Port knocking, a VPN or fail2ban?
All three keep strangers away from SSH and admin panels, in different ways. They are not exclusive — many servers combine them.
Port knocking
The port looks closed to everyone; one knock opens it for your address for a few seconds. Nothing to install on the network path and no tunnel: after the knock you connect directly. fwknop SPA makes the knock encrypted and non-replayable. Good for a few admin services on a server you reach from changing networks.
A VPN (WireGuard, Tailscale)
Services listen only on the VPN, so they are invisible from the internet, and the tunnel encrypts all traffic. A VPN needs a client running on every device and, for WireGuard, a UDP port; Tailscale relies on its coordination service. Good when you reach many services or a whole network.
fail2ban
The port stays open and fail2ban bans addresses after failed logins. It cuts down brute force but does not hide the service, so the server still answers every scanner. A useful extra layer behind either of the above.
Which one when
- 1One server, a couple of admin ports, phone in your pocket: port knocking.
- 2Many services, a whole home network, file shares: a VPN.
- 3A public service that must stay reachable: fail2ban and strong keys.
- 4Whatever you choose: SSH keys, no password logins.
Questions
Can I knock to open the VPN port?
Yes. Hiding the WireGuard UDP port or the management port of a router behind a knock combines both.