Re:Show HN: Knockles – eBPF Port Knocking Tool
by mmastrac on Monday August 29, 2022 @02:00PM
(#32641343)
If you have a Mikrotik kicking around, you can build firewall rules for this (IIRC, it's just a wrapper over top of linux iptables).
Basically a "knock" on a port adds an IP to a list for N seconds. A knock on port 2 from an IP in that list adds the port to another list for N seconds. A final knock on a third port adds an IP in the third list to the allowlist for a period of time (generally as long as there is activity).
For extra fun, add some guard ports around the knock ports that cause an immediate IP ban.
Basically a "knock" on a port adds an IP to a list for N seconds. A knock on port 2 from an IP in that list adds the port to another list for N seconds. A final knock on a third port adds an IP in the third list to the allowlist for a period of time (generally as long as there is activity).
For extra fun, add some guard ports around the knock ports that cause an immediate IP ban.