Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Based on this question: "Safe mode" on Linux? - So there is a configured knockd on a server, and a wrong firewall command was given out, so everybody got locked out from the server via layer3 (iptables). OK.

Could this be resolved by knocking the ports as in the knockd, so then the knockd will open given ports? Could this be a last chance to get in to the server via layer3?

Or it will not work, because if ex.: knockd configured to use port 5000 and port 5000 is blocked on all protocols, knockd will not work? Is knockd "before" the netfilter? (I mean INTERNET->KNOCKD->NETFILTER?)

share|improve this question
Not if the knock port has been blocked by the firewall... – Ignacio Vazquez-Abrams Jan 17 '13 at 11:49
I don't have time to try it out. Are you stating that on personal experience? – gasko peter Jan 17 '13 at 12:30
@Ignacio -- Actually, knockd uses libpcap, which bypasses the firewall. – Jander Mar 10 '13 at 20:54

Yes, in theory, knockd could help you get into the server. To do what it does, knockd uses the libpcap library, which is the same one that Wireshark uses. The raw sockets interface that this library uses is allowed to see all incoming packets, no matter how iptables is configured.

Whether this will help you in practice depends on how knockd is configured and how the firewall is (mis)configured. For instance, imagine there is a DROP rule at the very beginning of your ruleset, and this DROP rule is preventing you from getting in. If knockd adds its ACCEPT rule at the beginning of the chain (iptables -I ...), then it will let you in. But if it adds it at the end (iptables -A ...), then you're out of luck.

Note also that since knockd is typically configured to add or delete rules from the running firewall, a misconfigured knockd could itself break your firewall. If you're using knockd as a failsafe, it might be better to have it run iptables-restore </path/to/known-good-firewall-config instead of using iptables directly. You could even do both, using a different knock pattern for each option.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.