Phase 2 hid SSH behind a port knock and then broke it: the knock carries no secret, so a captured copy, resent, opens the door for anyone. This phase keeps the same test and tries a modern answer, Single Packet Authorization (SPA), which fixes exactly that.
WireGuard, a third approach, is covered as a read at the end; it needs kernel support this container lab doesn’t have, so its behaviour is described, not run here.
Every result on these pages comes from the lab. Nothing is claimed that wasn’t measured.
You need: Phase 2 finished (the knock in place). The SPA tool, fwknop, is already in the images.
| Step | What you'll do | Time |
|---|---|---|
| 0 | Set up SPA next to the knock Hide SSH again, then stand up fwknop on the firewall so a single encrypted packet can open the door. | 15 min |
| 1 | One packet opens the door Open SSH with a single SPA packet, and see how little crosses the wire compared with the knock. | 10 min |
| 2 | The replay test Resend a captured SPA packet and confirm the door stays shut, the test the knock failed. | 10 min |
| 3 | Knock vs SPA, side by side See the two methods against the same tests, from the lab's own results. | 5 min read |
| 4 | WireGuard, for comparison (a read) Understand a third approach the lab doesn't run: a VPN that answers nothing it doesn't recognise. | 5 min read |
| next | Phase 5: traffic shaping |