Find out how to use port knocking to remotely and safely connect to a server. You only have to use a port knocking client, which will send the right packet. Knock), Mac (Doorman), iOS (Knockond), Android (Port knocker). Fwknop: Single Packet Authorization Port Knocking fwknop stands for the 'FireWall KNock OPerator', and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports iptables and firewalld on Linux, ipfw on FreeBSD and Mac OS X, and PF on OpenBSD) and libpcap.

My iptables based firewall allows only port TCP 80 and 443. I also need tcp port # 22, but I do not have static IP at my home. How do I open and close TCP port #22 on demand under Debian or Ubuntu Linux based server systems? How do I install a port-knock server called knockd and configure it with iptables to open tcp port #22 or any other ports?
Debian or Ubuntu Linux comes with knockd. It is a port-knock server. It listens to all traffic on an ethernet and/or PPP interface created by VPN/dial-up pppd, looking for special “knock” sequences of port-hits. A knock client makes these port-hits by sending a TCP or UDP packet to a port on the server. This port need not be open — since knockd listens at the link-layer level, it sees all traffic even if it’s destined for a closed port. When the server detects a specific sequence of port-hits, it runs a command defined in its configuration file. This can be used to open up holes in a firewall for quick access.

Knockd installation

Open a terminal or login to the remote server using the ssh client. Type the following apt-get command as root user to install knockd server:
$ sudo apt-get install knockd
Sample outputs:

Configurations

Edit the file /etc/knockd.conf, enter:
$ sudo vi /etc/knockd.conf
Update the config file as follows. Feel free to set the sequence port number as per your setup 2022, 3022, 4022:

Save and close the file. Edit the file /etc/default/knockd, enter:
$ sudo vi /etc/default/knockd
Find:

Replace with:

Optional: set an interface name such as eth0 or ppp0 as per your setup:

Save and close the file.

How do I start / stop / restart kknockd?

Type the following commands:

OR

How do I knock port?

You need to use the knock command. It is a port-knock client. To open tcp port #22 for sshd at 203.1.2.3 ip address, enter:
$ knock -v 203.1.2.3 2022 3022 3022
Sample outputs:

How do I close down the port?

The syntax is:
$ knock -v 203.1.2.3 4022 3022 2022

How do I open UDP port?

The syntax is:
$ knock -v -u 203.1.2.3 9090
You can also combine TCP and UDP port as follows:
$ knock server1.cyberciti.biz 2022:tcp 9090:udp 4022:tcp

How do I verify that port was opened or closed on the server?

Use the ssh client as follows:
$ ssh user@203.1.2.3
OR
# iptables -L INPUT -v -n
# iptables -L INPUT -v -n grep :22

Please note that port knocking is nothing but security by obscurity. I suggest that:

Why cant quicken for mac connect with suntrust bank. Express Web Connect (Windows) or Quicken Connect (Mac). I was able to confirm that on our Master List of Financial Institutions that SunTrust Bank does support the Express Web Connect, Direct Connect and Web Connect methods. 8.3K Quicken for Mac; 277 Quicken Canada. Unable to connect to Suntrust and Fidelity. Note that for Suntrust Bank they support both Express Web Connect and Direct Connect. Direct Connect is still working from what I gather from another user in another thread (but he has to pay a fee to get it).

1. Secure OpenSSH properly using our “OpenSSH Server Best Security Practices” guide.
2. Use a better solution such as fwknop which implements an authorization scheme called Single Packet Authorization (SPA).

References:

• man pages – knockd, knock, and iptables