Public IP Addresses and DNS Names

Overview

Every LogicMonitor customer has a DNS record of [customername].logicmonitor.com. This record resolves to two or more public IP addresses at any given time. Because these IP addresses can and do change over time, it’s imperative that your network’s firewall(s) permit access to all of our public IP addresses.

Allowing LogicMonitor’s Public IP Addresses

There are two methods for adding LogicMonitor’s public IP addresses to your allow list:

• Allowing the DNS (recommended). If you have firewalls capable of handling DNS based rules, we recommend adding *.logicmonitor.com to your allow list in lieu of the below IP ranges for maximum efficiency and flexibility. LogicMonitor uses CloudFront CDN to deliver content.
• Allowing all IP addresses. If DNS based rules are not an option, then you must add the following set of public IP addresses in its entirety to your allow list:

  3.68.188.192/26
  3.106.118.64/26
  13.43.19.192/26
  15.156.210.128/26
  18.139.118.192/26
  18.246.78.128/25
  34.223.95.64/26
  38.100.37.0/24
  38.134.126.0/24
  52.52.63.0/26
  52.202.255.64/26
  52.215.168.128/26

  54.193.15.255/32
  54.194.232.54/32
  54.209.7.170/32
  54.254.224.41/32
  69.25.43.0/24
  74.201.65.0/24
  149.5.93.0/24
  212.118.245.0/24

Note: The above list of addresses does not include LogicMonitor’s external test locations for website monitoring. If you are performing website monitoring and need to explicitly allow for our external test location IP addresses, you can find the list of addresses in What Is Website Monitoring.

Some customers manually update their Collectors’ /etc/hosts files with static IP addresses. This is not a recommended (or sustainable) practice because these IP addresses can and do change over time. If for some reason a Collector cannot use DNS, then periodic checks (e.g. every five minutes) should be made to ensure the static entry remains up to date.

The only external communications needed for a LogicMonitor Collector is outbound 443/tcp to the IP addresses/DNS names noted above. If communications are sent to port 80 then a redirect to 443 can be expected. In order to use our remote session functionality, you will also need RDP or SSH on port 443.

Note: Bootstrap executables for Collector installation are delivered via CDN (AWS CloudFront). It is recommended to allow the DNS in order to support this process. However, if it is required that IP addresses be added to your allow list individually, you will need to review and add CloudFront’s IP ranges, as discussed in CloudFront’s
documentation.

Note: LogicMonitor has four individual proxy endpoints dedicated to routing collected data around disruptions in the public internet to your portal. If your Collectors are unable to reach our data centers, collected data will be rerouted through these proxies until it can be delivered to your portal via the normal path.