I have multiple workstations behind my OpenWRT router and I would like to block LogMeIn from beaconing out. That is, I want to render the LogMeIn installs useless.

I realize this won't be a terribly effective method (and blocking the users from initially installing it would likely be a better approach), but I'd like to do it anyway.

How can I most easily do this solely with IPTables?


Logmein clients usually connect to some of those address ranges : http://www.lolloland.com/2011/05/28/logmein-ip-addresses

To block logmein clients you have to block all those ip address (all ranges). It's not useful if you use a /32 subnet mask (1 host).


This is what I've done:

Blocking secure.logmein.com in all of it's IP addresses wasn't enough as the program was connecting to changing IPs in the range with a PTR to unkown.logmein.com

So my final iptables implementation looks like this:

-A FORWARD -m iprange --src-range -j REJECT
-A FORWARD -m iprange --dst-range -j REJECT

I also implemented the GPO which apparently does nothing, but when you try to access from the LogmeIn webpage, it returs access denied.


You just need to block the address: secure.logmein.com

Source: https://logmeinsupport.com/kblive/crm/selfservice/displaywh.jsp?DocId=2538

  • This does not appear to work. Also, secure.logmein.com resolves to a different IP address than the one the connection is beaconing to (and provides command and control with). Further, your link even states that blocking secure.logmein.com is meant to block the employees installing it. My question assumes that it has been installed and we would like to periodically disable it by playing with IPTables. Thank you for answering though! – omghai2u Dec 30 '10 at 20:27
  • Sorry about that- further research shows that it's not actually that simple to do. It would be much easier and more effective to block the installation of Logmein (using the link above). – AliGibbs Dec 31 '10 at 8:12
  • Although 1 suggestion is: On the gateway: if you can not block port 443 then block all access to the logmein servers. These servers hand out the encryption key for a session. No key, no session. To be certain, you could block the whole range of the Level 3 servers of logmein: - – AliGibbs Dec 31 '10 at 8:14
  • 1
    I disagree about the usefulness of blocking the install page when the installation has all ready taken place. That's probably just me, though. But that IP block you gave in your second comment is not where the beaconing address is for me, either. It appears that LogMeIn owns quite a range. – mrduclaw Dec 31 '10 at 17:50

Well after reading the logemin kb link posted above. You can check What's My DNS for secure.logmein.com you get, you get 3 different IP addresses from different DNS servers:

If you block those 3 IP addresses and LogMeIn only uses secure.logmein.com DNS entry and doesn't change those IP addresses.

  • I don't know this to be certain, but I really don't think it's beaconing to secure.logmein.com. In fact, I would wager that secure.logmein.com only has something to do with where you go to install/control machines. In any event, the IP address this guy is going to is on port 80. – omghai2u Jan 2 '11 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.