After a two week search and read I ended up with this iptable rule that blocks youtube (as string) to an ip range in my office network.
iptables -A FORWARD -t filter -m iprange --src-range 10.217.76.60-10.217.76.70 -m string --algo bm --string "youtube.com" -j DROP #block
As you can see computers from .60 to .70 (10 machines) cannot browse youtube, while e.g. .75 can. The rule works only for a few minutes and for some clients. After 2 or 3 minutes some clients can browse youtube normally. If I close those clients' browser, flush the iptables rules and re-run them again, all clients cannot connect to youtube but this lasts for 2-3 minutes again and for some clients (I'm talking about the ip-range clients).
Has anyone met this behavior again?! Does it have to do with the server I'm using (ubuntu 11.04), the cache or something else!?
I also have squid3 installed where i block the http of youtube and facebook, so i thought setting iptables i could cut the youtube for the https. (But some clients really need youtube to work, so i want to cut off song listening and useless network traffic).
EDIT:
After a long I tried :
iptables -I FORWARD -t filter -s 10.217.76.80/28 -m string --algo bm --string "youtube.com" -j DROP #from .80 to .95 (15 ip)
and got a better solution ...just for a while. After some time some clients started browsing again (rule didn't work) while others still didn't (rule worked).
I understand that (as MADHatter said) is a Youtube thing with many many servers, but what i don't understand is that when using a rule like this
iptables -I FORWARD -m string --algo bm --string "youtube.com" -j REJECT
all traffic for all clients is rejected for ever not just for some time, the only thing that I wanted is use the above rule for an ip range of users e.g from .10 to .240 and let all others freely browse youtube.
Do you think there is a rule for that? Everything else similar that i tried worked only for a random time period.