Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to pop up.
Is there any easy way to find out all the IPs that Facebook, Myspace, Snapchat etc uses?
There are several ways to find the IP ranges of major organizations such as Facebook. The most basic of these, is to open up your terminal/command line of choice and issue the command: nslookup facebook.com.
This gives you the associated IP address to that DNS name; in this case, 173.252.110.27 was the answer from my DNS server.
Then run a "whois" lookup for that IP address (you can go to Whois.net if you don't have a whois tool in your command line): whois 173.252.110.27
The relevant output in this case is:
NetRange: 173.252.64.0 - 173.252.127.255
CIDR: 173.252.64.0/18
OriginAS: AS32934
NetName: FACEBOOK-INC
Facebook has been assigned the entire /18 block of 173.252.64.0/18, so simply use that range for your ACL.
Note: With all of that stated, blocking by IP can become cumbersome very quickly, and is highly ineffective in many cases. Organizations the size of Facebook will constantly be adding new IP space, which will be outside of your filtered range.
Some sites might change to using a new CDN, which of course will use a different IP space as well.
If you're having specific issues with your HTTPS and URL blocking, depending on the equipment, you could ask in another question for assistance on those specific problems. The answers might better aid you in blocking access to these sites.
whois lookups, for the few ranges that I spot checked, do list Facebook as the assigned organization. In my experience HE's BGP Toolkit does a good job of giving accurate information.
Sep 4, 2013 at 5:03
To block an unacceptable website you would normally use a proxy server or web filtering firewall. Either by forcing everybody to use the proxy and blocking the normal access to the web or use a firewall and block the offending URL(s). Using IP addresses is never a good option for websites as these addresses can change very often for big sites (when they switch to/from CDNs, when they add another cluster that's nearer at your location, etc.).
Finding out all IP addresses a big website uses is very difficult with big players like Facebook and Google. Also there are many services who can be used as a proxy to access these sites despite you blocking the IP.
I've been using NBAR to throttle Facebook, but you can tweak it to block. This will only work on plain-text HTTP requests which effectively blocks someone entering the address in the browser before a redirect to HTTPS can take place. SSL (TLS) bookmarks to FB would be missed.
You could also look at the new ASA-X CX (Context Aware security) that should be able to handle this, though I haven't deployed this yet.
class-map match-any facebook-not4you
match protocol http host "*facebook.com"
match protocol http host "*fbcdn.net"
!
policy-map badfacebookbad
class facebook-not4you
drop
!
interface Gi0/1
service-policy output badfacebookbad
In your place, if i were in the chance to spend some moneys, I would put a UTM capable box between your gateway and your LAN.
For instance is extremely easy to put a FortiGate firewall in transparent mode ( working like a ethernet bridge ) and drop all the web requests destined to the "Social Networking" sites category.
