
fwknop - Firewall Knock Operator

fwknop implements a flexible port knocking (*) scheme around iptables log
messages.  Supported knock sequences include both encrypted and shared
sequences which can be augmented with both relative and absolute timeouts,
multi-protocol usage (tcp, udp, and icmp), and passive OS guess masking.

fwknop operates in two modes, "server" and "client".  When running in server
mode, fwknop parses the file /etc/fwknop/access.conf to get all access
definitions (source address, sequence type, access port(s) and protocol, OS
fingerprint requirements, etc.) and then begins watching all iptables log
messages as they are written to syslog.  If a matching sequence is monitored
then the iptables ruleset on the underlying system will be modified to allow
access to the port(s) that are either defined in access.conf or contained
within the knock sequence (for encrypted sequences).  When running in client
mode, fwknop sends either a shared or an encrypted knock sequence to the
destination system (which must be running fwknop in server mode).  In client
mode fwknop parses the file ~/.fwknoprc if sending a shared knock sequence
to the destination or for encrypted sequences fwknop accepts command line
input.  See the fwknop(8) man page for more information.

* The term "port knocking" was coined by Martin Krzywinski, see
http://www.portknocking.org
