Debian / Ubuntu: Set Port Knocking With Knockd and Iptables

by

Port knocking is a security technique used to hide services on a network behind a firewall until a specific sequence of connection attempts (knocks) is received.

To set up port knocking on Debian or Ubuntu, you will need to install two components: knockd, which acts as the daemon that listens for knocks and opens the firewall, and iptables, which is the firewall itself.

Here’s how you can set up port knocking using knockd and iptables:

  1. Install the knockd and iptables packages:
apt-get update
apt-get install knockd iptables
  1. Create a configuration file for knockd:
nano /etc/knockd.conf

In the file, add the following configuration to define the sequence of port knocks and the action to be taken:

[options]
UseSyslog

[openSSH]
sequence = 7000,8000,9000
seq_timeout = 5
command = iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn

[closeSSH]
sequence = 9000,8000,7000
seq_timeout = 5
command = iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn

In this example, the first sequence (7000,8000,9000) opens the firewall to allow incoming connections on port 22 (SSH), while the second sequence (9000,8000,7000) closes the firewall to disallow incoming connections. The seq_timeout parameter defines the time in seconds that the sequence must be completed within. The tcpflags parameter sets the type of packets that the knock sequence must consist of.

  1. Start the knockd service:
service knockd start
  1. Verify that the knockd service is running:
service knockd status
  1. Add the knockd service to start automatically at boot:
update-rc.d knockd defaults
  1. Test the port knocking configuration by sending the port knock sequence from another computer. You can use a port knocking client such as knock or hping3.

After you have successfully sent the knock sequence, you should be able to connect to the service that you have opened in the firewall (in this case, SSH).

Note: Make sure to configure your firewall to only allow incoming connections from trusted IP addresses, and to block all other incoming connections.

Leave a Comment