This very short article is about port knocking and iptables. Port knocking allows a specific port to be opened when a sequence of connection attempts on predefined ports are made. The correct sequence of “knocks” will dynamically open the desired port temporarily so that a connection can be made on the desired port.

In this article we will use port 22 as the port to hide with four (4) UDP ports to knock.


Using iptables, the following commands will create several chains, INTO-PHASE2, INTO-PHASE3, and INTO-PHASE4. Each chain will have several rules appended. Specifically a match is used to make up the condition under which the next step is invoked. If the given sequence of UDP ports are knocked in sequence port 22 on eth0 interface will open for five (5) seconds.

## Define port knocking
sudo iptables -N INTO-PHASE2
sudo iptables -A INTO-PHASE2 -m recent --name PHASE1 --remove
sudo iptables -A INTO-PHASE2 -m recent --name PHASE2 --set
sudo iptables -A INTO-PHASE2 -j LOG --log-prefix "INTO PHASE2: "
sudo iptables -A INTO-PHASE2 -j DROP

sudo iptables -N INTO-PHASE3
sudo iptables -A INTO-PHASE3 -m recent --name PHASE2 --remove
sudo iptables -A INTO-PHASE3 -m recent --name PHASE3 --set
sudo iptables -A INTO-PHASE3 -j LOG --log-prefix "INTO PHASE3: "
sudo iptables -A INTO-PHASE3 -j DROP

sudo iptables -N INTO-PHASE4
sudo iptables -A INTO-PHASE4 -m recent --name PHASE3 --remove
sudo iptables -A INTO-PHASE4 -m recent --name PHASE4 --set
sudo iptables -A INTO-PHASE4 -j LOG --log-prefix "INTO PHASE4: "
sudo iptables -A INTO-PHASE4 -m recent --rcheck --name PHASE4 -j LOG --log-prefix "(OPEN PORT 22) - "
sudo iptables -A INTO-PHASE4 -j DROP

## if you want to knock using tcp packets uncomment this line:
#sudo iptables -A INPUT -m recent --update --name PHASE1

## Define knocking sequence: knock on ports and then open SSH port for 5 seconds
sudo iptables -A INPUT -p udp --dport 23456 -m recent --set --name PHASE1
sudo iptables -A INPUT -p udp --dport 34567 -m recent --rcheck --name PHASE1 -j INTO-PHASE2
sudo iptables -A INPUT -p udp --dport 45678 -m recent --rcheck --name PHASE2 -j INTO-PHASE3
sudo iptables -A INPUT -p udp --dport 56789 -m recent --rcheck --name PHASE3 -j INTO-PHASE4

sudo iptables -A INPUT -p tcp --dport 22 -i eth0 -m recent --rcheck --seconds 5 --name PHASE4 -j ACCEPT

The following script can be used to open port 22 where HOST is the ip address of the sshd:

#!/usr/bin/env bash
set -euxo pipefail



echo "KNOCK1"
echo -n "*" | nc -w1 -u $HOST $PORT1

echo "KNOCK2"
echo -n "*" | nc -w1 -u $HOST $PORT2

echo "KNOCK3"
echo -n "*" | nc -w1 -u $HOST $PORT3

echo "KNOCK4"
echo -n "*" | nc -w1 -u $HOST $PORT4

echo "CONNECT"

Final words

Port knocking is a great way to protect your ports. Specifically for sshd, which is usually kept open. An additional enhancement for security purposes would be to change the port that sshd uses.