Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using CentOS as a VPN gateway.

Users connected to my server have access to the internet. The problem is that some of the users' computers are infected with some kind of worm, and as soon as they connect to server, the worm starts port scanning private IP ranges, like I don't care about the scanning but it's against the policies of the company that hosts my server.

So, how can I prevent out-going port scans? For example, can I block all outgoing packets sent to private IP ranges?

share|improve this question
You're focusing on the wrong problem. Fix (or disconnect) the infected clients. – HopelessN00b Aug 26 '12 at 6:26
Who says they're infected with anything? The port scanning could be intentional. Public VPN services are often abused in this way. – Michael Hampton Aug 26 '12 at 8:34
@MichaelHampton Fair enough. Fix or disconnect the clients, infected or not. :p – HopelessN00b Aug 26 '12 at 8:36

Close the client's account for Terms of Service/abuse violation.

IF it was unintentional, you can accept them back after they've cleaned up their computers. But if it happens a second time, cancel the account forever.

share|improve this answer
Maybe a little harsh. The same fool who got infected once is likely to get infected a second time (and more than twice, for that matter). When that fool is giving you money, it might be prudent not to jump to telling him to take his money elsewhere too quickly... or he will. – HopelessN00b Aug 26 '12 at 8:41
Some customers are not worth the money. But this is a business decision... – Michael Hampton Aug 26 '12 at 8:43
Thank u all for comments. The problem is that even if I fix (or disconnect) the infected clients or the clients who intentionally port scanning, my server will be blocked (at least for a few hours). What I'm looking for is a way to prevent it from happening. for example if I add "iptables -I OUTPUT -p tcp --dest -j DROP" to iptables, would it help? – Dave Aug 26 '12 at 14:45

This might help. TIP 8 is how to block network portscans using ip-tables.


share|improve this answer
Welcome to Server Fault! We really do prefer that answers contain content not pointers to content. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Iain Aug 26 '12 at 8:17
I'll try it. but to be honest, I can't understand the logic of the rule mentioned in the TIP 8. – Dave Aug 26 '12 at 15:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.