fwknop

Project Overview

fwknop implements an authorization scheme known as Single Packet Authorization (SPA) for strong service concealment. SPA requires only a single packet which is encrypted, non-replayable, and authenticated via an HMAC in order to communicate desired access to a service that is hidden behind a firewall in a default-drop filtering stance.

Key Features

• Single Packet Authorization (SPA): Next-generation Port Knocking
• Replay attack protection: SPA prevents replay attacks via encryption and HMAC authentication
• Service concealment: Services hidden behind default-drop firewall policies, invisible to Nmap scans
• Multi-firewall support: Supports iptables, firewalld, PF, and ipfw across Linux, OpenBSD, FreeBSD, and macOS
• Custom script support: Extensible with ipset, nftables, and other custom scripts
• Encryption options: Supports Rijndael block cipher and GnuPG asymmetric encryption

Target Audience

• Security administrators who need to protect critical services like SSH from scanning
• System administrators concerned about zero-day vulnerabilities and unpatched code
• Network security researchers

Quick Start

1. Install fwknop (via package manager or source compilation)
2. Configure the /etc/fwknop/access.conf file
3. Generate encryption and HMAC keys using the --key-gen option
4. Send SPA packets using the fwknop client
5. Receive and process SPA requests using the fwknopd daemon

Core Advantages

• More secure than traditional Port Knocking with SPA
• Supports multiple firewalls and operating systems
• Encryption (Rijndael/GnuPG) + HMAC dual authentication
• Open-source and free

System Requirements

• OS: Linux, OpenBSD, FreeBSD, macOS
• Additional Dependencies: libpcap (for passive SPA data acquisition)