Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have multiple workstations behind my OpenWRT router and I would like to block LogMeIn from beaconing out. That is, I want to render the LogMeIn installs useless.

I realize this won't be a terribly effective method (and blocking the users from initially installing it would likely be a better approach), but I'd like to do it anyway.

How can I most easily do this solely with IPTables?

share|improve this question
add comment

4 Answers

up vote 3 down vote accepted

Logmein clients usually connect to some of those address ranges : http://www.lolloland.com/2011/05/28/logmein-ip-addresses

To block logmein clients you have to block all those ip address (all ranges). It's not useful if you use a /32 subnet mask (1 host).

share|improve this answer
add comment

This is what I've done:

Blocking secure.logmein.com in all of it's IP addresses wasn't enough as the program was connecting to changing IPs in the range 212.118.234.0/24 with a PTR to unkown.logmein.com

So my final iptables implementation looks like this:

-A FORWARD -s 74.201.74.193/32 -j REJECT
-A FORWARD -s 69.25.20.193/32  -j REJECT
-A FORWARD -s 77.242.192.193/32 -j REJECT
-A FORWARD -s 92.242.140.1/32 -j REJECT
-A FORWARD -m iprange --src-range 212.118.234.1-212.118.234.254 -j REJECT
-A FORWARD -d 74.201.74.193/32 -j REJECT
-A FORWARD -d 69.25.20.193/32 -j REJECT
-A FORWARD -d 77.242.192.193/32 -j REJECT    
-A FORWARD -d 92.242.140.1/32 -j REJECT
-A FORWARD -m iprange --dst-range 212.118.234.1-212.118.234.254 -j REJECT

I also implemented the GPO which apparently does nothing, but when you try to access from the LogmeIn webpage, it returs access denied.

share|improve this answer
add comment

You just need to block the address: secure.logmein.com

Source: https://logmeinsupport.com/kblive/crm/selfservice/displaywh.jsp?DocId=2538

share|improve this answer
    
This does not appear to work. Also, secure.logmein.com resolves to a different IP address than the one the connection is beaconing to (and provides command and control with). Further, your link even states that blocking secure.logmein.com is meant to block the employees installing it. My question assumes that it has been installed and we would like to periodically disable it by playing with IPTables. Thank you for answering though! –  omghai2u Dec 30 '10 at 20:27
    
Sorry about that- further research shows that it's not actually that simple to do. It would be much easier and more effective to block the installation of Logmein (using the link above). –  AliGibbs Dec 31 '10 at 8:12
    
Although 1 suggestion is: On the gateway: if you can not block port 443 then block all access to the logmein servers. These servers hand out the encryption key for a session. No key, no session. To be certain, you could block the whole range of the Level 3 servers of logmein: 63.208.0.0 - 63.215.255.255 –  AliGibbs Dec 31 '10 at 8:14
1  
I disagree about the usefulness of blocking the install page when the installation has all ready taken place. That's probably just me, though. But that IP block you gave in your second comment is not where the beaconing address is for me, either. It appears that LogMeIn owns quite a range. –  mrduclaw Dec 31 '10 at 17:50
add comment

Well after reading the logemin kb link posted above. You can check What's My DNS for secure.logmein.com you get, you get 3 different IP addresses from different DNS servers:

69.25.20.193 74.201.74.193 77.242.192.193

If you block those 3 IP addresses and LogMeIn only uses secure.logmein.com DNS entry and doesn't change those IP addresses.

share|improve this answer
    
I don't know this to be certain, but I really don't think it's beaconing to secure.logmein.com. In fact, I would wager that secure.logmein.com only has something to do with where you go to install/control machines. In any event, the IP address this guy is going to is 64.94.18.153 on port 80. –  omghai2u Jan 2 '11 at 23:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.