Based on this question: "Safe mode" on Linux? - So there is a configured knockd on a server, and a wrong firewall command was given out, so everybody got locked out from the server via layer3 (iptables). OK.

Could this be resolved by knocking the ports as in the knockd, so then the knockd will open given ports? Could this be a last chance to get in to the server via layer3?

Or it will not work, because if ex.: knockd configured to use port 5000 and port 5000 is blocked on all protocols, knockd will not work? Is knockd "before" the netfilter? (I mean INTERNET->KNOCKD->NETFILTER?)

  • 2
    Not if the knock port has been blocked by the firewall... – Ignacio Vazquez-Abrams Jan 17 '13 at 11:49
  • I don't have time to try it out. Are you stating that on personal experience? – gasko peter Jan 17 '13 at 12:30
  • @Ignacio -- Actually, knockd uses libpcap, which bypasses the firewall. – Jander Mar 10 '13 at 20:54

Yes, in theory, knockd could help you get into the server. To do what it does, knockd uses the libpcap library, which is the same one that Wireshark uses. The raw sockets interface that this library uses is allowed to see all incoming packets, no matter how iptables is configured.

Whether this will help you in practice depends on how knockd is configured and how the firewall is (mis)configured. For instance, imagine there is a DROP rule at the very beginning of your ruleset, and this DROP rule is preventing you from getting in. If knockd adds its ACCEPT rule at the beginning of the chain (iptables -I ...), then it will let you in. But if it adds it at the end (iptables -A ...), then you're out of luck.

Note also that since knockd is typically configured to add or delete rules from the running firewall, a misconfigured knockd could itself break your firewall. If you're using knockd as a failsafe, it might be better to have it run iptables-restore </path/to/known-good-firewall-config instead of using iptables directly. You could even do both, using a different knock pattern for each option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.