I found an implementation of port knocking described in an article: https://www.digitalocean.com/community/tutorials/how-to-configure-port-knocking-using-only-iptables-on-an-ubuntu-vps
I checked what iptables DROP actually means and now I am very confused: https://serverfault.com/questions/157375/reject-vs-drop-when-using-iptables
When using DROP rules: - UDP packets will be dropped and the behavior will be the same as connecting to an unfirewalled port with no service. - TCP packets will return an ACK/RST which is the same response that an open port with no service on it will respond with. Some routers will respond with and ACK/RST on behalf of servers which are down.
In my book this means that the response for DROP will be different than for a closed port. And if they can be distinguished from each other, then the members of the knocking sequence can be found. If somebody knows the members of the sequence, then it takes several magnitude less trials to crack this kind of defense, which means it can be brute forced very easily.
Am I right that this implementation of port knocking is vulnerable?