How To: Install a Port Knocker - FWKNOP

**Sef** · June 9th, 2008

Moved to Tips and Tutorials.

**gmendoza** · June 9th, 2008

Ahh... I see now. The problem was perhaps version specific. Yeah, the previous version on the doc was actually 1.9.0, so obviously later versions introduced new issues. Thanks for the info.

The good news is, 1.9.4 works well, and adds the really nice feature of accepting SPA packets on a range of ports to avoid IDS signatures, etc.

That would be cool to add to the doc as well.

**cprofitt** · June 10th, 2008

Very nice -- been reading about this but not seen any application to try it...

I will have to follow this next weekend on my test server... looks like fun.

**kevdog** · July 20th, 2008

Version 1.96 Released

Awaiting update of Change List
(Will update guide once server appropriately tested with new version)

**kevdog** · September 13th, 2008

Version 1.9.7 Released - http://trac.cipherdyne.org/trac/fwkn....9.7/ChangeLog

Supposedly an unofficial Debian repository has been created to simply installation of the fwknop server on Debian/Ubuntu. I have not yet verified these steps however instructions are given here:
http://cipherdyne.org/blog/2008/08/i...nd-ubuntu.html

Happy Port Knocking!!

**kevdog** · October 30th, 2008

For all you Arch users -- just to let you know that fwknop is being distributed:
http://aur.archlinux.org/packages.php?ID=20630

**krammer** · February 11th, 2009

Ok, so I cannot get fwknop client working for the life of me on my linux box, internally and externally...it works fine from my Windows machine, where I then use putty after the encrypted packet is sent.

On my linux box for fwknop, I use:

Code:

fwknop -A tcp/22 -a 192.168.1.6 -D 192.168.1.3
ssh username@192.168.1.3

Am I doing anything wrong here??? Does the windows client use different default options that aren't seen? I don't have iptables running on the linux fwknop client...so nothing should be blocked.

Thanks to anyone who can help.

**kevdog** · February 12th, 2009

A couple of things you might want to try:

fwknop can be run in debug mode with the --debug command line option. This will disable daemon mode execution, and print verbose information to the screen on STDERR as packets are received

Also, after issuing the first command, port 22 should be open on the server. I would use nmap to scan the server for specifically port 22 to see if the port is open.

**krammer** · February 13th, 2009

I ran an nmap scan after issuing the fwknop command, and port 22 was "filtered" not open...so something is going wrong. I know I have the right key, and I know it's the right IP.

I also ran it in debug mode...it didn't give me anything useful. It just spit back some perl paths, and then the steps it went through sending the SPA.

There wasn't really any confirmation that it sent successfully...just:

[+] Sending 182 byte message to 192.168.1.3 over udp 62201...

That was the last line. Is that right? I guess I could always run a sniffer to see if it gets to my server.

**kevdog** · February 13th, 2009

Ok, so you can confirm a packet was sent to the server from the client.

On the server I would do the following:

1. Wireshark -- A packet sniffer -- see if you get packet received from client

2. The command:
sudo iptables -L
This will list your current firewall rules. If successful, you should see a change in this list if the packet was successful.

3. Also, I think fwknopd keeps a log. Have you investigated this?

Also a few things:
Are you running the daemon in debug mode?: Similar to this:
sudo perl ./fwknopd --debug

If stuck can you post your script that establishes your iptables, and also your /etc/fwknop/access.conf file.