Skip to content
Secret Knock
EN

knockd.conf examples

knockd reads /etc/knockd.conf: an [options] section and one section per door. Each section has a sequence, a time limit and the command to run for the knocking address, %IP%. Pick your own ports — never reuse the ones from examples.

Open SSH for a few seconds

The most common setup: one knock opens SSH, and knockd closes it again after cmd_timeout. Sessions you already opened keep working if the firewall accepts established connections.

[options]
    UseSyslog

[openSSH]
    sequence      = 7311:tcp,8822:tcp,9133:udp
    seq_timeout   = 10
    tcpflags      = syn
    start_command = /usr/sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    cmd_timeout   = 10
    stop_command  = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
/etc/knockd.conf

Separate sequences to open and to close

Without a timer, the port stays open until you knock the closing sequence. Convenient, but easy to forget — prefer the timed version.

[options]
    UseSyslog

[openSSH]
    sequence    = 7311:tcp,8822:tcp,9133:udp
    seq_timeout = 10
    tcpflags    = syn
    command     = /usr/sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT

[closeSSH]
    sequence    = 9133:udp,8822:tcp,7311:tcp
    seq_timeout = 10
    tcpflags    = syn
    command     = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
/etc/knockd.conf

One-time sequences

Instead of one fixed sequence, knockd can read a file of sequences and accept each one only once, so a recorded knock cannot be replayed. Secret Knock keeps the same list and moves to the next sequence after a knock that opened the door.

[openSSH]
    one_time_sequences = /etc/knockd/ssh_sequences
    seq_timeout        = 10
    tcpflags           = syn
    start_command      = /usr/sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    cmd_timeout        = 10
    stop_command       = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT

# /etc/knockd/ssh_sequences — one sequence per line, each used once
2222:udp,3333:tcp,4444:udp
5555:tcp,6666:udp,7777:tcp
8888:udp,9999:tcp,1111:tcp
/etc/knockd.conf and the sequence file

With nftables

On systems with nftables, let knockd add the address to a set with a timeout; the hide-SSH guide shows the matching nftables table.

[openSSH]
    sequence      = 7311:tcp,8822:tcp,9133:udp
    seq_timeout   = 10
    tcpflags      = syn
    start_command = /usr/sbin/nft add element inet filter knocked4 { %IP% timeout 30s }
/etc/knockd.conf

After editing

  1. 1On Debian and Ubuntu, set the interface knockd listens on in /etc/default/knockd (KNOCKD_OPTS="-i eth0") and restart knockd.
  2. 2Watch it work with journalctl -u knockd -f while you knock.
  3. 3In Secret Knock, + › Import from file turns each section with a sequence into a door; enter one-time sequence lists by hand.

All examples on GitHub → Every configuration on this page, ready to copy: github.com/mobilcomm/secretknock-examples (public domain).

Questions

Should I use TCP or UDP steps?

Either works. Mixing both makes a sequence harder to guess from a port scan. UDP steps can carry a payload in Secret Knock if your setup checks it.

Guides for your setup