How to block outgoing request to https favicon via iptables?

Question

Debian

Tried like this:

iptables -I OUTPUT -p tcp -m string --algo kmp --string 'favicon' -j DROP

It works only with http, it passes such requests through https, what can be done in this case?

Answer 1

Urls are not visible until HTTPS decryption, block at the web server level. But in general - this is usually not blocked, but simply excluded from logging.