Port Knocking for Security w KnockD

18th August 2026

Situation; we have a few cloud database instances, and the clients do not have static IP addresses. The cloud service offers only a basic firewall; it does NOT support DNS entries, or Geo-filtering. Cloud services like Digital Ocean don’t allow users to upload/install dedicated firewall images like pfSense.

Proposed Solution; Allow clients to exempt themselves using port knocking, like a combination lock

Destination:

apt install knockd iptables-persistent nano -Y
cp /etc/knockd.conf /etc/knockd.conf.example
iptables -A INPUT -p tcp –dport 443 -j REJECT
(this assumes the service you want to protect is on port 443 (HTTPS))
(don’t recommend port 22 until you have verified the setup is working correctly, as you may lock yourself out)
systemctl start netfilter-persistent
netfilter-persistent save
netfilter-persistent reload
nano /etc/knockd.conf
(edit the sequence, don’t use ports in order. tcp is the default, verify -I(not -A), verify tcpflags = syn
in the start_command line, verify the correct dport)
ip a
(note your nic name)
nano /etc/default/knockd
START_KNOCCKD=1
(1=on)
KNOCKD_OPT=”-i eth0“
(del starting #, replace eth0 with the nic name you looked up in a previous step)
systemctl start knockd
systemctl status knockd
systemctl enable knockd
(this makes it start after every reboot)

Source:

on linux use the knock command ie knock destination 9007 9999 9001 it gets installed with knockd

technically you don’t need a specific program to knock, it just makes it easier

On windows i have confirmed this port knocking client works.
Its a portable app so it can be downloaded and used even if the client doesn’t have administrator permissions.

If the cloud hosting has a separate firewall you will need to allow the tcp ports you are using for the knocking or the destination will never hear the knock sequence

iptables should work with docker, docker bypasses ufw!