How to block sites like facebook.com, google.com etc. for different users

Question

I use iptables for other sites as:

iptables -A OUTPUT -o EXTERNAL_IF -m owner --uid-owner USERNAME -d DESTINATION_WEB -j REJECT

It works for most sites except ones having a large range of IPs. What is the best way to achieve this? Please note that I need different rules for each user.

Answer 1

Iptables isn't very good at this - you'd need to block every IP address that these sites use (and there are many). A better solution would be to use a proxy server. Quintolabs.com has a very nice and powerful squid/icap based implementation that will do exactly what it is that you seek.

Answer 2

The most effective way to achieve this is to install squid proxy, group users you want blocked form such sites in a group that redirects such sites to 127.0.0.1 to display blocked site message.

You can look at the ACL wiki for squid, for details.