Blocking domain via ufw and iptables

Question

Does anyone know a way to block the domain name of a website (www.firstlightfcu.org) while still allowing access to the site using the IP address (174.122.168.43)? I tried blocking the website using iptables which worked perfectly and then allowing the IP address using ufw. The site is blocked altogether whether I use IP address or domain name to access it. I know this is supposed to be possible but I guess I'm missing something and I'm a new user with ubuntu. Any help pointing me in the right direction would be greatly appreciated.

Solution 1

If it's a question of your students, then they might want it for their own computer. They can modify their etc/hosts file and map that domain to a different IP address like:

127.0.0.1    www.firstlightfcu.org   # localhost
192.168.1.5  return.empty.example    # just some other address

Depending on what they map the domain name to, they will see different error messages, timeouts or just nothing.

Be aware, though, that many web servers are not reachable by their IP address alone, because that IP address hosts more than one domain. So the web server will give you one of those domains it hosts, not necessarily the domain you (they) want.

You may want to read https://pi-hole.net/ to learn more about such techniques to modify browser experience.

Solution 2

First, UFW is just a frontend of iptables. If you know how to write iptables rules then you don't need UFW since it basically just translates your so-called uncomplicated rules to iptables.

Secondly, blocking domain name using iptables is not quite effective since the name resolution works on the application layer; you make a request to a DNS server which would return ip address of the given domain in your DNS request; while iptables is more suitable to filter communication on network and transport layer.

What you can do is to configure a proxy server for your clients which you can use to block access to a particular domain name, on the application layer, without blocking the ip address of that domain itself. To make your clients to use your proxy without making configuration on each client, you can use transparent proxy.

Comments

[Admin]

You'd have to analyze the traffic at the application layer. This kind of behavior is better suited to a (transparent) proxy that can block on server name and SNI.

[Admin]

Problem I see with that is the site seems to be served via HTTPS so it wouldn't necessarily be proxy-able. Need more info on how your network is setup, what clients and how many, etc. For example, if you run your own internal DNS server you could spoof the domain name and point it to 0.0.0.0 or soem internal server w/ a "nice" error message, etc. And out of curiosity, why block a bank's website?