Block WhatsApp Web File Transfers

TL;DR

You can block file transfers on WhatsApp Web without stopping chats by using a firewall or proxy server to filter traffic based on the file types sent and received. This guide explains how to achieve this, focusing on practical methods suitable for both home and office networks.

Solution Guide

1. Understand How WhatsApp Web Transfers Files

WhatsApp Web doesn’t use a standard port for file transfers. It relies on the same HTTPS connection (port 443) as regular web browsing. This makes blocking files directly by port difficult. Instead, you need to inspect the content of the traffic.

2. Choose Your Blocking Method

There are two main approaches:

• Firewall: More technical, but offers granular control and is suitable for permanent blocking. Requires access to your firewall’s configuration.
• Proxy Server: Easier to set up, especially if you already have a proxy server running. Can be used for temporary or conditional blocking.
3. Firewall Blocking (Example using pfSense)

This example uses pfSense, but the principles apply to other firewalls.

1. Identify WhatsApp Web Traffic: Use a packet capture tool like Wireshark to analyze traffic while sending/receiving files on WhatsApp Web. Look for patterns in the HTTP headers (specifically the User-Agent string and destination domains). Common domains include web.whatsapp.com, media.whatsapp.com and related CDN addresses.
2. Create a Firewall Rule: In pfSense, go to Firewall > Rules. Create a new rule on the interface where WhatsApp Web traffic passes (usually LAN).
3. Rule Configuration:
   • Action: Block
   • Interface: Your LAN interface
   • Protocol: TCP
   • Source: Any
   • Destination: Single host or alias containing the WhatsApp Web domains identified in step 1.
   • Destination Port Range: HTTPS (443)
   • Layer 7 Filtering: Enable Layer 7 filtering and create a rule to block specific MIME types associated with common file extensions (e.g., image/jpeg, application/pdf, audio/mpeg). You’ll need to add multiple rules for different file types.
4. Example Layer 7 Rule: To block JPEG images:

   Layer 7 Filter Name: BlockJPEG
   Filter: Regular Expression
   Regex: Content-Type: image/jpeg

5. Save and Apply Changes: Ensure the rule is placed in the correct order (blocking rules should generally be higher up the list).
4. Proxy Server Blocking (Example using Squid)

This example uses Squid, a popular proxy server.

1. Configure Squid: Edit your squid.conf file (usually located in /etc/squid/squid.conf).
2. Add ACLs: Define Access Control Lists (ACLs) to identify WhatsApp Web traffic and the file types you want to block.

   acl whatsapp_web dstdomain .web.whatsapp.com media.whatsapp.com
   acls mime_type image/jpeg|image/png|application/pdf|audio/* video/*
   

3. Create a Blocking Rule: Add a rule to deny access based on the ACLs.

   http_access deny whatsapp_web mime_type
   http_access allow all
   

4. Restart Squid: Restart the Squid service to apply the changes. The command varies depending on your operating system (e.g., sudo systemctl restart squid).
5. Testing Your Configuration

After implementing either method, test thoroughly:

• Attempt to send various file types through WhatsApp Web. They should be blocked.
• Verify that text chats still function normally.
• Check your firewall or proxy server logs for any unexpected blocking of legitimate traffic.
6. Important Considerations
• HTTPS Inspection: Blocking based on content requires HTTPS inspection (also known as SSL/TLS interception). This can introduce security risks if not configured correctly. Ensure you understand the implications before enabling it.
• CDN Addresses: WhatsApp Web uses Content Delivery Networks (CDNs) with frequently changing IP addresses. You may need to update your firewall rules or proxy server configuration periodically.
• User-Agent Spoofing: Advanced users could potentially bypass blocking by spoofing their User-Agent string.