It is recommended to use wildcard rules whenever possible while allowlisting or blocking any GoTo services on your network as sub-domains of the domains listed above are included. Also, the client-to-host connection uses peer-to-peer connections, encrypted within a 256-bit AES tunnel.

Use of IP ranges instead of domain names for the firewall configuration is discouraged unless absolutely necessary because our IP ranges and those of our provider networks need to be periodically audited and modified, creating additional maintenance for your network. These changes are necessary to continue to provide the maximum performance for our GoTo products. Maintenance and failover events within our infrastructure may cause you to connect to servers within any of the ranges.

If your firewall includes a content or application data scanning filter, this may cause a block or latency, which would be indicated in the log files for the filter. To address this problem, verify that the domains or IP ranges will not be scanned or filtered by specifying exception domains or IP ranges. If your security policy requires you to specify explicit domain or IP ranges, then configure your firewall exceptions for outbound TCP ports 8200, 443, and 80 as well as UDP ports 8200 and 1853 for the GoTo domains or IP ranges, including those of our third-party provider networks.

We do not recommend explicit IP allowlisting of GoTo ranges. If URL allowlisting is not feasible, refer to the list of GoTo IP addresses.

We do not recommend explicit IP allowlisting of GoTo ranges. If URL allowlisting is not feasible, refer to the list of GoTo IP addresses.

Equivalent specifications in 3 common formats

Lens Server / Data Center IP addresses:

• *.remoteview.logmein.eu
• turn.console.logmeinrescue.eu
• For networks explicitly filtering outbound destination ports and protocols, the following ports are used on Rescue Lens side and Rescue Nextgen media: 15000 (UDP traffic) or 443 (TCP traffic) for Rescue media sessions.

You must also allowlist ranges for these third-party services:

• Microsoft Azure

The following features won't be able to use in case of using IP based allowlist since these are using dynamic IPs:

• External technician invite: invited external technicians won't be able to reach one-time technician console to download. This applies to networks where the external technicians are located.
• Auto-upgrade of Calling Card and Unattended endpoints won't be able to auto-upgrade. Manual upgrade and redeployment will be required.

For email invitations and correspondences from us and the GoTo software, we recommend allowing the following email domains through your email's spam and allowlist filters.

• @m.logmein.com
• @t.logmein.com
• @logmeinrescue.com
• @logmein.com
• @m.lastpass.com
• @t.lastpass.com