How To Use fwknop to Enable Single Packet Authentication on Ubuntu 12.04

Introduction

Exposing services to the internet is always a risk but is often the entire reason behind having a server in the first place. Any open port or exposed service can be subjected to a quite a lot of probing and access attempts by malicious users or automated scripts.

While some services must remain accessible because they are meant to be publicly consumable (like a web server hosting a site), other services are only meant to be used by one or a few authorized users and no one else (like SSH). In the best case scenario, these services would be well secured, but also only accessible when we actually want to use them.

Single Packet Authentication is a method of allowing the firewall to block access to a service until a specialized, encrypted packet is sent to a listening service. When the service validates this packet, it promptly modifies the firewall rules to expose the needed port.

A tool called fwknop, which stands for Firewall Knock Operator, can be used to interpret these packets and modify firewall rules. In this guide, we will be configuring a fwknop server and client on Ubuntu 12.04 systems. This will enable us to shield our SSH server until specifically requested.