if you have access to the router, then you can block it there. But most stock firmwares don't let you do this stuff. You should block domain name AND the facebook's ip ranges or kids will bypath the block by typing in ip address. Also, I would completely block any type of VPN/SSH connections(by packet inspection, not just by blocking standard ports), to prevent any attempts of tunneling through another internet.