How to block Facebook access on tomatoe router

I have set up an access restriction rule to block the following...

m.Facebook.com
$Facebook.com
Facebook.com

From what I can tell though, the user is still access Facebook mobile from their motorola blur running android app.

How can I make sure IOS and ANDROID apps cannot access Facebook? There has to be some filter or IP address's related to Facebook that would make their app not log in/work.

Thanks.

Quote from nafaught : I have set up an access restriction rule to block the following... m.Facebook.com $Facebook.com Facebook.com From what I can tell though, the user is still access Facebook mobile from their motorola blur running android app. How can I make sure IOS and ANDROID apps cannot access Facebook? There has to be some filter or IP address's related to Facebook that would make their app not log in/work. Thanks.

My guess is because you are only blocking 3 urls. I would not be surprised that the app uses something like mob.facebook.com (as an example). Also there is nothing stopping me from going to en-gb.facebook.com (uk page) and so on. Your best be is to blocking via wild card *.facebook.* (replacing * with what ever the wild card is). Also to block facebook's ip's which you are going to have to look up.

If you plan on blocking a lot of pages I would also look in to setting up an opendns account and set your router to pull dns records from them. This way you can easily block out things like porn and any other webpages you want (like facebook).

And to be honest you want to see how they are connecting? Just pull up wireshark and watch the network stream as they are connecting to facebook it will tell you everything you need to know. Now since this sounds like a work environment you should have your users sign an acceptable use agreement and when they violate the agreement just kick them off the network (which I don't under stand why you are not blocking them from connecting anyway).

Quote from nafaught : I have set up an access restriction rule to block the following... m.Facebook.com $Facebook.com Facebook.com From what I can tell though, the user is still access Facebook mobile from their motorola blur running android app. How can I make sure IOS and ANDROID apps cannot access Facebook? There has to be some filter or IP address's related to Facebook that would make their app not log in/work. Thanks.

A screenshot of the Access restriction rule page and the info on how those mobile devices are connected to Internet would be helpful.

Of course, if the user uses the FB explicit IP address (e.g., 66.220.158.11), all your efforts are futile. You need to block their IP address(es), not just the domain name(s).

Quote from eibgrad : Of course, if the user uses the FB explicit IP address (e.g., 66.220.158.11), all your efforts are futile. You need to block their IP address(es), not just the domain name(s).

You think they would hard code the IP in to the app? would kill region load balancing and what not. Though I do agree he should also block the IP's

69.171.229.11 and 66.220.149.11 For facebook.com
69.171.234.72 For m.facebook.com

So looks like you will have to block a few IP's op, your best bet is to setup opendns to block by dns, then use wireshark to get the page they are connecting to and block that IP.

Quote from mrbobhcrhs : You think they would hard code the IP in to the app? would kill region load balancing and what not. Though I do agree he should also block the IP's 69.171.229.11 and 66.220.149.11 For facebook.com 69.171.234.72 For m.facebook.com So looks like you will have to block a few IP's op, your best bet is to setup opendns to block by dns, then use wireshark to get the page they are connecting to and block that IP.

A determined user quickly learns ways around most obstacles, so yeah, I wouldn't doubt they'd attempt to use the explicit IP. Also, multiple IPs isn't the only means to load balancing. For all we know, they all lead to cachefly machines performing their own load balancing.

Btw, another way the user can avoid your filtering is to use a VPN service, or even TOR [torproject.org]. Not only will they have access to FB, you won't even know it.

That's why most of these things are only effective w/ naive users. It's almost impossible to stop someone who's really determined and has some basic skills. There are just too many ways to circumvent your filters.

Quote from eibgrad : A determined user quickly learns ways around most obstacles, so yeah, I wouldn't doubt they'd attempt to use the explicit IP. Also, multiple IPs isn't the only means to load balancing. For all we know, they all lead to cachefly machines performing their own load balancing. Btw, another way the user can avoid your filtering is to use a VPN service, or even TOR [torproject.org]. Not only will they have access to FB, you won't even know it. That's why most of these things are only effective w/ naive users. It's almost impossible to stop someone who's really determined and has some basic skills. There are just too many ways to circumvent your filters.

I agree, I have SSH my way around filters a few times. Thus why I said just to ban the user since they repeatedly break the rules. Then again I don't see why a user needs/ was allowed to be on the wifi from his phone anyway...

I think I agree. A wifi ban for the cell phone is the only sure fire way.

Thanks.

OpenDNS is a good way to do this, its free quick and easy to configure. You can also block other things that might not be wanted in a business or family situation like porn, malware, alcohol pages, gambling, etc.

Not sure if this is a business situation or home situation but blocking facebook from a cell phone is dang near impossible if you don't own the phone. The user can always disconnect from wifi and use 3G Service to get back on it.

Quote from nafaught : I think I agree. A wifi ban for the cell phone is the only sure fire way. Thanks.

But they could just access it over the cell network, how the heck is that going to accomplish anything?

No offense but this just sounds like over parenting. Even if you block it at your house whats stopping them from using a friends phone or a friends computer.

If it's a business environment and a personal device, they'll just use cell data, so why bother?

This sounds like an employee handbook issue, not a network issue.

yes it is pretty funny asking how to block access to facebook on a phone, they don't have to use wireless to get to it?

IP range to block


66.220.144.0 - 66.220.159.255
69.63.176.0 - 69.63.191.255
204.15.20.0 - 204.15.23.255

Quote from nizzy1115 : No offense but this just sounds like over parenting. Even if you block it at your house whats stopping them from using a friends phone or a friends computer.

This.

Take their cellphone away if you're that adamant about them not connecting to Facebook.