I am interested in using port knocking to strengthen security of a private server on the internet. I was unhappy with implementations that most commonly shows up on the internet (where a sequence of ports are tried) because they're vulnerable to sniffing attacks. I thought about implementing a dynamic sequence based on time/secrets.

I then stumbled upon Tumbler which does mostly what I want. The only problem is that it now runs a service that is not even as secure as SSH itself and which is just as discoverable. This article recommends setting up a firewall rule that DROPs all other incoming UDP packets instead of REJECTing so that UDP port scanners think ALL ports are open (and take very long). I think that's bad practice.

Instead, I'd like to ACCEPT the packets on the Tumbler port but still send the ICMP port unreachable message so that it looks like the port is closed. How can I do this? I can't see a way with iptables.

One could argue that if that's possible then knocking isn't even required. That is true for protecting simple port scanners but not for protection against SSH connection attempts to random ports.

In summary, what I'd like is (for example):

1 Tumbler or similar listening (UDP 5678)

2 sshd listening on (TCP 5679)

3 IPTABLES ACCEPT packets to (UDP 5678) but still send ICMP unreachable port (thus UDP 5678 looks closed/uninteresting to scanners)

4 IPTABLES REJECT all others

5 On successful knock to Tumbler (which remains silent), IPTABLES to ACCEPT connections to SSH (Tumbler does this anyway)

How do I do point 3? Thanks!


You won't be able to implement this on application level (i.e. by using Tumbler). It has to be done in the iptables itself, by using the pknock match from xtables-addons kernel extension. They also support secure cryptographic SPA (single packet authorization) over single UDP port, so if you got access to your kernel they are preferable to tumbler or anything on application level.

Build it and add to your kernel by googling the guide for your OS.

https://www.howtoforge.com/xtables-addons-on-centos-6-and-iptables-geoip-filtering - for example this one for CentOS 6...

| improve this answer | |
  • Thank you very much for the information. xtables seems very useful. It still doesn't seem to allow you to make it so that the firewall responds with ICMP "port unreachable" for packets to the UDP port used for knocking - which is all I want. – Stefan Hartman Dec 11 '15 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.