LogicMonitor Public IP Addresses and DNS Names

Overview

Every LogicMonitor customer has a DNS record of [customername].logicmonitor.com. This record resolves to two or more public IP addresses at any given time. Because these IP addresses can and do change over time, it’s imperative that your network’s firewall(s) permit access to all of our public IP addresses.

Allowing LogicMonitor’s Public IP Addresses

There are two methods for adding LogicMonitor’s public IP addresses to your allow list:

  • Allowing the DNS (recommended). If you have firewalls capable of handling DNS based rules, we recommend adding *.logicmonitor.com to your allow list in lieu of the below IP ranges for maximum efficiency and flexibility. LogicMonitor uses CloudFront CDN to deliver content.
  • Allowing all IP addresses. If DNS based rules are not an option, then you must add the following set of public IP addresses in its entirety to your allow list:

    3.106.118.64/26
    18.139.118.192/26
    34.223.95.64/26
    38.100.37.0/24
    38.134.126.0/24
    52.52.63.0/26
    52.202.255.64/26
    52.215.168.128/26

    54.193.15.255/32
    54.194.232.54/32
    54.209.7.170/32
    54.254.224.41/32
    69.25.43.0/24
    74.201.65.0/24
    149.5.93.0/24
    212.118.245.0/24

Note: The above list of addresses does not include LogicMonitor’s external test locations for website monitoring. If you are performing website monitoring and need to explicitly allow for our external test location IP addresses, you can find the list of addresses in What Is Website Monitoring.

Some customers manually update their Collectors’ /etc/hosts files with static IP addresses. This is not a recommended (or sustainable) practice because these IP addresses can and do change over time. If for some reason a Collector cannot use DNS, then periodic checks (e.g. every five minutes) should be made to ensure the static entry remains up to date.

You will also need outbound TCP port 443 and 80 access. Port 80 is only used if one attempts to access LogicMonitor via a non-secure HTTP address. This will initially reach port 80 and then be redirected to port 443 for encryption. In order to use our remote session functionality, you will also need RDP or SSH on port 443.

Note: Bootstrap executables for Collector installation are delivered via CDN (AWS CloudFront). It is recommended to allow the DNS in order to support this process. However, if it is required that IP addresses be added to your allow list individually, you will need to review and add CloudFront’s IP ranges, as discussed in CloudFront’s
documentation
.

Note: LogicMonitor has four individual proxy endpoints dedicated to routing collected data around disruptions in the public internet to your portal. If your Collectors are unable to reach our data centers, collected data will be rerouted through these proxies until it can be delivered to your portal via the normal path.

In this Article: