I'm trying to add port-knocking to my home network setup so that I can hide a couple of services from the world (ssh being the most important one). I came across knockd which seems like a perfect solution, except that it is flat-out not working for me.
My plan is to run an instance of knockd on a server machine that is inside my home network firewall. I'll port-forward from the router/firewall all the ports necessary for the port-knocking sequence. E.g. I'll forward ports 100, 200, 300, 400 plus port 22 to the server (obviously, those won't be the actual ports I'll use since I've advertised them here). Then I'll block port 22 on the interior server and setup knockd rules to open it for a small window of time when the correct port-knock sequence is sent (in this example, 100 - 200 - 300 - 400). For my initial setup and testing, I'm just trying to get the port knocking to work from within the firewalled network setup. I have knockd running on the server, and I'm knocking from another machine within the network - port forwarding should not be complicating my test setup.
This just isn't working. I send down the knock sequence and I can't find any evidence that knockd has detected it. Nothing in knockd's log (even after turning on debugging info), nothing to stdout. I've tried to make things simple by just having knockd write out a file into /tmp when it gets the right sequence -- i.e. I'm not even doing anything complicated on the server with iptables yet -- and I'm getting no success.
I've tried implementing the knock in a couple of ways as suggested by cookbook sites. 4 telnet commands to send the sequence, knock via "nc -z HOST PORT PORT PORT", and even the knock command line client itself.
The server I'm using happens to also be running vmware server 2.0.2. Since knockd listens at level 2 in the network stack (from what I understand) I was wondering if there might be a conflict between what vmware is doing to support bridged networking and what knockd is doing.
I tried a similar setup inside a VM running on the above mentioned server and still nothing works. So that had me wondering again if vmware is munging things at a low networking level to support the guest.
So I'm wondering if anyone knows more detail here. Can a technology like knockd be used in a vmware environment? Do I have to setup a separate, real server just to support this kind of stealth for ssh in my home network?