Facebook blocking

[vhinzsanchez]

Great! Let us know of the outcome!

[GG_jr (Gabriel GHEORGHIU)]

Hi Lewis,

I have blocked Facebook access for GREEN using the following settings.
It works with or without “Block HTTP and HTTPS ports” enabled.

But, with this configuration (“Transparent with SSL” with or without “Block HTTP and HTTPS ports” enabled), I have a problem regarding Google Translate (till now) but I’m sure may be and other dysfunctions regarding sites. I will open another post with this but I want you to know about that.

[alefattorini (Alessio Fattorini)]

That’s a good FAQ! Remind that with Transparent SSL you’re forced to install the certificate into your client

[GG_jr (Gabriel GHEORGHIU)]

@alefattorini

Remind that with Transparent SSL you’re forced to install the certificate into your client

Hi Alessio,

You are right!

[Lewis]

@vhinzsanchez I have not tried his method, having problems understanding. How do I add all the IP/CIDR? It looks like I have to add one at a time in Firewall Objects>CIDR Subnets, once that done how do I link them all to a group?

@GG_jr gave you method a go, and it didnt work, dont know if I did something wrong.
How do i force my certificate to be installed, I have tried and having no luck. Using Firefox

[GG_jr (Gabriel GHEORGHIU)]

@Lewis

How do i force my certificate to be installed, I have tried and having no luck. Using Firefox

1. Remove from Firefox → Options → Advanced → Certificates → View Certificates, any certificate regarding NS.
2. In NS GUI → Web Proxy: right click on “http://your_ip/proxy.crt” and “Open Link in New Tab”.
3. Save the certificate.
4. Import the certificate as Trusted Authorities.
5. Restart Firefox (Optional).

[alefattorini (Alessio Fattorini)]

Ehi man, those are good explanations! Please take some time to create a new page on our wiki

[GG_jr (Gabriel GHEORGHIU)]

@GG_jr

But, with this configuration (“Transparent with SSL” with or without “Block HTTP and HTTPS ports” enabled), I have a problem regarding Google Translate (till now) but I’m sure may be and other dysfunctions regarding sites. I will open another post with this but I want you to know about that.

I found the problem:

Do not enable “Block porn sites by regular expressions on URL”.

If you want to block porn sites, choose from “Categories”.

With “Block porn sites by regular expressions on URL” enabled, also blocked and this:
http://docs.nethserver.org/en/latest/base_system.html?highlight=services#network-services

when I want to open from here:

How to deny access to unsecure ports in the network services or firewall settings?

Hi again, I am migrating from opensuse to nethserver. Actual I am working on migrating my firewall settings. I have seen that you can do some settings at the network services tab. But there you can only allow or deny dovecot with all ports(110,143,4190,993,995). Same thing with HTTP. I want to allow only secure ports. I tested with creating a firewall rule with deny on port 110, but that didn’t work. I think because the network settings override my own firewall rule. Is there any way to impl…

[GG_jr (Gabriel GHEORGHIU)]

@Lewis

How do i force my certificate to be installed, I have tried and having no luck. Using Firefox

Another How To: Problem with ssl bump on Firefox 39+

TIP: If you have installed any AV that scan SSL, disable this option!

[GG_jr (Gabriel GHEORGHIU)]

Hi everybody,

Another TIP regarding blocking Facebook through Web proxy -> Transparent with SSL and Web filter:

If you want to access different media web sites who have “Comments” section made with “Facebook Comments Plugin”, you will not be able to see or access that section.

This is available for any other combination (Blocking Twitter and Twitter Plugin, …).

Kind regards,
Gabriel

[Nas (Artem Fedai)]

Unfoturnatelly it is whole stystem blocking, but TS ask about how to block certain user. So only firewall rules.

[GG_jr (Gabriel GHEORGHIU)]

@Nas

Unfoturnatelly it is whole stystem blocking, but TS ask about how to block certain user. So only firewall rules.

Yes, but even those users will be not able to see that section.
Is the same thing but only for a few users. Or not?

[ikari84 (Manuel Esquivel)]

the one way to resolve this problem (for me), was use the iptable:

iptables -I FORWARD -s 192.168.1.1 -p tcp --dport 443 -m string --string ‘facebook’ --algo bm -j DROP

Or other case, block all and allow some IP connect.
#Block all
iptables -I FORWARD -p tcp --dport 443 -m string --string ‘facebook’ --algo bm -j DROP
#Allow IP
iptables -I FORWARD -s 192.168.1.123 -p tcp --dport 443 -m string --string ‘facebook’ --algo bm -j ACCEPT

This way you keep using the transparent proxy without ssl.

Regards…