Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have multiple workstations behind my OpenWRT router and I would like to block LogMeIn from beaconing out. That is, I want to render the LogMeIn installs useless.

I realize this won't be a terribly effective method (and blocking the users from initially installing it would likely be a better approach), but I'd like to do it anyway.

How can I most easily do this solely with IPTables?

share|improve this question
up vote 3 down vote accepted

Logmein clients usually connect to some of those address ranges :

To block logmein clients you have to block all those ip address (all ranges). It's not useful if you use a /32 subnet mask (1 host).

share|improve this answer

This is what I've done:

Blocking in all of it's IP addresses wasn't enough as the program was connecting to changing IPs in the range with a PTR to

So my final iptables implementation looks like this:

-A FORWARD -m iprange --src-range -j REJECT
-A FORWARD -m iprange --dst-range -j REJECT

I also implemented the GPO which apparently does nothing, but when you try to access from the LogmeIn webpage, it returs access denied.

share|improve this answer

You just need to block the address:


share|improve this answer
This does not appear to work. Also, resolves to a different IP address than the one the connection is beaconing to (and provides command and control with). Further, your link even states that blocking is meant to block the employees installing it. My question assumes that it has been installed and we would like to periodically disable it by playing with IPTables. Thank you for answering though! – omghai2u Dec 30 '10 at 20:27
Sorry about that- further research shows that it's not actually that simple to do. It would be much easier and more effective to block the installation of Logmein (using the link above). – AliGibbs Dec 31 '10 at 8:12
Although 1 suggestion is: On the gateway: if you can not block port 443 then block all access to the logmein servers. These servers hand out the encryption key for a session. No key, no session. To be certain, you could block the whole range of the Level 3 servers of logmein: - – AliGibbs Dec 31 '10 at 8:14
I disagree about the usefulness of blocking the install page when the installation has all ready taken place. That's probably just me, though. But that IP block you gave in your second comment is not where the beaconing address is for me, either. It appears that LogMeIn owns quite a range. – mrduclaw Dec 31 '10 at 17:50

Well after reading the logemin kb link posted above. You can check What's My DNS for you get, you get 3 different IP addresses from different DNS servers:

If you block those 3 IP addresses and LogMeIn only uses DNS entry and doesn't change those IP addresses.

share|improve this answer
I don't know this to be certain, but I really don't think it's beaconing to In fact, I would wager that only has something to do with where you go to install/control machines. In any event, the IP address this guy is going to is on port 80. – omghai2u Jan 2 '11 at 23:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.