Knockd

From DD-WRT Wiki

Revision as of 08:13, 9 February 2006 by 209.66.124.150 (Talk)
Jump to: navigation, search

Introduction

knockd is a utility that can enhance security on your network. knockd will perform whatever action you script until a special knock sequence is given. A knock sequence is defined as a series of either TCP or UDP requests on defined ports. These ports do not even have to be open.

For example, a script could be written to forward the SSH port (port 22) to a specific LAN host for 20 seconds when the knock sequence is given. This knock sequence could be defined as connecting to port 22 twice with UDP, port 151 once with TCP, and then port 15 with UDP, for example.

Port Scanning the routers WAN interface would yield no ports open. If the port scan was run again within 20 seconds of sending the knock sequence, the scan would yeild that port 22 was open. This could enhance security as most attacks begin with port scans to determine what services you have open, and port 22 wouldn't show up unless the attacker both expected you to be running knockd AND took the time to deterime the knock sequence.

A knock sequence of connecting with either udp or tcp on port 1, followed by port 2, followed by port 3, followed by port 4, followed by port 5 could be used to launch a script that closes all ports on the router, or even disables the WAN port for 60 seconds before bringing it back up. In this way you are protecting yourself from attackers as soon as a port scan is detected.

Further examples may be seen at Linux Journal's General Discussion of Port Knocking