You need to open the EAPs for client access to those auth services, for example with a free authentication policy in EAC. But it's no ideal solution: if IPs change, you have to change the ACL rules, too. There is no reliable way to set up such an authentication scheme.

dnsmasq won't help at all and ipset isn't needed to set rules for allowing access to certain IP addresses. But there are other problems such as distinguishing between authentication and normal traffic, both being HTTPS. AFAIK, FB provides a proprietary solution with Meraki and Cisco to sell FB-enabled WiFi hotspots.

But who uses FB anyway in those times? The youngsters did leave it long time ago, when their Moms and Dads started to send them friend requests. ;)

Yes, I know. You have to white-list facebook.com, facebook.net, fbcdn.net, licdn.net, licdn.com, akamaihd.net, akamai.net, akamaiedge.net and cloudfront.com. If you do this by IP rules, then good luck for keeping the list of regional data centers of the CDNs up-to-date on your installed hotspot base. It creates dependencies not under your control and therefore will be unreliable, even if it works at a given time. IMHO not a good idea, but YMMV. :)

E-raser wrote

Ok but this is just the point
With use of ipset & dnsmasq you don't have to edit the ip's all the time

I see. They are intercepting DNS lookups and setting firewall rules. Yes, if you intercept at that level, white-listing of FB can work. But since EAPs don't offer DNS services itself (EAPs are Thin APs, not routers!) I see no way to do DNS interception on an EAP. You have to do it in the router, but then you would need to implement the Captive Portal on the router, too. This will make EAPs standard APs then, they are no Thin APs anymore if used with a CP running on a router.

E-raser wrote

yep, every site is allowed, I tested this also but I don't get redirected to the portal page if all ip's are allowed

That's because the firewall rule redirecting HTTP requests to the portal page comes after the free authentication rule in EAP. Any Captive Portal using HTTP redirection needs to have almost all IPs blocked in order to be able to intercept HTTP traffic to any website (except a few you grant free access to).