How to Use knockd for Port Knocking on Linux

Port knocking is a stealth-oriented defense technique that hides sensitive network services behind a closed firewall until a predefined sequence of connection attempts is detected. In the Linux operating system, this functionality is primarily driven by knockd, a lightweight packet-sniffing daemon. This article explains how knockd operates on Linux, how it interacts with the kernel's packet-filtering frameworks to dynamically modify firewall rules, and how it protects exposed entry points like SSH from reconnaissance and automated attacks.

The Concept of Port Knocking

Standard firewall configurations leave public service ports, such as TCP port 22 for SSH, open to the internet. While access may be restricted by passwords or cryptographic keys, the open port remains visible to port scanners, leaving it vulnerable to zero-day exploits, denial-of-service attempts, and constant brute-force attacks.

Port knocking resolves this by keeping the target port in a closed or filtered state by default. A client must "knock" on a prearranged sequence of closed ports (for example, TCP 7000, TCP 8000, and TCP 9000). Once the sequence is validated, the firewall temporarily opens the protected port specifically for the client's IP address.

How knockd Functions in Linux

Unlike standard network services that bind to specific TCP or UDP sockets and respond to incoming traffic, knockd operates at a lower level using the libpcap library. This design enables the daemon to monitor network traffic passively:

1. Passive Packet Sniffing: The daemon listens on a specified network interface (such as eth0), intercepting raw Ethernet frames. Because it does not bind to a listening socket, port scanners scanning the host see all knocked ports as completely closed or filtered.
2. State Tracking: When a packet hits a monitored port, knockd logs the client IP, the destination port, and the arrival timestamp. It maintains an internal state table to track whether incoming packets match configured knock sequences within an allowable time limit.
3. Triggering Firewall Rules: Upon verifying a successful sequence, knockd executes system-level shell commands defined in its configuration file. These commands typically interact directly with Linux packet-filtering frameworks—either legacy iptables or modern nftables.

The knockd Configuration Model

The daemon’s behavior is defined within the /etc/knockd.conf configuration file. The configuration is split into global directives and individual event triggers.

A typical configuration file includes the following components:

• Global Options: Defines the network interface to monitor and logging preferences through syslog.
• Open Event ([openSSH]):
  • sequence: A defined list of target ports and protocols (e.g., 7001:tcp,8002:tcp,9003:tcp).
  • seq_timeout: The maximum window of time (in seconds) allowed for the client to complete the sequence.
  • command: The specific firewall command executed upon success, such as appending an allow rule targeting the knocking IP address via the %IP% variable.
  • tcpflags: Flags required for the packet to match (typically syn packets).
• Close Event or Timeout ([closeSSH] or cmd_timeout):
  • Systems can use a secondary knock sequence to close the port manually, or define cmd_timeout within the open event to automatically run a tear-down command after a set number of seconds.

When using an automatic timeout, knockd executes the opening rule, waits for the configured interval, and runs the closing rule. Because Linux firewalls can track connection states using conntrack, an established SSH session remains active even after the initial opening rule is removed and the port is closed to new connection attempts.

Interaction with Linux Packet Filters

knockd does not handle packet filtering itself; it relies entirely on the Linux kernel's netfilter subsystem. In an iptables setup, the firewall is configured to block incoming traffic to the protected port by default:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

When a correct knock is registered, knockd executes a rule insertion command:

iptables -I INPUT 2 -s <client_ip> -p tcp --dport 22 -j ACCEPT

This inserts a temporary rule allowing the specific client IP to reach port 22. Once the client initiates the connection and establishes the session, the connection transitions to the ESTABLISHED state. When the temporary rule is removed, the established session persists, but no new connections from that IP or any other IP can be initiated without repeating the knock sequence.

Security Limitations and Best Practices

While knockd provides effective obscurity, it is an access-control mechanism rather than an encryption protocol. Administrators should account for specific limitations:

• Packet Sniffing and Replay Attacks: Traditional port knocks send plain TCP/UDP headers across the network. An adversary capable of monitoring traffic between the client and server can record the port sequence and replay it from the same IP, or spoof the source IP if firewall rules do not validate bidirectional state.
• NAT Interference: If multiple clients sit behind a single Carrier-Grade NAT (CGNAT) or corporate gateway, opening a port for the gateway's public IP opens access to any client behind that gateway for the duration of the window.
• Defense-in-Depth: Port knocking must never serve as the sole security boundary. Critical services must continue to enforce robust authentication, such as SSH public-key cryptography and disabled root logins.