Linux – Block LogMeIn with IPTables

iptableslinuxnetworking

I have multiple workstations behind my OpenWRT router and I would like to block LogMeIn from beaconing out. That is, I want to render the LogMeIn installs useless.

I realize this won't be a terribly effective method (and blocking the users from initially installing it would likely be a better approach), but I'd like to do it anyway.

How can I most easily do this solely with IPTables?

Best Answer

Logmein clients usually connect to some of those address ranges : http://www.lolloland.com/2011/05/28/logmein-ip-addresses

To block logmein clients you have to block all those ip address (all ranges). It's not useful if you use a /32 subnet mask (1 host).

Related Solutions

Linux – How to Port Forward with Iptables

First of all - you should check if forwarding is allowed at all:

cat /proc/sys/net/ipv4/conf/ppp0/forwarding 
cat /proc/sys/net/ipv4/conf/eth0/forwarding

If both returns 1 it's ok. If not do the following:

echo '1' | sudo tee /proc/sys/net/ipv4/conf/ppp0/forwarding
echo '1' | sudo tee /proc/sys/net/ipv4/conf/eth0/forwarding

Second thing - DNAT could be applied on nat table only. So, your rule should be extended by adding table specification as well (-t nat):

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 8001 -j DNAT --to-destination 192.168.1.200:8080
iptables -A FORWARD -p tcp -d 192.168.1.200 --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Both rules are applied only to TCP traffic (if you want to alter UDP as well, you need to provide similar rules but with -p udp option set).

Last, but not least is routing configuration. Type:

ip route

and check if 192.168.1.0/24 is among returned routing entries.

Linux – Iptables block host

1.) Lookup the IP addresses of a specific ISP:

You'll have to use Google and search WHOIS records. You can also get hold of an ip2location database which should help.

2.) The command you need is: $ iptables -A INPUT -s 192.168.100.0/24 -j DROP

Replace the IP (192.168.100.0) with your start IP of the range to block and the number afterwards with a netmask (see: http://www.computerhope.com/jargon/n/netmask.htm to work out what number you need) depending on how far you want to go, block-wise.

Best Answer

Related Solutions

Linux – How to Port Forward with Iptables

Linux – Iptables block host

Related Topic