Skip to content
Secret Knock

Support

Write to us at [email protected]. Tell us your device, the server software (knockd or fwknopd) and what happens when you knock — never send us your knock sequence or keys.

A knock does not open the port

  1. 1Check the address you knock from on the home screen and compare it with what the server logs. Pin IPv4 or IPv6 for the server if they differ.
  2. 2Check the server: knockd and fwknopd log every recognised knock. If nothing is logged, the packets do not reach the server.
  3. 3Check seq_timeout and the order of ports in knockd.conf against the sequence in the app.
  4. 4On mobile data or a VPN your public address changes — knock again after switching networks.
Read the port knocking guide →

Questions

What is port knocking?

Port knocking keeps a service such as SSH hidden behind a closed firewall. The firewall opens it only for an address that first sends a secret pattern of connection attempts — the knock. knockd watches for a sequence of ports; fwknop accepts one encrypted Single Packet Authorization packet.

Which servers does Secret Knock work with?

Any server running knockd or fwknopd, and firewalls that open a port after a sequence of TCP or UDP connection attempts — for example on a Linux VPS, a home server, a NAS or a router.

Is port knocking secure?

A classic knock sequence travels in the clear, so treat it as one extra layer in front of strong SSH keys, not as a replacement. fwknop SPA is stronger: each packet is encrypted, authenticated with HMAC and cannot be replayed.

Does it work on Apple Watch?

Yes. Apple Watch apps cannot send raw network packets themselves, so the Watch knocks through your iPhone. Away from the iPhone, the Watch can send fwknop SPA over HTTP if your server enables it.

Why did my knock not open the port?

Most often the knock left over IPv6 while SSH connects over IPv4, or the other way round, or the server saw a different public IP. Secret Knock shows the address you knock from and lets you pin IPv4 or IPv6 per server. The port knocking guide covers the other causes.

Does Secret Knock collect any data?

No. There is no account, no analytics and no tracking. Your servers and keys stay on your devices and in your own iCloud.

How much does it cost?

One server is free with every feature. Unlimited servers are a one-time purchase that covers iPhone, iPad, Mac and Apple Watch and works with Family Sharing.