I am interested in using port knocking to strengthen security of a private server on the internet. I was unhappy with implementations that most commonly shows up on the internet (where a sequence of ports are tried) because they're vulnerable to sniffing attacks. I thought about implementing a dynamic sequence based on time/secrets.
I then stumbled upon Tumbler which does mostly what I want. The only problem is that it now runs a service that is not even as secure as SSH itself and which is just as discoverable. This article recommends setting up a firewall rule that DROPs all other incoming UDP packets instead of REJECTing so that UDP port scanners think ALL ports are open (and take very long). I think that's bad practice.
Instead, I'd like to ACCEPT the packets on the Tumbler port but still send the ICMP port unreachable message so that it looks like the port is closed. How can I do this? I can't see a way with iptables.
One could argue that if that's possible then knocking isn't even required. That is true for protecting simple port scanners but not for protection against SSH connection attempts to random ports.
In summary, what I'd like is (for example):
1 Tumbler or similar listening (UDP 5678)
2 sshd listening on (TCP 5679)
3 IPTABLES ACCEPT packets to (UDP 5678) but still send ICMP unreachable port (thus UDP 5678 looks closed/uninteresting to scanners)
4 IPTABLES REJECT all others
5 On successful knock to Tumbler (which remains silent), IPTABLES to ACCEPT connections to SSH (Tumbler does this anyway)
How do I do point 3? Thanks!