A port knock keeps a service hidden until you send a secret pattern of packets. This one is a faithful recreation of a legacy design: the firewall logs odd-looking packets, a watcher reads the log, and when one address sends the right sequence in time, SSH and RDP open for that address only, for a few minutes.
Then you break it. Knocking is one layer on top of a deny-all firewall, not a lock on its own, and this phase shows exactly where it falls short.
You need: Phase 1 finished, or at least its answer key loaded (step 0 does that).
| Step | What you'll do | Time |
|---|---|---|
| 0 | Start from Phase 1's end Rebuild the lab with the Phase 2 tools, load Phase 1's finished firewall, and read the knock's settings. | 10 min |
| 1 | Hide Close SSH for everyone, so the server's remote access disappears from the network. | 5 min |
| 2 | Knock Turn on the knock, send it from client-a, and watch the door open for client-a only. | 15 min |
| 3 | One packet by hand Craft one knock packet yourself, and see exactly what makes it different from normal traffic. | 10 min |
| 4 | Timers Watch the three timers work: the door closes, a session already open stays up, and an idle one is dropped. | 10 min |
| 5 | Break it: replay the knock Resend a captured knock from the outsider, and watch the door open for them too. | 10 min |
| 6 | Break it: guessing gets banned Guess passwords from the outsider, and watch Fail2Ban lock them out. | 10 min |
| 7 | Break it: the reused password walks past Use the password leaked in Phase 1 to sign in cleanly, past Fail2Ban, because a correct login is not a failed one. | 10 min |
| 8 | Check your work, and save it as code Confirm the knock hides the doors, then save the firewall rules so Phase 2 starts the same way every time. | 10 min |
| next | Phase 3: fix the leaks |