Is port knocking good for a last chance when everything is locked out via the Firewall?

Question

Based on this question: "Safe mode" on Linux? - So there is a configured knockd on a server, and a wrong firewall command was given out, so everybody got locked out from the server via layer3 (iptables). OK.

Could this be resolved by knocking the ports as in the knockd, so then the knockd will open given ports? Could this be a last chance to get in to the server via layer3?

Or it will not work, because if ex.: knockd configured to use port 5000 and port 5000 is blocked on all protocols, knockd will not work? Is knockd "before" the netfilter? (I mean INTERNET->KNOCKD->NETFILTER?)

Answer 1

Yes, in theory, knockd could help you get into the server. To do what it does, knockd uses the libpcap library, which is the same one that Wireshark uses. The raw sockets interface that this library uses is allowed to see all incoming packets, no matter how iptables is configured.

Whether this will help you in practice depends on how knockd is configured and how the firewall is (mis)configured. For instance, imagine there is a DROP rule at the very beginning of your ruleset, and this DROP rule is preventing you from getting in. If knockd adds its ACCEPT rule at the beginning of the chain (iptables -I ...), then it will let you in. But if it adds it at the end (iptables -A ...), then you're out of luck.

Note also that since knockd is typically configured to add or delete rules from the running firewall, a misconfigured knockd could itself break your firewall. If you're using knockd as a failsafe, it might be better to have it run iptables-restore </path/to/known-good-firewall-config instead of using iptables directly. You could even do both, using a different knock pattern for each option.