3

I have multiple workstations behind my OpenWRT router and I would like to block LogMeIn from beaconing out. That is, I want to render the LogMeIn installs useless.

I realize this won't be a terribly effective method (and blocking the users from initially installing it would likely be a better approach), but I'd like to do it anyway.

How can I most easily do this solely with IPTables?

4 Answers 4

3

Logmein clients usually connect to some of those address ranges : http://www.lolloland.com/2011/05/28/logmein-ip-addresses

To block logmein clients you have to block all those ip address (all ranges). It's not useful if you use a /32 subnet mask (1 host).

3

This is what I've done:

Blocking secure.logmein.com in all of it's IP addresses wasn't enough as the program was connecting to changing IPs in the range 212.118.234.0/24 with a PTR to unkown.logmein.com

So my final iptables implementation looks like this:

-A FORWARD -s 74.201.74.193/32 -j REJECT
-A FORWARD -s 69.25.20.193/32  -j REJECT
-A FORWARD -s 77.242.192.193/32 -j REJECT
-A FORWARD -s 92.242.140.1/32 -j REJECT
-A FORWARD -m iprange --src-range 212.118.234.1-212.118.234.254 -j REJECT
-A FORWARD -d 74.201.74.193/32 -j REJECT
-A FORWARD -d 69.25.20.193/32 -j REJECT
-A FORWARD -d 77.242.192.193/32 -j REJECT    
-A FORWARD -d 92.242.140.1/32 -j REJECT
-A FORWARD -m iprange --dst-range 212.118.234.1-212.118.234.254 -j REJECT

I also implemented the GPO which apparently does nothing, but when you try to access from the LogmeIn webpage, it returs access denied.

1

You just need to block the address: secure.logmein.com

Source: https://logmeinsupport.com/kblive/crm/selfservice/displaywh.jsp?DocId=2538

4
  • This does not appear to work. Also, secure.logmein.com resolves to a different IP address than the one the connection is beaconing to (and provides command and control with). Further, your link even states that blocking secure.logmein.com is meant to block the employees installing it. My question assumes that it has been installed and we would like to periodically disable it by playing with IPTables. Thank you for answering though!
    – omghai2u
    Dec 30, 2010 at 20:27
  • Sorry about that- further research shows that it's not actually that simple to do. It would be much easier and more effective to block the installation of Logmein (using the link above).
    – AliGibbs
    Dec 31, 2010 at 8:12
  • Although 1 suggestion is: On the gateway: if you can not block port 443 then block all access to the logmein servers. These servers hand out the encryption key for a session. No key, no session. To be certain, you could block the whole range of the Level 3 servers of logmein: 63.208.0.0 - 63.215.255.255
    – AliGibbs
    Dec 31, 2010 at 8:14
  • 1
    I disagree about the usefulness of blocking the install page when the installation has all ready taken place. That's probably just me, though. But that IP block you gave in your second comment is not where the beaconing address is for me, either. It appears that LogMeIn owns quite a range.
    – mrduclaw
    Dec 31, 2010 at 17:50
0

Well after reading the logemin kb link posted above. You can check What's My DNS for secure.logmein.com you get, you get 3 different IP addresses from different DNS servers:

69.25.20.193 74.201.74.193 77.242.192.193

If you block those 3 IP addresses and LogMeIn only uses secure.logmein.com DNS entry and doesn't change those IP addresses.

1
  • I don't know this to be certain, but I really don't think it's beaconing to secure.logmein.com. In fact, I would wager that secure.logmein.com only has something to do with where you go to install/control machines. In any event, the IP address this guy is going to is 64.94.18.153 on port 80.
    – omghai2u
    Jan 2, 2011 at 23:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .