to block an entire domain.

running on 6.40.3 RB951G, greetings from spain

I do not use it to block facebook, but if porn pages, I do not want them to see small children at home (or visitors or public wifi cafe ,ect :-)), obviously blocking all the pages is impossible, blocking the main ones that come out in the searches I'm still in it xd : - ))

But it is perfect to block a page in question as facebok or youtube in an office so that employees are not distracted :-)

I personally do not work the block by layer 7: - ((((

greetings from Spain. and continue working people :-))
PD: my first post :-O
Temorizador
 
aliguven
just joined
Posts: 1
Joined: Tue Jul 24, 2018 4:23 pm

Re: Blocking facebook

Tue Jul 24, 2018 4:33 pm

1. IP > Firewall >Layer7 Protocols click + ,
write Name Facebook
write Regexp ^.+(facebook.com).*$
2. Address List click + ,
write Name yasak
write Address 192.168.2.20-192.168.2.254

3. Firewall Rule click + ,
Chain forward
in Advanced > Src. Address List choose yasak. in Layer7 Protocol choose facebook.
in Action> Action choose reject. in Reject with choose icmp admin prohibited.


Last İP > POOL 192.168.2.21-192.168.2.254. if you want facebook for some pcs, you can give the ip manuel and lower than 192.168.2.20.
if you want to add youtube etc. repeat 1 and 3. step.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24383
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Blocking facebook

Wed Jul 25, 2018 4:24 pm

that is bad advice and will:

- not work properly
- will slow down your router
No answer to your question? How to write posts
 
User avatar
AlainCasault
Trainer
Trainer
Posts: 627
Joined: Fri Apr 30, 2010 3:25 pm
Location: Laval, QC, Canada
Contact:

Re: Blocking facebook

Wed Jul 25, 2018 6:08 pm

MikroTik wrote a MUM presentation that gives excellent tips on that topic and others. Google "pdf" and "holy crusade".

Basically, just drop dns requests containing key words (facebook, netflix and others). Simpler, faster, cheaper cpu wise.

Funny title but Yanis M. is quite the passionate guy :)


Regards,

Sent from Tapatalk

___________________________
Alain Casault, Eng.
If I helped you, let me know!
 
R1CH
Forum Veteran
Forum Veteran
Posts: 913
Joined: Sun Oct 01, 2006 11:44 pm

Re: Blocking facebook

Wed Jul 25, 2018 7:25 pm

That doesn't really work when browsers like Firefox will soon be defaulting to DNS over HTTPS.
 
evil
just joined
Posts: 3
Joined: Wed Mar 23, 2016 6:55 pm

Re: Blocking facebook

Thu Nov 29, 2018 5:07 am

Hi
Does anyone know a solution for blocking FB that really works? I found some tips over the Internet, but not working.
@AlainCasault: can you please send me a link or something for your recommendation.
10x
 
User avatar
vecernik87
Long time Member
Long time Member
Posts: 649
Joined: Fri Nov 10, 2017 8:19 am

Re: Blocking facebook

Thu Nov 29, 2018 6:29 am

there is not really 100% working solution.
Closest is blocking with TLS-HOST because it works on HTTPS and does not consume too much CPU (at least not as much as L7 filtering which is useless anyway when FB works over HTTPS)


presentation: https://youtu.be/XkKj9rj4quQ?t=1511
/ip firewall filter add chain=forward dst-port=443 protocol=tcp tls-host=*.facebook.com action=reject

Please, keep in mind that many websites use facebook oauth login and with this, you will cripple them. Is it worth it? (That is just rhetorical question, I don't expect answer.)

Who is online

Users browsing this forum: marisv, oskarsk and 129 guests