port knocking to close ports

[crequill]

Hi,

Thanks to have added port knocking to open ssh port. Can you add the same thing to close the ssh port when connexion is closed?

Best regards.

[isontheline]

Hi @crequill 👋

You should NOT rely on an external process to close your port.

Close it as soon as possible like this example : https://webssh.net/documentation/help/networking/port-knocking/

cmd_timeout   = 10
stop_command  = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT

This will not stop the established connections but only close port for new attempts

[crequill]

Thanks but I know it.
But to launch iptables to close the port, you need to launch a new sequence. So it will be nice to configure it in webssh.

[isontheline]

Please share your knockd configuration (without the right sequences of course)

[crequill]

There is an example on man page of knockd:

[options]
logfile = /var/log/knockd.log
[openSSH]
sequence = 7000,8000,9000
seq_timeout = 10
tcpflags = syn
command = /usr/sbin/iptables -A INPUT -s %IP% -j ACCEPT
[closeSSH]
sequence = 9000,8000,7000
seq_timeout = 10
tcpflags = syn
command = /usr/sbin/iptables -D INPUT -s %IP% -j ACCEPT

[isontheline]

Please add cmd_timeout and stop_command and you will be fine with « auto close »

if I implement a stop port sequence inside WebSSH sometimes it won’t be fired (network issue, software issue) and your port will be open forever

[crequill]

Thanks