Blacklisting domains; Stopping them from opening from my Debian 10 OS computer

drlivingstone · 04-08-2023, 09:26 AM

Newbie here.

What I am trying to do:
I am trying to make certain sites unreachable from my computer (just blacklist those domains). I was also considering making them unreachable at certain times of the day, but making them unreachable in the first place isn't even working with what I found and tried. I don't want to use addons or extensions for browsers as all I've looked at note that they will access to all my data, and I don't like that. I would like to resolve this through iptables if possible but if not I am open to other approaches, but its just that Ive devoted too much of my time to this approach already.

What I've done first:
Firstly, I've searched this forum and looked and tried the proposed solutions on several pages of posts about the topic (as well in "Click here to find similar threads button") and could not find anything that gave me a solution to my problem (opened sites and youtube links about this to check those as well) - for some reason unknown to me, the proposed solutions wouldn't work for me, so apologies if I missed some solution already given. :/

My setup:
My system is Debian GNU/Linux 10 (buster). My computer doesn't have wireless capability but is connected to the router over an Ethernet cable and that works fine. I am not connected through some VPN or something (not that I know of). I've used “ip link show” command in terminal to show me the MAC address of my system:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether <shows me my MAC address here; omitted by me> brd ff:ff:ff:ff:ff:ff

What I've tried:

First, I've created a iptables list:
sudo iptables -N bslist

I've tried to create a blocking of a site from my system using the following command (didn't work):
sudo iptables -I bslist -p tcp -m mac --mac-source <my MAC address here; omitted by me> -m string --string "https://www.reddit.com/" --algo kmp -j REJECT

Note: For each following step all the previous iptables entries done by me were replaced or deleted so they could not interfere.

I've also tried it sans the MAC address(also didn't work):
sudo iptables -R bslist 1 -p tcp -m string --string "https://www.reddit.com/" --algo kmp -j REJECT

I've also tried to edit the hosts file to redirect it to 127.0.0.1 (also didn't work):
sudo nano /etc/hosts
127.0.0.1 https://www.reddit.com/
I've also tried a variant of this without the https://www
127.0.0.1 reddit.com
still didn't work

Finally I tried:
sudo iptables -I bslist -s www.reddit.com -j DROP

Would anyone kindly help me find a solution for this? Thank you.

P.S. If someone could help me on how to set rules for blocking the sites at certain times of the day, that would be a great bonus, but I would be just as satisfied with knowing how to block a website in the first place.

smallpond · 04-14-2023, 08:17 AM

Have a read through this thread: https://www.linuxquestions.org/quest...omains-888816/

jayjwa · 04-18-2023, 12:13 PM

There's likely a way to do the time thing, but I don't know what it is. Note Reddit has multiple hostnames and multiple addresses, on both ipv4 and ipv6. A DNS blocklist is like so:

Code:

127.0.0.1  reddit.com
127.0.0.1  www.reddit.com

Note that if you are doing DNS caching (like nscd) you will need to clear the cache. With iptables you need to match on the hostname(s), and block both ipv4 and ipv6 (with ip6tables).

Code:

iptables -A OUTPUT -d reddit.com -p tcp -j NFLOG --nflog-prefix "Reddit: "
iptables -A OUTPUT -d www.reddit.com -p tcp -j NFLOG --nflog-prefix "Reddit: "
ip6tables -A OUTPUT -d reddit.com -p tcp -j NFLOG --nflog-prefix "Reddit: "

ip6tables -L OUTPUT -n -v
Chain OUTPUT (policy ACCEPT 21633 packets, 9416K bytes)
 pkts bytes target     prot opt in     out     source               destination
   36  4000 NFLOG      6    --  *      *       ::/0                 2a04:4e42:200::396   nflog-prefix "Reddit: "
 2737  229K NFLOG      6    --  *      *       ::/0                 2a04:4e42:400::396   nflog-prefix "Reddit: "
   43  4969 NFLOG      6    --  *      *       ::/0                 2a04:4e42:600::396   nflog-prefix "Reddit: "
    0     0 NFLOG      6    --  *      *       ::/0                 2a04:4e42::396       nflog-prefix "Reddit: "

iptables -L OUTPUT -n -v
Chain OUTPUT (policy ACCEPT 136K packets, 73M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 NFLOG      6    --  *      *       0.0.0.0/0            151.101.129.140      nflog-prefix "Reddit: "
  184 13147 NFLOG      6    --  *      *       0.0.0.0/0            151.101.193.140      nflog-prefix "Reddit: "
   59 38547 NFLOG      6    --  *      *       0.0.0.0/0            151.101.1.140        nflog-prefix "Reddit: "
   15  1520 NFLOG      6    --  *      *       0.0.0.0/0            151.101.65.140       nflog-prefix "Reddit: "
   15  1520 NFLOG      6    --  *      *       0.0.0.0/0            151.101.65.140       nflog-prefix "Reddit: "
    0     0 NFLOG      6    --  *      *       0.0.0.0/0            151.101.129.140      nflog-prefix "Reddit: "
  184 13147 NFLOG      6    --  *      *       0.0.0.0/0            151.101.193.140      nflog-prefix "Reddit: "
   59 38547 NFLOG      6    --  *      *       0.0.0.0/0            151.101.1.140        nflog-prefix "Reddit: "

If you really want to block instead of logging like the example, change "-j NFLOG" to "-j REJECT" with nothing after it. See 'man iptables' for REJECT target options or maybe use DROP target. iptables -F OUTPUT to clear.

hazel · 04-19-2023, 01:26 AM

What about using the /etc/hosts.deny file? Then if you wanted to make it time-dependent, you could have a cron job that modifies the file at certain times of day.

jayjwa · 04-19-2023, 01:03 PM

Quote:

Originally Posted by hazel

What about using the /etc/hosts.deny file? Then if you wanted to make it time-dependent, you could have a cron job that modifies the file at certain times of day.

That only blocks hosts reaching in to you, not you reaching out (outbound). Not all things respect hosts.deny either.