I'm using CentOS as a VPN gateway.

Users connected to my server have access to the internet. The problem is that some of the users' computers are infected with some kind of worm, and as soon as they connect to server, the worm starts port scanning private IP ranges, like I don't care about the scanning but it's against the policies of the company that hosts my server.

So, how can I prevent out-going port scans? For example, can I block all outgoing packets sent to private IP ranges?

  • You're focusing on the wrong problem. Fix (or disconnect) the infected clients. Commented Aug 26, 2012 at 6:26
  • Who says they're infected with anything? The port scanning could be intentional. Public VPN services are often abused in this way. Commented Aug 26, 2012 at 8:34
  • 1
    @MichaelHampton Fair enough. Fix or disconnect the clients, infected or not. :p Commented Aug 26, 2012 at 8:36

2 Answers 2


Close the client's account for Terms of Service/abuse violation.

IF it was unintentional, you can accept them back after they've cleaned up their computers. But if it happens a second time, cancel the account forever.

  • Maybe a little harsh. The same fool who got infected once is likely to get infected a second time (and more than twice, for that matter). When that fool is giving you money, it might be prudent not to jump to telling him to take his money elsewhere too quickly... or he will. Commented Aug 26, 2012 at 8:41
  • Some customers are not worth the money. But this is a business decision... Commented Aug 26, 2012 at 8:43
  • Thank u all for comments. The problem is that even if I fix (or disconnect) the infected clients or the clients who intentionally port scanning, my server will be blocked (at least for a few hours). What I'm looking for is a way to prevent it from happening. for example if I add "iptables -I OUTPUT -p tcp --dest -j DROP" to iptables, would it help?
    – Dave
    Commented Aug 26, 2012 at 14:45

This might help. TIP 8 is how to block network portscans using ip-tables.



  • 1
    Welcome to Server Fault! We really do prefer that answers contain content not pointers to content. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – user9517
    Commented Aug 26, 2012 at 8:17
  • I'll try it. but to be honest, I can't understand the logic of the rule mentioned in the TIP 8.
    – Dave
    Commented Aug 26, 2012 at 15:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .