我怎麼才能讓firefox當一個特定地點的瀏覽器?
目標是透過劃分來確保安全。具體來說,是為了阻止 Facebook 嘗試追蹤和儲存我所有的網路瀏覽活動,包括當我不在 Facebook 網站上。
理想情況下,我希望有一個瀏覽器能夠運行僅有的訪問 facebook 和我的其他瀏覽器操作使其可以訪問每個網站除了臉書的。
請告訴我如何將 Firefox 設定為 Facebook 專用(單一網站)瀏覽器。
答案1
Facebook 容器。此附加元件可在您的瀏覽器中隔離 Facebook。這可能就是您所需要的。
如果您想更加確定,請使用兩個型材。在兩者中安裝一些網站攔截插件。第一個設定檔中將 Facebook 列入黑名單,第二個設定檔中僅將 Facebook 列入白名單。
答案2
這可以在 Linux 中完成firejail
,您可以--netfilter
在其中使用參數:
[a] 定義 iptables 規則以阻止訪問您的 Facebook 擁有的所有 ip netblocks主瀏覽器和
[b] 定義 iptables 規則來阻止對整個互聯網的訪問除了Facebook 擁有的那些 ip netblocksFacebook 特定(沙箱)瀏覽器
Facebook 擁有的 IP 網路區塊清單可以使用 Facebook, Inc = AS32934 的 whois 自治系統 (AS) 編號找到
root@disp355:/home/user# whois -h whois.radb.net -- \
root@disp355:/home/user# '-i origin AS32934'| grep -e "^route:"
...
route: 69.63.176.0/20
route: 66.220.144.0/20
route: 66.220.144.0/21
route: 69.63.184.0/21
route: 69.63.176.0/21
route: 74.119.76.0/22
route: 69.171.255.0/24
route: 173.252.64.0/18
route: 69.171.224.0/19
route: 69.171.224.0/20
root@disp355:/home/user#
然後可以將整個清單放入 Facebook 專用瀏覽器的 netfilter 檔案中:
sudo bash -c 'cat << EOF > /etc/firejail/facebookOnly.net
################################################################################
# Author: Michael Altfield <[email protected]>
# Created: 2019-03-25
# Updated: 2019-03-25
# Version: 0.1
# Purpose: Permits traffic to/from facebook (and dns) only
################################################################################
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A OUTPUT --destination 102.132.96.0/20 -j ACCEPT
-A OUTPUT --destination 102.132.96.0/24 -j ACCEPT
-A OUTPUT --destination 103.4.96.0/22 -j ACCEPT
-A OUTPUT --destination 129.134.0.0/17 -j ACCEPT
-A OUTPUT --destination 157.240.0.0/17 -j ACCEPT
-A OUTPUT --destination 157.240.10.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.1.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.11.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.12.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.13.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.14.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.15.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.18.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.19.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.192.0/18 -j ACCEPT
-A OUTPUT --destination 157.240.193.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.194.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.195.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.20.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.2.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.21.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.22.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.24.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.25.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.26.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.27.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.28.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.29.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.30.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.3.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.6.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.7.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.8.0/24 -j ACCEPT
-A OUTPUT --destination 157.240.9.0/24 -j ACCEPT
-A OUTPUT --destination 173.252.64.0/19 -j ACCEPT
-A OUTPUT --destination 173.252.88.0/21 -j ACCEPT
-A OUTPUT --destination 173.252.96.0/19 -j ACCEPT
-A OUTPUT --destination 179.60.192.0/22 -j ACCEPT
-A OUTPUT --destination 179.60.192.0/24 -j ACCEPT
-A OUTPUT --destination 179.60.193.0/24 -j ACCEPT
-A OUTPUT --destination 179.60.194.0/24 -j ACCEPT
-A OUTPUT --destination 179.60.195.0/24 -j ACCEPT
-A OUTPUT --destination 185.60.216.0/22 -j ACCEPT
-A OUTPUT --destination 185.60.216.0/24 -j ACCEPT
-A OUTPUT --destination 185.60.217.0/24 -j ACCEPT
-A OUTPUT --destination 185.60.218.0/24 -j ACCEPT
