Port Knocking

Port Knocking with IPTABLES

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F

iptables -N PORTKNOCKING
iptables -N KNOCK1
iptables -N KNOCK2
iptables -N KNOCK3
iptables -N GRANTED

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 123 -j REDIRECT --to-port 22
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 123 -j ACCEPT

iptables -A INPUT -j PORTKNOCKING

iptables -A KNOCK1 -p tcp --dport 11111 -m recent --name CHECK1 --set -j DROP
iptables -A KNOCK1 -j DROP

iptables -A KNOCK2 -m recent --name CHECK1 --remove
iptables -A KNOCK2 -p tcp --dport 22222 -m recent --name CHECK2 --set -j DROP
iptables -A KNOCK2 -j KNOCK1

iptables -A KNOCK3 -m recent --name CHECK2 --remove
iptables -A KNOCK3 -p tcp --dport 44444 -m recent --name CHECK3 --set -j DROP
iptables -A KNOCK3 -j KNOCK1

iptables -A GRANTED -m recent --name CHECK3 --remove
iptables -A GRANTED -p tcp --dport 22 -j ACCEPT
iptables -A GRANTED -j KNOCK1

iptables -A PORTKNOCKING -m recent --rcheck --seconds 30 --name CHECK3 -j GRANTED
iptables -A PORTKNOCKING -m recent --rcheck --seconds 15 --name CHECK2 -j KNOCK3
iptables -A PORTKNOCKING -m recent --rcheck --seconds 15 --name CHECK1 -j KNOCK2
iptables -A PORTKNOCKING -j KNOCK1

nmap -Pn --host_timeout 201 --max-retries 0 -p 11111 -n 192.168.1.83
nmap -Pn --host_timeout 201 --max-retries 0 -p 22222 -n 192.168.1.83
nmap -Pn --host_timeout 201 --max-retries 0 -p 44444 -n 192.168.1.83