-2

In my office, I have set up a linux machine as router and provide internet connectivity to all clients. Behind this linux router I have set up a cisco wireless router, with which I have made internet connectivity available to mobile phones of some employees in my office.

Now i want to block access to WhatsApp and other IM services (we chat, line). Is it possible to block these android applications using iptables?

masegaloeh
  • 18,236
  • 10
  • 57
  • 106
amrit
  • 39
  • 1
  • 1
  • 4
  • What is the name of the application you are trying to block? – MadHatter Dec 02 '13 at 08:25
  • whats app, we chat, line – amrit Dec 02 '13 at 08:26
  • OK. I'm not familiar with those particular apps, but the way this usually works is that you have to find out how those apps communicate with the internet. If it's to a particular centralised server or block of servers, you can block those with `iptables` by IP address. If it's to particular ports, you can block those ports. But if they use, say, regular HTTP to port 80, `iptables` can't help you, because it doesn't operate at the application layer. So step one is: find out how those apps communicate. – MadHatter Dec 02 '13 at 08:28
  • i know but it is quit difficult to get the ip addresses of theirs server. – amrit Dec 02 '13 at 08:30
  • i am using ntopng for monitoring all clients and i am not able to get ip addresses relating to these applications – amrit Dec 02 '13 at 08:35
  • 3
    The fact that its difficult doesn't alter the fact that this is what you need to do if you want to use IPtables. If you want to easily block these kind of web apps then you need to look at devices that allow you to filter by web app traffic pattern. – Rob Moir Dec 02 '13 at 08:35
  • i want to know , how can i prevent it by my linux router. i can easily block it if i got the ip addresses. – amrit Dec 02 '13 at 08:39
  • iptables alone would not work. It might make whatsapp less reliable and would make a support headache for you. overriding dns for them may help for desktops, but mobile clients will have cached dns from outside of your network or may be using their data cell network. Short of forcing all traffic through a mitm https proxy (expensive), there is no guarenteed solution. Most trendy things are on public cloud or CDN, so blocking IP's will block many other sites. overriding dns is probably your best poor man solution. – Aaron Apr 21 '17 at 14:36

6 Answers6

8

It looks like this application has been designed to try and avoid being blocked.

You could block this at layer 8 using an AUP that employees sign up to, which excludes using your equipment for services like this and which details sanctions for breach of said policy. This is the best solution as, when all is said and done this is a management issue not a technical one.

You could try layer 7 blocking DNS packets that request addresses in the whatsapp.net/.com/.whatever domains (sro.whatsapp in particular may be useful to block).

It uses ports 80,443,5222,5223 and 5228. You may get some mileage blocking some of them but it's unlikely you'll be able to block 80,443 reasonably.

I've read that some people have had success by blocking the whole of 184.173/16 but if that's a bit blunt then ipdb.at have a list too.

Community
  • 1
user9517
  • 115,471
  • 20
  • 215
  • 297
4

Apply a filter using the official IP list: https://www.whatsapp.com/cidr.txt

Use QoS instead of blocking.

brauliobo
  • 187
  • 8
1

Like @Iain says, this should be solved at layer 8. But if you insist on a technical solution, you can also mandate that all wireless traffic must go through a proxy you control, and you can block WhatsApp traffic on that proxy.

Dennis Kaarsemaker
  • 19,277
  • 2
  • 44
  • 70
0

I'm not sure how relevant this will be, but I wanted to block of WeChat from the network. What I did to achieve this was trace the connection and lookup the IP device were using to connect to the chat server. After obtaining this IP, I did a IP range lookup and simply block the whole range this IP came from.

It's been working like a charm.

I assume you can do the same for any other chat applications.

For Wechat is the range '203.205.160.0 - 203.205.167.255' which is own by Tencent which is the company that owns Wechat.

I think this IP range might change overtime, so might need to update once a while.

The IP range will most likely be different depending on your locale and region. The range above might not work for everyone.

Hope this is helpful for someone down the road.

Jun Zheng
  • 101
0

I'd suggest using netfilter_ndpi, which is basically a deep packet inspection module. You can get the source directly from github. After you've built the module for xtables (iptables & ipv6tables) you can just apply your rules like the following example:

iptables -N applied_filter

iptables -A FORWARD -j applied_filter

iptables -A applied_filter -m ndpi --proto whatsapp,whatsapp_voip -j REJECT

iptables -A applied_filter -j ACCEPT

The only issue with this is that you'll have to keep the module up-to-date manually, as protocols are not static and change frequently.

If you have already a set of iptables rules then you'll have to avoid the conntrack module, as ndpi needs a few sent packets to recognize the protocol and conntrack bypasses the ndpi module.

I hope that I was able to help.

ViktorAs
  • 1
  • 1
-1

suggesting the ports TCP/5222, TCP/5223 and TCP/5228 as needed for Whatsapp.

So try to block those ports.

OR

c.whatsapp.net - WhatsApp Sever which is used for connection.

WhatsApp connects first then logs in, then reading/writing data will be done. So blocking this stops at the initial stage.

Don't have any idea of other IM's wechat, hike, line, etc but whatsapp network communition could be blocked.

Gaurav Padawe
  • 1