New Member

Question

Facebook Just Wont Die

Forum|Forum|2 years ago
March 22, 2024
4 replies
6016 views

I guess the title says it all. I block Facebook in a web profile with *.facebook.com. and its the first item, with action to block. (I block Meta as well.) I have an application profile with the first override to block the facebook application. My DNS server has the DNS for Facebook to be blocked. I've never had a facebook account and never installed a facebook app on my computer, and nobody in my house uses facebook. But, as you can see, sometimes its blocked, other times its not a moment later. What am I missing here??

Facebook Not Blocked.png

FortiGate

ameif56hgtAuthor

New Member

I looked more at the details. The ones passed says action: client-rst with Security Action Allow. Others says action: client-rst with Security Action Block a second later.

ozkanaltas

Valued Contributor III

Hello @ameif56hgt ,

Did you configure deep ssl-inspection? if you're not doing it, that could be why.

Also DNS filter should catch this before the web and application filter. Which application do you use as a DNS filter? Fortigate or other app?

ameif56hgtAuthor

New Member

Deep inspection is ON and the Fortigate certificate is installed on computers and phones, BUT I do not believe this needs to be on to detect Facebook web access. I do use AdGuard Home on a Pi for DNS blocking, but I'm also seeing more apps get around it by going to their own DNS (which I block) or having the IP hardcoded in the app. If you look at the log I provided, you can clearly see the IP identified as Facebook, which the Fortigate should be blocking.

hbac

Staff

Hi @ameif56hgt,

We should see those traffic if you don't use Facebook. Can you check what is the source IP and track it from there? Can you show the log details of the allowed logs?

Regards,

ameif56hgtAuthor

New Member

The source IP is from Macs or iPhones or iPads. My guess Apple initiates this or some non-related app I have does. Maybe a browser.

Screenshot 2024-03-22 at 9.32.14 AM.png Screenshot 2024-03-22 at 9.33.13 AM.png

smaruvala

Staff

Hi,

From the traffic logs it is using udp protocol for communication. So I am assuming it is using QUIC protocol for the communication. You can try to block the quic application or service so that the facebook will fallback TLS.

Regards,

Shiva

Genobaseball10

Explorer

Web filtering should work by editing your security profile and doing a URL filter with a wildcard mask of *facebook.com. If this doesn't fix your issue, we can move to DNS filtering. Please let us know the status after trying this solution! I've just tested it in my home network and it seems to function. If this doesn't work, we can try DNS filtering after.

ameif56hgtAuthor

New Member

So I do have a Fortigate DNS filter in between my devices and my DNS repeaters (AdGuards) which are also on my network. I block DNS traffic that goes from devices to the WAN unless it's from AdGuard to the WAN, obviously. It's a wildcard *Facebook.com

I do wish I could find the app. on the iPhone or Mac generating it, but I don't really know how to go that deep.

ameif56hgtAuthor

New Member

OK I fixed it, just not the way I should have to. The two IP addresses at Facebook my computer and iPhones were contacting had IP addresses in the 31.13.70.X and 31.13.90.X ranges, so I just added a firewall rule to block those two IP ranges. Works like a charm. I do not know why a Web filter can identify Facebook track, and Facebook applications but neither seems to reliably block it. It clearly shows Facebook application ID 15832, which I BLOCK, but it doesn't.

Genobaseball10

Explorer

Nice find! I'm not sure why it wasn't working for you. When I did a wildcard of *Facebook.com in my homelab, I wasn't able to access any of Facebook or its features on any device. Sorry for the inconveneince!

Sign up

Login with SSO

Login to the community

Login with SSO