knock: Port Knocking CLI

What is knock

Knock is a port knocking client that opens firewall ports when you send a specific sequence of connection attempts. It’s handy for bouncing in and out of a host that hides services behind a closed firewall.

How it works (in short): you send carefully ordered connection attempts to a host; if the sequence matches what the server expects, the firewall temporarily opens the requested port.

Quick start

  • Install (examples, Debian/Ubuntu):
sudo apt-get update
sudo apt-get install knock
  • Basic single-port knock (TCP by default):
knock hostname 80:tcp
  • Knock on a port using UDP (explicit):
knock -u hostname 53:udp
  • Force IPv4 or IPv6 usage:
knock -4 hostname 22:tcp
knock -6 hostname 443:tcp
  • Display verbose output for troubleshooting:
knock -v hostname 8080:tcp

Common pitfalls and tips

  • Protocols matter: TCP and UDP are treated separately by your firewall. Always specify the correct protocol for the knock sequence; assuming TCP will fail if the server expects UDP.

  • Server expectations: The server side must be configured to recognize and respond to the exact knock sequence. If you don’t own or control the target, you may not know the required sequence.

  • IPv4 vs IPv6: If you’re in a mixed environment, make sure you’re knocking to the correct IP family. Using -4 or -6 enforces the intended family.

  • Verbose output helps: Use -v to see what knock attempts the client is sending and what the server is returning. This can highlight mismatches or timeouts.

  • Timeouts and sequencing: Port knocking relies on timing. If your knocks come too fast or too slowly, the firewall might ignore them. Re-check any server-side timing configuration if you control it.

  • Security note: Port knocking can reduce exposure but is not a foolproof security measure. Combine with strong authentication and monitoring.

Practical example: a complete one-off workflow

  • Suppose the server expects a UDP knock on port 7000, followed by a TCP knock on port 22.
# First UDP knock on 7000
knock -u -v server.example.com 7000:udp

# Then TCP knock on 22
knock -v server.example.com 22:tcp

What to do if things go wrong

  • If you see errors, run with -v to get more details about the failure.
  • Verify the server-side knock sequence and that the firewall rule is in the expected state.
  • Check network path issues: could be NAT, firewall, or rate-limiting interfering with the knocks.

Bottom line

Knock is a pragmatic tool for controlled firewall access via port knocking. Start with simple UDP or TCP sequences, verify verbose feedback, and ensure server-side expectations are aligned. As with any security mechanism, test carefully and don’t rely on it in isolation.

See Also