Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using CentOS as a VPN gateway.

Users connected to my server have access to the internet. The problem is that some of the users' computers are infected with some kind of worm, and as soon as they connect to server, the worm starts port scanning private IP ranges, like 192.168.1.1-255. I don't care about the scanning but it's against the policies of the company that hosts my server.

So, how can I prevent out-going port scans? For example, can I block all outgoing packets sent to private IP ranges?

share|improve this question
    
You're focusing on the wrong problem. Fix (or disconnect) the infected clients. –  HopelessN00b Aug 26 '12 at 6:26
    
Who says they're infected with anything? The port scanning could be intentional. Public VPN services are often abused in this way. –  Michael Hampton Aug 26 '12 at 8:34
1  
@MichaelHampton Fair enough. Fix or disconnect the clients, infected or not. :p –  HopelessN00b Aug 26 '12 at 8:36
add comment

2 Answers 2

Close the client's account for Terms of Service/abuse violation.

IF it was unintentional, you can accept them back after they've cleaned up their computers. But if it happens a second time, cancel the account forever.

share|improve this answer
    
Maybe a little harsh. The same fool who got infected once is likely to get infected a second time (and more than twice, for that matter). When that fool is giving you money, it might be prudent not to jump to telling him to take his money elsewhere too quickly... or he will. –  HopelessN00b Aug 26 '12 at 8:41
    
Some customers are not worth the money. But this is a business decision... –  Michael Hampton Aug 26 '12 at 8:43
    
Thank u all for comments. The problem is that even if I fix (or disconnect) the infected clients or the clients who intentionally port scanning, my server will be blocked (at least for a few hours). What I'm looking for is a way to prevent it from happening. for example if I add "iptables -I OUTPUT -p tcp --dest 192.168.0.0/16 -j DROP" to iptables, would it help? –  Dave Aug 26 '12 at 14:45
add comment

This might help. TIP 8 is how to block network portscans using ip-tables.

http://www.techrepublic.com/blog/10things/10-iptables-rules-to-help-secure-your-linux-box/539

GL

share|improve this answer
1  
Welcome to Server Fault! We really do prefer that answers contain content not pointers to content. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Iain Aug 26 '12 at 8:17
    
I'll try it. but to be honest, I can't understand the logic of the rule mentioned in the TIP 8. –  Dave Aug 26 '12 at 15:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.