I found an implementation of port knocking described in an article: https://www.digitalocean.com/community/tutorials/how-to-configure-port-knocking-using-only-iptables-on-an-ubuntu-vps

I checked what iptables DROP actually means and now I am very confused: https://serverfault.com/questions/157375/reject-vs-drop-when-using-iptables

When using DROP rules: - UDP packets will be dropped and the behavior will be the same as connecting to an unfirewalled port with no service. - TCP packets will return an ACK/RST which is the same response that an open port with no service on it will respond with. Some routers will respond with and ACK/RST on behalf of servers which are down.

In my book this means that the response for DROP will be different than for a closed port. And if they can be distinguished from each other, then the members of the knocking sequence can be found. If somebody knows the members of the sequence, then it takes several magnitude less trials to crack this kind of defense, which means it can be brute forced very easily.

Am I right that this implementation of port knocking is vulnerable?

  • 2
    I suggest you read the comments on the linked answer, as it is contested. I also do not agree with the answer. Also the behavior could be verified with a packet capture. – multithr3at3d May 4 '20 at 14:52
  • Port knocking was an interesting novelty back in the day, today not so much. It's a fun exercise but you should carefully evaluate any use case as port knocking is almost certainly a bad way to go. – user10216038 May 4 '20 at 15:07
  • @user10216038 Idk why an additional layer of security can be bad. Does it compromise something else? – inf3rno May 4 '20 at 15:18
  • Yes! as @multithr3at3d pointed out, the port knocking is readily apparent in the packet traffic. What's more, it's a virtual flare of, "Hey look at me, I'm doing something unusual!" – user10216038 May 4 '20 at 15:22

As a matter of fact, there is no response in DROP. But yes, it is different as the OS will send back an icmp reply for a closed port indeed.

About the safety of the code, it simply drops all other ports as well, so it seems safe enough:

sudo iptables -A GATE1 -j DROP
  • Okay, but what happens when I run iptables on a server and I forward only the ports from the router which I use in the knocking sequence? Isn't it possible in that case that the router sends a different response for a port scanning as the DROP on the server? Well I guess your answer responded that. – inf3rno May 4 '20 at 15:20
  • if the rule is DROP, it always drops the packets with no replies sent back to the sender. REJECT on the other hand, drops the packet and send his condolences to the sender using icmp :) – MTG May 4 '20 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.