-1

I am using OpenWRT router. I need to block a URL or multiple URLs (Not IP) for specific time. for example, I want to block facebook.com so that clients of this router cant access the website. firewall rules should have the option to do that but I dont know how to do that.

Raihanhbh
  • 77
  • 1
  • 10

1 Answers1

0

Here is one way to block by domain name rather than by IP address.

The main reason of why you need such a complicated method is that each domain name (e.g. facebook.com) may be resolved as different IP address at any given time. So, we need to keep a list of resolved IP addresses and add iptables rules based on this list.

First, you should enable logging in dnsmasq config:

uci set dhcp.@dnsmasq[0].logqueries=1
uci commit dhcp
/etc/init.d/dnsmasq restart

This will give you log entries like:

daemon.info dnsmasq[2066]: reply facebook.com is 31.13.72.36

Now, you just have to constantly parse syslog and add corresponding iptables rules like this (note that you most likely need a more versatile script and ipset for better performance):

logread -f | awk '/facebook.com is .*/{print $11}' | while read IP; do iptables -I OUTPUT -d $IP -j DROP; done
Vasily G
  • 859
  • 8
  • 16
  • I have got another option to do that instead of directly accessing iptables. We can use proxies. tinyproxy might be a good choice. – Raihanhbh Oct 19 '16 at 04:13