There are several ways to find the IP ranges of major organizations such as Facebook. The most basic of these, is to open up your terminal/command line of choice and issue the command:
This gives you the associated IP address to that DNS name; in this case,
220.127.116.11 was the answer from my DNS server.
Then run a "whois" lookup for that IP address (you can go to Whois.net if you don't have a whois tool in your command line):
The relevant output in this case is:
NetRange: 18.104.22.168 - 22.214.171.124
Facebook has been assigned the entire /18 block of
126.96.36.199/18, so simply use that range for your ACL.
Note: With all of that stated, blocking by IP can become cumbersome very quickly, and is highly ineffective in many cases. Organizations the size of Facebook will constantly be adding new IP space, which will be outside of your filtered range.
Some sites might change to using a new CDN, which of course will use a different IP space as well.
If you're having specific issues with your HTTPS and URL blocking, depending on the equipment, you could ask in another question for assistance on those specific problems. The answers might better aid you in blocking access to these sites.