Port knocking explained

How port knocking works

The firewall drops every connection to the protected port, so a scanner sees nothing. A small daemon watches the traffic that hits the firewall. When one source address produces the expected pattern, the daemon adds a firewall rule that allows that address, usually for a short time.

The pattern is the knock. With knockd it is a sequence of connection attempts to specific ports in a specific order and within a time limit. With fwknop it is a single encrypted packet.

knockd: knock sequences

knockd listens on an interface and matches connection attempts against the sequences in /etc/knockd.conf. A sequence can mix TCP and UDP ports. When it matches, knockd runs a command — typically an iptables or nftables rule for the knocking address (%IP%).

This example opens SSH for the knocking address and closes it again after 10 seconds. Existing SSH sessions keep working if your firewall accepts established connections.

[options]
    UseSyslog

[openSSH]
    sequence      = 7311:tcp,8822:tcp,9133:udp
    seq_timeout   = 10
    tcpflags      = syn
    start_command = /usr/sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    cmd_timeout   = 10
    stop_command  = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT

Pick your own ports; never reuse ports from published examples. tcpflags = syn makes knockd count only packets with the SYN flag — the first packet of a connection attempt.

fwknop: Single Packet Authorization

fwknop replaces the sequence with one UDP packet that is encrypted (AES) and authenticated (HMAC). The server, fwknopd, captures it passively, verifies it, checks it is not a replay, and opens the requested port for the address inside the packet.

Generate keys with fwknop --key-gen and put them in the server's access.conf. Secret Knock imports the client side from your .fwknoprc.

SOURCE              ANY
OPEN_PORTS          tcp/22
KEY_BASE64          <output of fwknop --key-gen>
HMAC_KEY_BASE64     <output of fwknop --key-gen>
FW_ACCESS_TIMEOUT   30

Because the allowed address travels inside the encrypted packet, SPA can open a port for an address other than the one sending the packet — useful when you knock from a phone on mobile data for a laptop elsewhere.

Why knocks fail

• IPv4 vs IPv6: the knock went out over one address family and SSH connects over the other. The firewall opened the door for an address you are not using.
• A different public address: on mobile data, behind carrier NAT or a VPN, the server sees another IP than you expect. Check the address you knock from.
• Retransmitted SYNs: if a TCP knock is not answered, the client's operating system sends the same SYN again. In our tests knockd 0.8 reset the sequence on such a repeated SYN, so a client must send each knock once and stop the attempt quickly.
• Timing: knocks that arrive outside seq_timeout, or in the wrong order, start the sequence over.
• Middleboxes: some networks block or rewrite traffic to unusual ports, so a knock that works at home can fail on a hotel or office network.

Is it secure?

A knockd sequence is sent unencrypted; anyone who can watch your traffic can replay it. Use it to hide a service from scanners, in front of SSH keys — not instead of them. fwknop SPA closes that gap with encryption, HMAC and replay protection, and is the better choice when your traffic may be observed.

Knocking from iPhone, Mac and Apple Watch

Secret Knock sends knockd sequences and fwknop SPA packets from iPhone, iPad and Mac, checks that the port answers, and opens your SSH app. Apple Watch knocks through the paired iPhone, because watchOS does not let apps send raw TCP or UDP packets; away from the iPhone it can send SPA over HTTP to servers that enable it.