> put a global Deny rule for 31.13.x.x and problem is solved.

Since Facebook is only one of a huge number of other objectionable data leakages apps present to us, I recommend something more expansive than that. I recommend blocking all outgoing traffic entirely by default, and only enabling outgoing traffic for specific apps to specific destinations as needed.