In the following we construct an /etc/iptables/les file to handle port knocking for SSH. Stop_command = /usr/bin/iptables -D TCP -s %IP% -p tcp -dport 22 -j ACCEPT Start_command = /usr/bin/iptables -A TCP -s %IP% -p tcp -dport 22 -j ACCEPT If you followed Simple stateful firewall, you should substitute the INPUT chain specification, with the custom open chain used in the firewall. These configs can be easily altered to integrate properly with an iptables firewall. knockd(1) § CONFIGURATION provides three example port knocking configurations. Knockd is such a port knocking daemon that can provide an added layer of security to your network. Besides easing the setup of rules these helper programs may also offer advanced features. Simple port knocking Server side With a daemon helperĪ specialised daemon can be used to handle port knocking. To check that you have not inadvertantly selected commonly used ports, use this port database, and/or your /etc/services file. can help you generate a selection of ports between 5. It is wise to randomly select the ports that you use for the knock sequence. They also offer many other advanced options, but are not in the standard kernel yet (August 2013). Note: There are additions to iptables in current development that have commands for port knocking in a single rule.

$ nmap -Pn -host-timeout 201 -max-retries 0 -p 2222 host #knocking port 2222

$ nmap -Pn -host-timeout 201 -max-retries 0 -p 1111 host #knocking port 1111 Using recent, the firewall can find out if a certain IP address has knocked the correct ports, and if that is the case, open certain port(s).Ī session with port knocking may look like this: The module recent in iptables is used to dynamically create list of IP addresses based on their (successful or unsuccessful) port connections. Installing and configuring nftables or iptables is a prerequisite for the content of this article. Further, do not use the port sequence used in this example for live configurations permanently. In case of SSH protection, see SSH keys for a strong method that can be used along with port knocking. That would be a fragile security through obscurity. Warning: Port knocking should be used as part of a security strategy, not as the only protection.

Advanced port scanner 1.3