Fine, just have your webserver give a 401 to everyone other than the IP address you want to access. If you really want port knocking to get in then have your server listn on port 52485 or whatever and add the IP to the allowed list.

I would rather the server doing any processing of the packets be running as a low privilege user than sitting in the kernel.