Situation; we have a few cloud database instances, and the clients do not have static IP addresses. The cloud service offers only a basic firewall; it does NOT support DNS entries, or Geo-filtering. Cloud services like Digital Ocean don’t allow users to upload\/install dedicated firewall images like pfSense.<\/p>\n\n\n\n
Proposed Solution; Allow clients to exempt themselves using port knocking, like a combination lock<\/p>\n\n\n\n
Destination:<\/p>\n\n\n\n
apt install knockd iptables-persistent nano -Y Source:<\/p>\n\n\n\n on linux use the knock command ie knock destination 9007 9999 9001 it gets installed with knockd<\/p>\n\n\n\n technically you don’t need a specific program to knock, it just makes it easier<\/p>\n\n\n\n
cp \/etc\/knockd.conf \/etc\/knockd.conf.example
iptables -A INPUT -p tcp –dport 443 <\/strong>-j REJECT
(this assumes the service you want to protect is on port 443 (HTTPS))
(don’t recommend port 22 until you have verified the setup is working correctly, as you may lock yourself out)
systemctl start netfilter-persistent
netfilter-persistent save
netfilter-persistent reload
nano \/etc\/knockd.conf
(edit the sequence<\/strong>, don’t use ports in order. tcp is the default, verify -I<\/strong>(not -A), verify tcpflags <\/strong>= syn
in the start_command <\/strong>line, verify the correct dport)
ip a
(note your nic name)
nano \/etc\/default\/knockd
START_KNOCCKD=1
(1=on)
KNOCKD_OPT=”-i eth0<\/strong>“
(del starting #, replace eth0 with the nic name you looked up in a previous step)
systemctl start knockd
systemctl status knockd
systemctl enable knockd
(this makes it start after every reboot)
<\/p>\n\n\n\n