To block youtube

hadolfov · 02-22-2008, 01:14 PM

Hello!
i need to block youtube, so anybody in my network can access it, i have add this lines to mi firewall script, but dont work.

${IPTABLES} -A INPUT -s 208.65.153.253 -j DROP
${IPTABLES} -A OUTPUT -d 208.65.153.253 -j DROP
${IPTABLES} -A INPUT -s 208.65.153.251 -j DROP
${IPTABLES} -A OUTPUT -d 208.65.153.251 -j DROP
${IPTABLES} -A INPUT -s 208.65.153.238 -j DROP
${IPTABLES} -A OUTPUT -d 208.65.153.238 -j DROP

Any idea?

Thank you!

anomie · 02-22-2008, 01:28 PM

Not enough info -- you're appending rules, so we need to see the rules that precede it. Post the results of # iptables -nvL (in code tags so that it's readable).

osor · 02-22-2008, 01:53 PM

Quote:

Originally Posted by anomie

Post the results of # iptables -nvL (in code tags so that it's readable).

Usually easier to read is the output of iptables-save.

anomie · 02-22-2008, 02:01 PM

To each his own. I don't like the format as much, but either will do.

win32sux · 02-22-2008, 04:58 PM

This is definitely not something you'd wanna do with iptables. You'll never be able to keep up with all the IPs. A proxy server is much better suited for this, as you'd just block "youtube.com" without having to worry about any IPs.

Having said that, you mentioned a "network" yet you posted INPUT/OUTPUT rules. If this is a network firewall you'd need to use the FORWARD chain instead of INPUT/OUTPUT. That might explain why your rules aren't having any effect.

custangro · 02-22-2008, 05:40 PM

If you host your own DNS you can "poison" your DNS by making a zone for youtube. Then point it at 127.0.0.1. Also you can do this with /etc/hosts if this is a standalone machine.

-C

internetSurfer · 02-22-2008, 05:59 PM

"YouTube.com owns the entire 208.65.153.0 to 208.65.153.255 range,
so you can use a firewall rule to block all TCP connections on
Port 80 (or more if you want to block everything possible) using
the CIDR of 208.65.153.0/24"

_

win32sux · 02-22-2008, 06:07 PM

Yeah, if you are 100% positive that youtube.com only uses 208.65.153.0/24 then you should be able to cut your network clients off from it by using something like:

Code:

iptables -I FORWARD -i $LAN_IFACE -o $WAN_IFACE -d 208.65.153.0/24 -j REJECT

They will, of course, still be able to bypass the restriction by using VPN, Tor, a remote proxy, etc.