-A OUTPUT --destination 185.60.219.0/24 -j ACCEPT
-A OUTPUT --destination 204.15.20.0/22 -j ACCEPT
-A OUTPUT --destination 31.13.24.0/21 -j ACCEPT
-A OUTPUT --destination 31.13.64.0/18 -j ACCEPT
-A OUTPUT --destination 31.13.64.0/19 -j ACCEPT
-A OUTPUT --destination 31.13.64.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.65.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.66.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.67.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.68.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.70.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.71.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.72.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.73.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.74.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.75.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.80.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.81.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.82.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.83.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.84.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.85.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.86.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.87.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.89.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.90.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.91.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.92.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.93.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.94.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.95.0/24 -j ACCEPT
-A OUTPUT --destination 31.13.96.0/19 -j ACCEPT
-A OUTPUT --destination 45.64.40.0/22 -j ACCEPT
-A OUTPUT --destination 66.220.144.0/20 -j ACCEPT
-A OUTPUT --destination 66.220.144.0/21 -j ACCEPT
-A OUTPUT --destination 66.220.152.0/21 -j ACCEPT
-A OUTPUT --destination 69.171.224.0/19 -j ACCEPT
-A OUTPUT --destination 69.171.224.0/20 -j ACCEPT
-A OUTPUT --destination 69.171.239.0/24 -j ACCEPT
-A OUTPUT --destination 69.171.240.0/20 -j ACCEPT
-A OUTPUT --destination 69.171.250.0/24 -j ACCEPT
-A OUTPUT --destination 69.171.255.0/24 -j ACCEPT
-A OUTPUT --destination 69.63.176.0/20 -j ACCEPT
-A OUTPUT --destination 69.63.176.0/21 -j ACCEPT
-A OUTPUT --destination 69.63.184.0/21 -j ACCEPT
-A OUTPUT --destination 74.119.76.0/22 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT
-A OUTPUT -j DROP
-A INPUT -p udp --sport 53 -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -j DROP
COMMIT
EOF'
同樣,為您的主瀏覽器創建相反的內容:
sudo bash -c 'cat << EOF > /etc/firejail/notFacebook.net
################################################################################
# Author: Michael Altfield <[email protected]>
# Created: 2019-03-25
# Updated: 2019-03-25
# Version: 0.1
# Purpose: Permits traffic to/from everything except facebook
################################################################################
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT --destination 102.132.96.0/20 -j DROP
-A OUTPUT --destination 102.132.96.0/24 -j DROP
-A OUTPUT --destination 103.4.96.0/22 -j DROP
-A OUTPUT --destination 129.134.0.0/17 -j DROP
-A OUTPUT --destination 157.240.0.0/17 -j DROP
-A OUTPUT --destination 157.240.10.0/24 -j DROP
-A OUTPUT --destination 157.240.1.0/24 -j DROP
-A OUTPUT --destination 157.240.11.0/24 -j DROP
-A OUTPUT --destination 157.240.12.0/24 -j DROP
-A OUTPUT --destination 157.240.13.0/24 -j DROP
-A OUTPUT --destination 157.240.14.0/24 -j DROP
-A OUTPUT --destination 157.240.15.0/24 -j DROP
-A OUTPUT --destination 157.240.18.0/24 -j DROP
-A OUTPUT --destination 157.240.19.0/24 -j DROP
-A OUTPUT --destination 157.240.192.0/18 -j DROP
-A OUTPUT --destination 157.240.193.0/24 -j DROP
-A OUTPUT --destination 157.240.194.0/24 -j DROP
-A OUTPUT --destination 157.240.195.0/24 -j DROP
-A OUTPUT --destination 157.240.20.0/24 -j DROP
