Skip to content
Secret Knock
EN

Set up an fwknop server

fwknop Single Packet Authorization keeps SSH closed until one encrypted, authenticated UDP packet arrives. These steps set it up on a Debian or Ubuntu server; test it from a computer first, then add the same keys to Secret Knock.

1. Install and generate keys

Install the server and the client, then generate a key pair. Keep the output: the same two keys go into access.conf and into Secret Knock.

sudo apt install fwknop-server fwknop-client
fwknop --key-gen          # prints KEY_BASE64 and HMAC_KEY_BASE64
Debian / Ubuntu

2. Allow SSH for SPA packets

access.conf says what a valid packet may open and for how long.

SOURCE              ANY
OPEN_PORTS          tcp/22
KEY_BASE64          <output of fwknop --key-gen>
HMAC_KEY_BASE64     <output of fwknop --key-gen>
FW_ACCESS_TIMEOUT   30
/etc/fwknop/access.conf

3. Tell fwknopd where to listen

fwknopd captures packets on an interface; it does not need an open port. Set the interface your server uses.

# /etc/fwknop/fwknopd.conf
PCAP_INTF               eth0;
PCAP_FILTER             udp port 62201;
MAX_SPA_PACKET_AGE      120;
/etc/fwknop/fwknopd.conf

4. Close SSH by default

Keep an SSH session open while you do this, and test from a second connection before you log out. fwknopd inserts its own chain at the top of INPUT and adds a timed ACCEPT there for each valid packet.

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j DROP
iptables

5. Test, then add the door

Restart fwknop-server, send a packet from another machine and connect:

# from another machine: request SSH for the address the server sees (-R)
fwknop -A tcp/22 -R -D server.example.com \
    --key-base64-rijndael "<KEY_BASE64>" --key-base64-hmac "<HMAC_KEY_BASE64>"
ssh [email protected]
From a computer with fwknop-client
  1. 1In Secret Knock: New door › Start from a template › fwknop, enter the host, and paste the output of fwknop --key-gen with Paste keys.
  2. 2Knock; the door shows Door ajar when port 22 answers.
  3. 3Run fwknopd -f -v on the server if it does not — the troubleshooting guide lists the usual causes.

All examples on GitHub → Every configuration on this page, ready to copy: github.com/mobilcomm/secretknock-examples (public domain).

Questions

Does fwknopd need an open port?

No. It reads packets from the network interface, so the SPA port can stay closed in the firewall; the packet only has to reach the server.

Guides for your setup