LinuxQuestions.org - Debian: Why can't I get knockd to work?

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - Debian: Why can't I get knockd to work? (https://www.linuxquestions.org/questions/linux-newbie-8/debian-why-cant-i-get-knockd-to-work-4175453530/)

Debian: Why can't I get knockd to work?

I did apt-get install knockd.

I use these 2 scripts to open and close ports. The default on startup is to have the ports closed.

open-ports:

Quote:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

close-ports:

Quote:

iptables -F
iptables -X

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

/etc/knockd.conf:

Quote:

[options]
UseSyslog

[openSSH]
sequence = 1,2,3,4
seq_timeout = 5
command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn,ack

[closeSSH]
sequence = 1,2,3,4
seq_timeout = 5
command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn,ack

can't remember what the other file is. I know when I sit in front of the computer I see "starting knockd" in the startup dialog so I know something is happening. But it doesn't matter I can't knock. I don't know what I'm doing wrong.

The point of a firewall and port knocking is to only open a desired ports so the open-ports script is not necessary. There are several knockd howtos but look at the following. You can also start knockd in debug mode (-D) to help you find problems and also check the logs.

http://go2linux.garron.me/how-to-con...ewall-iptables

I know. The reason I posted it was to show what scripts I use to open and close the firewall. I figured the problem was that knockd was not even seeing the packet. Perhaps the firewall rules meant any and all packets were being dropped at the NIC, so no programs, not even knockd could see the packets, which is what I was really asking. When I use block-ports, the policy for input becomes DROP. A debugger I guess would let me know whether or not that was happening, but that doesn't tell me why. I don't really understand how iptables works, I just assume that's the problem.