I setup port knocking rules on CentOS 7, iptables as follow:
-I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7
-I INPUT -p tcp --dport 2 -m recent --rcheck --rsource --seconds 20 --name KNOCK1 -m recent --set --rsource --name KNOCK2 -m limit --limit 5/min -j LOG --log-prefix "knock 2" --log-level 6
-I INPUT -p tcp --dport 3 -m recent --rcheck --rsource --seconds 20 --name KNOCK2 -m recent --set --rsource --name OPEN_NOW -m limit --limit 5/min -j LOG --log-prefix "knock 3" --log-level 6
-I INPUT -p tcp --dport 22 -m state --state NEW -m recent --rcheck --rsource --seconds 20 --name OPEN_NOW -j ACCEPT
Then I blocked port 22:
iptables -A INPUT -p tcp --dport 22 -j DROP
It works correctly because before sending the port sequence, nmap displays as:
22/tcp filtered ssh no-response
And after sending the following probes (on Windows):
nmap -PN --host_timeout 201 --max-retries 0 -p 1 200.xxx.xxx.xxx && nmap -PN --host_timeout 201 --max-retries 0 -p 2 200.xxx.xxx.xxx && nmap -PN --host_timeout 201 --max-retries 0 -p 3 200.xxx.xxx.xxx
Both nmap and nc shows it as open:
nmap:
22/tcp open ssh syn-ack ttl 49
nc:
hostname.xxxx.xxxx [200.xxx.xxx.xxx] 22 (ssh) open
However, I cannot ssh into it, using any client (Putty, nc). It timeouts as Iptables is correctly dropping the packets. But the port is OPEN (since the probes opened the port) meaning the DROP rule was no longer in effect and nmap/nc got "Ack / Open", shouldnt I be able to ssh?