Port knocking on Apple Watch

Through your iPhone

Apple Watch apps cannot send raw network packets, so the Watch asks your iPhone to knock. Every kind of door works this way: knockd sequences, fwknop over UDP, ping sizes and DrayTek. Your knock sequences and keys stay on the iPhone.

On its own: fwknop SPA over HTTP

Without the iPhone nearby, the Watch can send an fwknop SPA packet as an HTTP request over Wi-Fi or cellular. fwknopd reads the packet from the traffic it captures, so enable SPA over HTTP, include the HTTP port in its capture filter, and make sure something accepts TCP connections on that port — your web server, for example — so the request is sent at all.

# /etc/fwknop/fwknopd.conf
ENABLE_SPA_OVER_HTTP    Y;
PCAP_FILTER             udp port 62201 or tcp port 80;

On the Watch

1. 1Hold the knocker. The Watch taps your wrist when the knock goes out, and again when the door opens.
2. 2Door ajar shows the port check and the countdown, with Knock again.
3. 3The complication opens the app from your watch face.
4. 4With the app lock on, the Watch does not knock.

Questions