Hacker News Reader

Comment by marios | Hacker News Reader

Not the way I'd do it, since you can easily miss on some new domain that belongs to facebook (or perhaps some server that does not look like it belongs to facebook in the first place, but it is sitting in their assigned subnets).

If you really want to block all traffic from/to facebook, lookup the IP prefixes associated with their AS number(AS32934), and setup your firewall to block those. If you are using PF, tables are your friend. With netfilter, consider using ipset.

View on HN

Very interesting after looking up the AS number [1] you provided it includes domains that are not on that GitHub list - as you mentioned. I would have to agree with this being the better method to blocking facebook.

[1] http://www.tcpiputils.com/browse/as/32934 * note there are more than average ads on this site and it's a bit plain but this was the only one I could find that, with my brief searching, showed ip prefixes associated to the AS number.

If anyone has a better lookup tool that'd be great!

edit: Should also note that since other users are mentioning they might be under multiple AS number's maybe the ticket would be to setup a GitHub that collected these AS numbers for FB.

edit 2: found a less ad filled site! http://ipduh.com Search AS32934 click "prefixes" at top

https://ipinfo.io/AS32934

You can also confirm this is the only ASN for Facebook by searching for Facebook at https://ipinfo.io/countries/us

It's also possible that Facebook has prefixes they use that are announced by ASNs other than their own.

Like this [1], More details at [2]

[1] http://www.commandlinefu.com/commands/view/16096/block-all-f...

[2] http://www.tcpiputils.com/browse/as/32934

Why would you wait and drop the traffic inbound? Why would you let your browser send the SYNs at all? This rule doesn't make any sense.

Because most people don't block outbound and certainly not in a stateful way which means it's a poor place or a blacklist. To get this to work outbound, you need to allow all other traffic out (fine that's probably what you are doing already) or have a curated whitelist of other traffic allowed out. I assume this package doesn't want to make that assumption so the safe thing to do is to make an inbound blacklist.

That doesn't make any sense. You can block outbound just fine by having your block rules followed by a default allow. You don't need anything to be stateful when you are blocking whole IP addresses.

So this has to assume that it's not a whitelisting setup and put a default allow. Which if you do outbound whitelisting, kinda fucks things up.

Nothing prevents you from having explicit deny rules followed by explicit allow rules followed by default deny.

And if you're already doing outbound whitelisting (which is generally much more trouble than it's worth) then unless you put Facebook on the whitelist you don't need to do anything anyway.

Smart, even this list forgets national domain names belonging to Facebook. For example Facebook.no which is owned by a rather anonomous company (lovellsnames.org /Low Gravity Limited), yet the domain appears to be used by FB and God knows how many subdomains under there again there are.

I'm surprised that AS-based blocking tools aren't already more prevalent and readily available.

AS information isn't trivially available, though you can do a pretty good job through tools like the CIDR Report and ASN Routeviews.

There are quite substantial portions of the Internet to which I'd generally provide very little or very limited access if I had my druthers.

ARIN, et al, provide WHOIS servers that will map IP address information to ASNs. The list of all registered ASNs is also public. Also, there are routing registries which can provide even more information on which ASNs announce which prefixes.

Most of what you'd want is out there, but you might have to obtain it all and doing a bit of work to combine/correlate i all.

That's kind of what I was trying to say.

Blocking at the firewall works best for me. If any OS X users want to know how, I've covered it here: https://www.perpetual-beta.org/weblog/blocking-facebook-on-o...

Awesome, thanks for posting this, i have been searching for exactly this...!

You're very welcome. :-)

completely agree. unfortunately dnsmasq, firewalls, running your own bind, or PF, table, or the other solutions you mention -- these all require a level of technical expertise far, far beyond the norm, or even 2 standard deviations above the norm of Internet users' technical ability (for some of them, including me). I had maintained the Facebook blocklist for hosts files because it was super simple for me to use, and to share with others.

definitely not ideal, not even complete, and requires work - BUT, nearly any Internet user can implement the solution done this way.

It would be really interesting to autogenerate the domain lists by running background scripts on AS numbers, polling DNS for every IP in the range, and cataloging the domains by script - say, daily, and then printing the list into a 0.0.0.0 prefixed hosts list. Thank you!

disclaimer: github user maintaining linked resource

Facebook only has one AS?

That's not uncommon.

Most likely yes. There are only about 50k public autonomous systems on the entire Internet. The problem of course is already mentioned by another commenter: some FB assets are in other ASes.

https://en.m.wikipedia.org/wiki/Autonomous_system_(Internet)

Yes, http://ipinfo.io/AS32934. True for most organizations: http://ipinfo.io/countries/us

That's fairly typical.

An AS (identified by an ASN) is an autonomous system. It's comprised of multiple CIDR blocks, contiguous regions of IP addresses. The network definition (by CIDR block) is fairly dynamic, as blocks can be added, deleted, or consolidated.

An autonomous system is a single administrative domain over public IP space. Essentially, autonomous systems are what the Internet is inter-networking between, through BGP (border gateway protocol). BGP and AS are what Cisco (and other router) gear are ultimately all about.

So yes: organisations typically have one AS. Exceptions are typically the result of corporate mergers (not uncommon) or government space (where the domains are large).

(Disclaimer: I'm not a networking bithead, don't muck with routers much, and have a rough knowledge of much of this, though it should be vaguely accurate.)

And if you end up with more than one AS due to a merge, you usually pick one them as your primary and connect the other ones to it, then announce their prefixes from your primary, ie. your primary AS becomes transit for your other ones. That way you only have to maintain one external border.

Right. Since Facebook has

    fdda274d380ki4frcgi-rumjfjai1460158783-sonar.xx.fbcdn.net

there are probably many more like that.

If they use a CDN that CDIR doesn't belong to FB you're screwed. afair they're using Akamai

what's AS number? how can I find out what a AS number for a domain or ip address is?

You can use https://ipinfo.io - either search at https://ipinfo.io/countries/us, or use the API (note the org field):

    $ curl ipinfo.io/`dig +short facebook.com | head -n1`
    {
      "ip": "69.171.230.68",
      "hostname": "edge-star-mini-shv-17-prn1.facebook.com",
      "city": "Menlo Park",
      "region": "California",
     "country": "US",
      "loc": "37.4590,-122.1781",
      "org": "AS32934 Facebook, Inc.",
      "postal": "94025"
    }

See https://ipinfo.io/developers for more details

ipinfo.io retrieves this information from somewhere. can I and how obtain this information myself, from the very source?

http://lmgtfy.com/?q=AS+number

etc.

https://en.wikipedia.org/wiki/Autonomous_system_(Internet)

maybe you know.

can I and how obtain this information myself, from the very source, for a given domain name or company or whatever it is?

I was at a hackathon a few weekends ago, and to my surprise I needed to register a domain name and get an SSL certificate for it.

I thought I was unreconcilably blocked for the duration of the hackathon, as DNS propagation disclaimers give itself 72 hours, and SSL certificates require who knows what.

I was able to get a completely new domain with Amazon Route 53 and Amazon's free SSL certificates in 20 minutes.

So yeah, I would say these blocklists are futile now, in OP's format.

Reply on news.ycombinator.com