Linux Firewalls

Port Knocking

In 2003, a brilliant concept called port knocking^[71] was introduced to the security community by Martin Krzywinski in an article in SysAdmin magazine. Port knocking is the communication of authentication data across closed ports which allows a service (such as SSHD) to be protected behind a packet filter configured in a default-drop stance. Any would-be client that wishes to make a connection to a protected service through the default-drop packet filter must first prove possession of a valid port-knock sequence. If a client produces a correct knock sequence (e.g., by connecting to each constituent port of the sequence in the proper order), then the packet filter is temporarily reconfigured to allow the IP address that sent the sequence ...