Skip to content
Secret Knock
EN

An fwknop SPA client for iPhone, iPad, Mac and Apple Watch

fwknop replaces a guessable sequence with one encrypted, authenticated packet. Secret Knock builds that packet on your device with your keys and sends it to fwknopd over UDP or HTTP.

Compatible with fwknopd

Secret Knock sends fwknop's Rijndael (AES) encryption with an HMAC — SHA-256 by default, other digests selectable — over UDP to port 62201 or another port you set, or as an HTTP request. You can request access for the address the packet comes from or name another address, and send fwknop command mode messages if your server allows them.

Set up the server

Generate a key pair with fwknop --key-gen and put both keys into the server's access.conf.

SOURCE              ANY
OPEN_PORTS          tcp/22
KEY_BASE64          <output of fwknop --key-gen>
HMAC_KEY_BASE64     <output of fwknop --key-gen>
FW_ACCESS_TIMEOUT   30
/etc/fwknop/access.conf

Add the door in the app

  1. 1New door › Kind: Single Packet (fwknop), or Start from a template › fwknop.
  2. 2Paste the output of fwknop --key-gen with Paste keys — or, on iPhone and iPad, scan a QR code of the keys.
  3. 3Or + › Import from file and pick your .fwknoprc.
  4. 4Keys stay in the Keychain; with sync on, they travel end-to-end encrypted through iCloud Keychain to your own devices.

All examples on GitHub → Every configuration on this page, ready to copy: github.com/mobilcomm/secretknock-examples (public domain).

Questions

Why fwknop instead of knockd?

A knockd sequence travels in the clear and can be replayed by anyone who sees it. An SPA packet is encrypted, authenticated and cannot be replayed.

Can Apple Watch send SPA by itself?

Yes, over HTTP: Apple Watch apps cannot send raw UDP, so away from the iPhone the Watch sends the SPA packet as an HTTP request. See the Apple Watch guide for the server side.

Guides for your setup