Skip to content
Secret Knock
EN

MikroTik port knocking from iPhone, iPad and Mac

RouterOS has no knock daemon, but its firewall can stage a knock through address lists: each matching packet puts the source on a list, and the last list opens Winbox or SSH. Secret Knock sends both kinds of MikroTik knock — ports and ping sizes.

Knock with ports

Three connection attempts in order move the address from list to list; only an address on the final list reaches Winbox (8291). Put these rules above any rule that drops input traffic.

/ip firewall filter
add chain=input protocol=tcp dst-port=4311 action=add-src-to-address-list \
    address-list=knock-1 address-list-timeout=10s comment="knock 1"
add chain=input protocol=tcp dst-port=5822 src-address-list=knock-1 \
    action=add-src-to-address-list address-list=knock-2 address-list-timeout=10s comment="knock 2"
add chain=input protocol=udp dst-port=6133 src-address-list=knock-2 \
    action=add-src-to-address-list address-list=knocked address-list-timeout=1h comment="knock 3"
add chain=input protocol=tcp dst-port=8291 src-address-list=knocked action=accept comment="Winbox after the knock"
add chain=input protocol=tcp dst-port=8291 action=drop comment="Winbox for everyone else"
RouterOS terminal

Knock with ping sizes

RouterOS can also match the size of ICMP echo requests. packet-size is the whole IPv4 packet: 20 bytes of IP header, 8 bytes of ICMP header and the ping data, so 100 bytes of data arrive as 128. In Secret Knock's ping editor you enter the data size; it shows the resulting ICMP, IPv4 and IPv6 packet sizes, and warns above 1280 bytes, where packets may be fragmented.

/ip firewall filter
add chain=input protocol=icmp packet-size=128 action=add-src-to-address-list \
    address-list=ping-1 address-list-timeout=10s comment="ping 100 bytes of data"
add chain=input protocol=icmp packet-size=308 src-address-list=ping-1 \
    action=add-src-to-address-list address-list=knocked address-list-timeout=1h comment="ping 280 bytes of data"
add chain=input protocol=tcp dst-port=8291 src-address-list=knocked action=accept
add chain=input protocol=tcp dst-port=8291 action=drop
RouterOS terminal

Add the door in the app

  1. 1New door › Start from a template › MikroTik port sequence or MikroTik ping sizes. Both set Winbox (8291) as the port to check.
  2. 2Enter your ports, or the data sizes and counts of your pings.
  3. 3Knock, wait for Door ajar, then open Winbox.

All examples on GitHub → Every configuration on this page, ready to copy: github.com/mobilcomm/secretknock-examples (public domain).

Questions

Why does my MikroTik knock not open?

Check the order of the rules (the knock rules must come before the drop rule), the address-list timeouts, and that the router sees the address you knock from — Secret Knock shows it on the home screen.

Guides for your setup