Hello

I am using a debian wheezy with iptables.

I'd like to have either:

- port triggering / knocking (if I understood correctly). Ie, I try to access a given port from an IP, and this request will open for this IP another port for a given time. I couldnt find anything about this on iptables

or

- port forwarding: I've found the classic
-A PREROUTING -i eth0 -p tcp -m tcp --dport 8010 -j REDIRECT --to-ports 80
which will redirect port 8010 to 80, but I'd like that port 80 remains prohibited for everybody (or at least, any external IP) - the idea is to hide the port from scanners (I have other security after that, I know hiding is not enough)

How could I achieve this ?

Thks for the help

J

Port knocking includes more then just iptables. In a nutshell a server runs that monitors traffic on the desired knocking ports. When it matches then the desired service ports are opened via iptables.

http://www.cyberciti.biz/faq/debian-...king-tutorial/

A more secure version of port knocking is called Single Packet Authorization.

http://www.linuxjournal.com/article/9565
https://help.ubuntu.com/community/Si...tAuthorization

Many thanks, these links are excellent.

Would you have any suggestions regarding my second question - how to block a given port when it comes straight from the outside, but not when it has been pre-procesed and redirected ?


Rgds

One can do port knocking solely in iptables with the -m recent module
or something like that.

There are other nice things where you can search the conent of a package and then add ips to a recent list.

The second one can also be done with the recent thing. Just only allow ips within a set and block the others. Or take a look at -m set this is a bit more powerfull than recent but on debian wasn't included in default kernel of squeeze at least.

thanks - I've installed simple port knocking ,and it works as expected,


many thanks for the help

J.