Let's say you're a bank. You implement port knocking as your security measure of choice to keep SSH secure.
I know from your job postings that your developers and IT department work at X location in Y city. I know the IP range of your public facing servers. I go to the closest coffee shops to that office, and drop off some wifi sniffers that record and send me all the communication to that IP range. All it takes is one of your employees doing some work on one of those servers from the coffee shop, and now I know your port knock sequence. Layer defeated.
Or, you use a VPN. I do the same thing. All I see is VPN traffic. Maybe I can identify what type of traffic with DPI (unlikely to have the horsepower on the type of device you'd be leaving unattended at/near coffee shops for extended periods of time), but no real details on where that traffic is ultimately headed, and I have no ingress point given up to me. The VPN can also be used to secure other types of traffic beyond SSH.
There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive.
But I would say in addition to a VPN, not instead of. Imagine the vpn client had it built in to do the knock, before connecting. So the VPN ports are not opened until the knock is performed and only for the source IP that did them.
If someone is burning multiple private 0day exploits to target you then they are attackers at the level where port knocking is not likely to foil them either.
(And to be clear, I just think that port knocking is a bit silly - not that it's totally ineffective, and it's not what I would call security through obscurity, since it is effectively another auth factor with a simple PIN)
Blocking all icmp traffic breaks tcp - so true "invisibility" isn't that grät either.
Decades of running without a single intrusion. We moved to SPA port knocking and now we rely less on the VPN for certain assets.
I would imagine that this is open for a man in the middle attack- if this traffic were intercepted- you'd be able to see port numbers, right?
Sure but I hope the service you're opening up with the knock is actually secure like ssh.
The idea is just that you cant portscan to find something to attack. Its basically the same reasoning behind using non standard ports, but takes it a bit further.
If you want to add another layer and manage another secret- why not just add another layer of the lower-friction and more secure methods we already use to establish secret-based auth?
I think the main reason you'd use port knocking is because it's fun and cool.
The answer to that may dictate if the technique would have value for you.
If you want two layers of secret-based auth- why would you make your second layer one that's objectively less secure and more unwieldy than other layers?