1

I want to deny access to a specific URL. It isn't a whole website, it's a specific URL. I want to do it simply so that some applications including browsers can't make requests for it. I tried this:

$ cat /etc/hosts    
127.0.0.1 http://url_to_block/url_to_block2/url_to_block3

but it didn't help me, for example, in the browser some website keeps on sending the ajax requests to that URL and receiving the responses from it.

Why not? How to do it?

slm
  • 363,520
  • 117
  • 767
  • 871
Incerteza
  • 2,641
  • 4
  • 20
  • 22
  • 1
    You need some form of transparent HTTP proxy or deep inspection filtering that is able to understand the HTTP protocol such as snort in inline mode. And even then, it's going to be very difficult (and impossible with shrewd users) to prevent users to find work arounds. – Stéphane Chazelas Nov 21 '14 at 11:49
  • Did you read the man page for `/etc/hosts`? `/etc/hosts` is only for associating hostnames and (domainname) aliases with IP addresses. If at all it matches `url_to_block` from your example URL, but nothing more (neither protocol `http:` nor the paths within the domain). – Anthon Nov 21 '14 at 12:06
  • Probably most reliable and hacky way is to drop TCP connections with packets matching your pattern using iptables. But you should firth educate yourself about networks, read some basic info - it would be anyway useful in your future life. – gena2x Nov 21 '14 at 13:15
  • 1
    @gena2x, that would certainly not be the most reliable. What if one uses `http://url_to_block/url_to_block2/url_to_block%33` or `http://url_to_block/url_to_block2/./url_to_block3` or send the `GET /url_` in one packet and the rest in the next packet? At least a HTTP proxy will see the full data in the TCP stream and will know how to canonize the requests before filtering. – Stéphane Chazelas Nov 21 '14 at 13:38
  • @StéphaneChazelas, is it easy to create it myself in, say, Python? So that all the traffic goes through it. – Incerteza Nov 21 '14 at 18:45

1 Answers1

1

The file /etc/hosts is only for mapping hostnames with IP addresses, not for URLs. There isn't any method that I'm aware which will allow you to do this across the board for all applications (that's built into a typical Linux distro), but you have a couple of options that will allow you to do it either per browser, via plugins, or using an HTTP proxy that filters all your requests from web browsers.

Plugins

2 such plugins for Firefox:

There are others. For Chrome:

I would probably go this route if it's just for yourself, or a couple of user's on a handful of systems.

Proxies

If it's for a larger domain of users then you'll need to use a HTTP proxy. Depending on which you choose, you may have to configure each user's browser independently.

If you choose to proxy all HTTP traffic using something like Squid, you can configure it as a transparent proxy, but this will have to be done on a system that's sitting in between your systems and the internet. Directions on how to set this up are discussed in this article, titled: Linux: Setup a transparent proxy with Squid in three easy steps.

slm
  • 363,520
  • 117
  • 767
  • 871