For those who want to ensure access to their servers from anywhere in the world via SSH/RDP/other means — a small RTFM/guide.

We need to manage without VPNs and other complexities, from any handy device.

And so that we don't have to fiddle too much with the server.

All that is needed for this is — knockd, skilled hands and 5 minutes of work.

"Everything is on the internet," of course (even on Habr), but when it comes to specific implementation — that's where it starts…

We'll be practicing with Fedora/CentOS, but it doesn't really matter.

This guide is suitable for both beginners and veterans of the trade, so there will be comments, but shorter.

1. Server

installing knock-server:
yum/dnf install knock-server

configure it (for example for ssh) — /etc/knockd.conf:

[options]
    UseSyslog
    interface = enp1s0f0
[SSHopen]
    sequence        = 33333,22222,11111
    seq_timeout     = 5
    tcpflags        = syn
    start_command   = iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    cmd_timeout     = 3600
    stop_command    = iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
[SSHclose]
    sequence        = 11111,22222,33333
    seq_timeout     = 5
    tcpflags        = syn
    command         = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT

"The opening" part is set to auto-close after 1 hour. Just in case…

/etc/sysconfig/iptables:

...
-A INPUT -p tcp -m state --state NEW -m tcp --dport 11111 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22222 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 33333 -j ACCEPT
...

go ahead:

service iptables restart
service knockd start

you can add RDP to a running virtual Windows Server (/etc/knockd.conf; substitute the interface name as desired):

[RDPopen]
    sequence        = 44444,33333,22222
    seq_timeout     = 5
    tcpflags        = syn
    start_command   = iptables -t nat -A PREROUTING -s %IP% -i enp1s0f0 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.0.2
    cmd_timeout     = 3600
    stop_command    = iptables -t nat -D PREROUTING -s %IP% -i enp1s0f0 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.0.2
[RDPclose]
    sequence        = 22222,33333,44444
    seq_timeout     = 5
    tcpflags        = syn
    command         = iptables -t nat -D PREROUTING -s %IP% -i enp1s0f0 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.0.2

We track all our client prompts on the server using the command iptables -S.

2. Guide to pitfalls

knockd.conf:

The manuals also have everything (though it’s not certain), however knockd is quite stingy with messages, so one has to be very attentive.

version
In Fedora/CentOS repositories, the latest knockd today is 0.63. If you want UDP — look for packages 0.70.
interface
In the default configuration of Fedora/CentOS, this line is missing. Add it manually, otherwise it won’t work.
timeout
Here you can choose as you like. It needs to allow the client enough time for all knocks — and thwart the port scanner (and they will be scanning at 146%).
start/stop/command.
If there is one command — then command, if there are two — then start_command+stop_command.
If you make a mistake — knockd will stay silent, but it won't work.
proto
In theory, you can use UDP. In practice, I mixed TCP and UDP, and a client from a beach in Bali could only open their gate on the fifth try. Because TCP packets arrived when needed, but for UDP — it's not guaranteed. But it’s a matter of taste, again.
sequence
The implicit pitfalls are that sequences should not overlap… how to put it…

For example, like this:

open: 11111,22222,33333
close: 22222,11111,33333

By the trigger 11111 open it will wait for the next trigger on 22222. However, upon this (22222) trigger it will start working close and everything will break. This also depends on the client's delay. Such is life ©.

iptables

If in /etc/sysconfig/iptables this is the case:

*nat
:PREROUTING ACCEPT [0:0]

that doesn't particularly bother us, then this is the case:

*filter
:INPUT ACCEPT [0:0]
...
-A INPUT -j REJECT --reject-with icmp-host-prohibited

Then it is indeed a problem.

Since knockd adds rules to the end of the INPUT chain, we will get reject.

And disabling this reject means opening the machine to all winds.

To avoid complicating iptables with where to insert what before which (as people suggest), let's simplify it:

the default in CentOS/Fedora the first rule ("what is not forbidden is allowed") will be replaced with the opposite,
and the last rule will be removed.

As a result, it should look like this:

*filter
:INPUT DROP [0:0]
...
#-A INPUT -j REJECT --reject-with icmp-host-prohibited

You can, of course, replace DROP with REJECT, but with DROP bots will have a harder time.

3. Client

This is the most interesting part (from my point of view), as you need to work not only from any beach but also from any device.

In principle, a number of clients are listed on the website the project, but that's in the same category of "everything is on the internet." Therefore, I will list what is currently working for me.

When choosing a client, it is necessary to ensure it supports the delay option between packets. Yes, not all beaches are the same and 100 megabits do not guarantee the packets arrive in the correct order at the right time from this location.

And yes — when configuring the client, the delay must be adjusted manually. Too much timeout — the bots will attack, too little — the client won't keep up. Too much delay — the client won't keep up or there will be a conflict of pings (see "pitfalls"), too little — packets will get lost on the internet.

With timeout=5s, a working option is delay=100..500ms

Windows

As strange as it sounds, finding a proper knock client for this platform is quite non-trivial. Something that uses CLI, supports delay, TCP — and without frills.

One option is to try this here. Apparently, Google isn't cutting it for me.

Linux

It's pretty straightforward here:

dnf install knock -y
knock -d   11111 22222 33333

MacOS

The easiest way is to install the port from homebrew:
brew install knock
and create the necessary batch command files like:

#!bin/sh
knock -d <delay> <dst_ip> 11111 22222 33333

iOS

A working option is KnockOnD (free, from the store).

Android

"Knock on Ports." This is not an advertisement, but it works. And the developers are quite responsive.

P.S. The markdown on Habr, of course, bless it with health someday…

UPD1: thanks to a good person I found a working client for Windows.
UPD2: another good person reminded me that adding new rules to the end of iptables isn't always useful. But — it depends.

Source: habr.com

Linux tips & tricks: server, open up