-A OUTPUT --destination 157.240.2.0/24 -j DROP
-A OUTPUT --destination 157.240.21.0/24 -j DROP
-A OUTPUT --destination 157.240.22.0/24 -j DROP
-A OUTPUT --destination 157.240.24.0/24 -j DROP
-A OUTPUT --destination 157.240.25.0/24 -j DROP
-A OUTPUT --destination 157.240.26.0/24 -j DROP
-A OUTPUT --destination 157.240.27.0/24 -j DROP
-A OUTPUT --destination 157.240.28.0/24 -j DROP
-A OUTPUT --destination 157.240.29.0/24 -j DROP
-A OUTPUT --destination 157.240.30.0/24 -j DROP
-A OUTPUT --destination 157.240.3.0/24 -j DROP
-A OUTPUT --destination 157.240.6.0/24 -j DROP
-A OUTPUT --destination 157.240.7.0/24 -j DROP
-A OUTPUT --destination 157.240.8.0/24 -j DROP
-A OUTPUT --destination 157.240.9.0/24 -j DROP
-A OUTPUT --destination 173.252.64.0/19 -j DROP
-A OUTPUT --destination 173.252.88.0/21 -j DROP
-A OUTPUT --destination 173.252.96.0/19 -j DROP
-A OUTPUT --destination 179.60.192.0/22 -j DROP
-A OUTPUT --destination 179.60.192.0/24 -j DROP
-A OUTPUT --destination 179.60.193.0/24 -j DROP
-A OUTPUT --destination 179.60.194.0/24 -j DROP
-A OUTPUT --destination 179.60.195.0/24 -j DROP
-A OUTPUT --destination 185.60.216.0/22 -j DROP
-A OUTPUT --destination 185.60.216.0/24 -j DROP
-A OUTPUT --destination 185.60.217.0/24 -j DROP
-A OUTPUT --destination 185.60.218.0/24 -j DROP
-A OUTPUT --destination 185.60.219.0/24 -j DROP
-A OUTPUT --destination 204.15.20.0/22 -j DROP
-A OUTPUT --destination 31.13.24.0/21 -j DROP
-A OUTPUT --destination 31.13.64.0/18 -j DROP
-A OUTPUT --destination 31.13.64.0/19 -j DROP
-A OUTPUT --destination 31.13.64.0/24 -j DROP
-A OUTPUT --destination 31.13.65.0/24 -j DROP
-A OUTPUT --destination 31.13.66.0/24 -j DROP
-A OUTPUT --destination 31.13.67.0/24 -j DROP
-A OUTPUT --destination 31.13.68.0/24 -j DROP
-A OUTPUT --destination 31.13.70.0/24 -j DROP
-A OUTPUT --destination 31.13.71.0/24 -j DROP
-A OUTPUT --destination 31.13.72.0/24 -j DROP
-A OUTPUT --destination 31.13.73.0/24 -j DROP
-A OUTPUT --destination 31.13.74.0/24 -j DROP
-A OUTPUT --destination 31.13.75.0/24 -j DROP
-A OUTPUT --destination 31.13.80.0/24 -j DROP
-A OUTPUT --destination 31.13.81.0/24 -j DROP
-A OUTPUT --destination 31.13.82.0/24 -j DROP
-A OUTPUT --destination 31.13.83.0/24 -j DROP
-A OUTPUT --destination 31.13.84.0/24 -j DROP
-A OUTPUT --destination 31.13.85.0/24 -j DROP
-A OUTPUT --destination 31.13.86.0/24 -j DROP
-A OUTPUT --destination 31.13.87.0/24 -j DROP
-A OUTPUT --destination 31.13.89.0/24 -j DROP
-A OUTPUT --destination 31.13.90.0/24 -j DROP
-A OUTPUT --destination 31.13.91.0/24 -j DROP
-A OUTPUT --destination 31.13.92.0/24 -j DROP
-A OUTPUT --destination 31.13.93.0/24 -j DROP
-A OUTPUT --destination 31.13.94.0/24 -j DROP
-A OUTPUT --destination 31.13.95.0/24 -j DROP
-A OUTPUT --destination 31.13.96.0/19 -j DROP
-A OUTPUT --destination 45.64.40.0/22 -j DROP
-A OUTPUT --destination 66.220.144.0/20 -j DROP
-A OUTPUT --destination 66.220.144.0/21 -j DROP
-A OUTPUT --destination 66.220.152.0/21 -j DROP
-A OUTPUT --destination 69.171.224.0/19 -j DROP
-A OUTPUT --destination 69.171.224.0/20 -j DROP
-A OUTPUT --destination 69.171.239.0/24 -j DROP
-A OUTPUT --destination 69.171.240.0/20 -j DROP
-A OUTPUT --destination 69.171.250.0/24 -j DROP
-A OUTPUT --destination 69.171.255.0/24 -j DROP
-A OUTPUT --destination 69.63.176.0/20 -j DROP
-A OUTPUT --destination 69.63.176.0/21 -j DROP
-A OUTPUT --destination 69.63.184.0/21 -j DROP
-A OUTPUT --destination 74.119.76.0/22 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j DROP
COMMIT
EOF'
現在您可以使用第一個 netfitler 規則集啟動 Facebook 專用瀏覽器,如下所示:
firejail --dns="1.1.1.1" --dns="9.9.9.9" --dns="8.8.8.8" --net=eth0 --netfilter=/etc/firejail/facebookOnly.net firefox -no-remote -new-instance "https://www.facebook.com"
對於無法從網路其餘部分「回撥」Facebook 伺服器的通用瀏覽器:
firejail --dns="1.1.1.1" --dns="9.9.9.9" --dns="8.8.8.8" --net=eth0 --netfilter=/etc/firejail/notFacebok.net firefox -no-remote -new-instance "https://start.duckduckgo.com"
有關此內容的更多信息,請參閱以下文章: