Come See us: 123 Main St

•

Linux Server Lab | Practical Linux & Server Guides

August 9, 2026

How to Set Up Port Knocking on Linux

Even a properly firewalled, hardened SSH setup still shows up as an open port to anyone scanning your server.

Even a properly firewalled, hardened SSH setup still shows up as an open port to anyone scanning your server. Port knocking takes a different approach entirely, keeping a service’s port closed to everyone by default and only opening it briefly after receiving a specific, secret sequence of connection attempts to unrelated ports first.

What Is Port Knocking?

Port knocking works by having a small daemon monitor firewall logs for connection attempts to a specific, predetermined sequence of ports (which don’t actually need to have anything listening on them). Once that exact sequence is detected from a given IP address, the daemon temporarily opens the actual target port (SSH, for instance) for that specific IP, closing it again after a short window or once the connection is established.

Why Consider This Beyond Standard Firewall Rules

A properly configured UFW firewall () still leaves whatever ports you’ve explicitly allowed visibly open to anyone scanning your server — an attacker running Nmap sees your SSH port is open, even if they can’t successfully authenticate. Port knocking hides that port entirely from casual scanning, since the port genuinely isn’t open until the correct knock sequence has been received.

Installing knockd

On Debian or Ubuntu-based systems:

sudo apt update
sudo apt install knockd -y

Configuring the Knock Sequence

Edit the configuration file:

sudo nano /etc/knockd.conf

Define your knock sequence and the resulting action:

ini

[options]
    UseSyslog

[openSSH]
    sequence    = 7000,8000,9000
    seq_timeout = 5
    command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

[closeSSH]
    sequence    = 9000,8000,7000
    seq_timeout = 5
    command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

This example defines an “open” sequence (connecting to ports 7000, 8000, then 9000 in order) and a corresponding “close” sequence in reverse, each within a 5-second window.

Closing SSH by Default

For port knocking to actually add security value, SSH itself needs to be blocked by default, with knockd specifically responsible for temporarily opening access:

sudo iptables -A INPUT -p tcp --dport 22 -j DROP

Enabling and Starting knockd

Edit /etc/default/knockd to enable it (often disabled by default after installation):

START_KNOCKD=1

Start the service:

sudo systemctl enable --now knockd

Performing a Knock from a Client

From a client machine, the knock sequence can be sent using the knock client tool:

sudo apt install knock -y
knock your-server-ip 7000 8000 9000

After a successful knock, SSH becomes accessible for a brief window, allowing a normal SSH connection:

ssh user@your-server-ip

Automating the Knock in Your SSH Workflow

For regular use, wrap the knock and subsequent SSH connection into a single script or shell alias, avoiding needing to remember and manually run two separate commands every time you want to connect.

Port Knocking Limitations

Security through obscurity, not a complete solution – port knocking hides a service from casual scanning but doesn’t replace proper authentication; always combine it with key-based SSH authentication rather than relying on knocking alone
The knock sequence itself can be observed – anyone specifically monitoring network traffic during a legitimate knock could potentially observe and replay the sequence, though this requires considerably more effort than simple port scanning
Added complexity – every legitimate access now requires the extra knock step, which can occasionally cause its own troubleshooting headaches if the sequence or timing isn’t configured correctly

An Alternative Worth Considering: Tailscale

For many homelab users, Tailscale () accomplishes a similar underlying goal — keeping SSH inaccessible from the general internet — with considerably less manual configuration and none of port knocking’s sequence-management complexity, by simply not exposing the port publicly at all rather than hiding it behind a knock sequence.

Final Thoughts

Port knocking on Linux adds a truly interesting extra layer of obscurity on top of proper SSH hardening, hiding a service from casual internet-wide scanning entirely until the correct sequence arrives. While tools like Tailscale often provide a simpler path to the same underlying goal for most modern homelab setups, port knocking remains a valuable technique to understand, particularly for scenarios where you specifically need a port really closed by default rather than merely authenticated.