1

enter image description here

I would like know if it's possible to block access to a particular site eg: facebook.com, using BGP prefix filtering.

For example, can I apply a filter to prefixes received from my ISP that drops those originating from the AS number of the Facebook?

Regards,

Improve this question
4
  • 1
    You will have to provide more details than this. Which router brand and software version are you using, also please provide the current configuration.
    – Teun Vink ♦
    Nov 6, 2017 at 16:10
  • 2
    I think you are trying to use the wrong tool for the job. this sounds like an X-Y Problem. It would be better to explain what you are really trying to accomplish.
    – Ron Maupin ♦
    Nov 6, 2017 at 16:11
  • I am trying to filter all facebook inbound prefixes from my SP, I will show config.
    – BGP
    Nov 6, 2017 at 16:31
  • 2
    Blocking facebook by filtering their prefixes may not be the most effective or efficient way, that is why Ron asked you what it is you're trying to achieve.
    – Teun Vink ♦
    Nov 6, 2017 at 16:36

2 Answers 2

Reset to default
3

You are talking about Layer3 vs Layer7 filtering. Blocking those inbound prefixes won't disallow a website to be accessed. The traffic will still match the default route and be sent to the ISP.

You'll need a firewall or content filter to disallow outbound connections - and you'll likely want to do it via DNS, not IP.

Improve this answer
1

If you receive a full routing-table from your ISP (eg: no default route), then this may be possible.

If you receive a default route and/or a subset of local prefixes, you could also write an ACL to include all prefixes associated with key Facebook infrastructure and simply drop it.

Be aware that dropping this traffic will increase load times on most web pages as your clients browsers sit timing out waiting for responses from Facebook and their associated Ad-Servers which will no longer respond.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.