Patent ID: 8739269

Claim:
A method for providing security in a virtual private network, comprising: defining, by a processor of a customer edge router, a protected server group, wherein the protected server group identifies a subset of all customer endpoint devices in the virtual private network, wherein the subset includes a server within the virtual private network to be protected; receiving, by the processor, a packet; applying, by the processor, an inbound access control list to the packet if the packet is destined to a server in the protected server group, wherein the inbound access control list comprises an inbound list of internet protocol addresses that may not be accessed by the protected server group, wherein the applying inbound access control list comprises: determining the packet is destined to the server in the protected server group, and the packet comprises a message which is allowed to proceed to the server in the protected server group; and creating a bypass entry in an outbound access control list to permit return traffic from the server in the protected server group, wherein the bypass entry is valid for a predetermined period of time for a stateless session; and applying, by the processor, the outbound access control list to the packet if the packet is from the server in the protected server group, wherein the outbound access control list comprises an outbound list of internet protocol addresses that the protected server group may initiate a session with, wherein the applying the outbound access control list comprises: determining that the packet is from the server in the protected server group and that the packet is sent without being solicited; and blocking a transmission of the packet that is sent without being solicited.