1. Confirm SSH is shut
copydocker compose exec client-a nmap -n -Pn -p 22 10.10.20.10
2. Send one SPA packet
Use the keys from step 0. -N names the service to open (the server’s SSH), -D is the firewall.
copydocker compose exec client-a fwknop -A tcp/22 -N 10.10.20.10:22 -a 10.10.10.11 -D 10.10.10.1 --key-base64-rijndael PASTE_KEY_BASE64 --key-base64-hmac PASTE_HMAC_KEY_BASE64
3. Sign in
copydocker compose exec client-a ssh netstate@10.10.20.10
4. See what the firewall opened
copydocker compose exec fw iptables -S FWKNOP_FORWARD
You should see
- The scan before:
22/tcp filtered. - After the one packet: SSH connects.
FWKNOP_FORWARDholds a short-lived rule:ACCEPT ... 10.10.10.11 ... dport 22 ... _exp_<time>. It disappears on its own after 30 seconds.
What it means
The knock was several packets with odd flags, sent in order. SPA is one UDP packet, and its contents are encrypted and signed. On the wire, an onlooker sees a single packet of random-looking data going to the firewall, with no hint of what it asks for or whether it worked. The door opens for the sender’s address only, then closes itself.