Why a port knock does not open the door

1. The door opened for another address

The firewall opens the port for the source address the server saw. If you knocked over IPv6 and SSH then connects over IPv4 — or the other way round — the door is open for an address you are not using. Mobile data, carrier NAT and VPNs change the address too.

Compare the address Secret Knock shows on the home screen ("You knock from …") with the address in the server's log, and pin IPv4 or IPv6 for the door if they differ.

2. The packets do not reach the server

Hotel, office and mobile networks sometimes block unusual ports, and a cloud firewall in front of the server drops packets before knockd or fwknopd sees them. Watch the traffic on the server while you knock:

# knockd (UseSyslog): every recognised step and the command it ran
sudo journalctl -u knockd -f

# Do the packets reach the server at all? (use your interface and ports)
sudo tcpdump -ni eth0 'tcp port 7311 or tcp port 8822 or udp port 9133'

# fwknopd in the foreground with verbose output
sudo fwknopd -f -v

3. The sequence arrives in the wrong shape

1. 1Retransmitted SYNs: when a TCP knock gets no answer, the client's operating system resends the same SYN. knockd 0.8 resets the sequence on such a repeat. Secret Knock sends each TCP knock as a single SYN and stops the attempt at once; other clients may not.
2. 2Timing: all steps must arrive within seq_timeout, in order. Add a short delay before a step if a router in between reorders packets.
3. 3Protocol: a UDP step must be sent as UDP, a TCP step as TCP — check each step against knockd.conf.
4. 4tcpflags = syn makes knockd ignore TCP packets without the SYN flag. Without it, the other packets of a connection to the same port also count as hits and can break the sequence.

4. fwknop: keys, clocks and replays

1. 1Both keys must match access.conf: the Rijndael key and the HMAC key, with the same digest (SHA-256 by default).
2. 2fwknopd rejects packets older than MAX_SPA_PACKET_AGE (120 seconds by default), so a device clock far off makes every packet look old.
3. 3Each SPA packet can be used once; fwknopd drops a replayed packet on purpose.
4. 4If you knock over HTTP, something must accept TCP connections on that port, or the request is never sent.

5. The door opens, but SSH still fails

1. 1Rule order: the rule the daemon adds must come before the rule that drops the port — an iptables -A appends after an existing DROP and never matches.
2. 2The window: cmd_timeout or FW_ACCESS_TIMEOUT closed the door before SSH connected. Connect within the window; established sessions keep working if your firewall accepts established connections.
3. 3Secret Knock's port check after the knock tells you whether the port answered at all, separately from SSH authentication.

Questions