What Is Port Knocking? How It Works and Its Security Role

A firewall trick that only opens a port after it's knocked on in exactly the right order.

What is port knocking?

Leaving a remote-access port like SSH open to the internet at all times makes it an easy target for automated port scans and brute-force attacks. Port knocking keeps that port completely closed by default — invisible to any scan — and only has the firewall open it once a specific sequence of connection attempts ('knocks') to a set of ports arrives in the right order.

How it works: a specific sequence of attempts

A client might attempt short connections to, say, ports 7000, 8000, then 9000 in that exact order; a knock daemon on the server watches the firewall logs for that pattern and, once it matches, temporarily opens the real target port (e.g. SSH's 22) for just that client's IP.

Benefit: invisible to port scans

A normal firewall's 'this port is closed' response still reveals that a server is alive and listening; a port-knocking server gives an attacker who doesn't know the sequence no way to tell that any port could ever be opened at all, which removes it from most automated scanners' target lists.

Limitation: security through obscurity

Port knocking isn't strong cryptographic authentication — it relies on secrecy of the sequence itself, which can be defeated if the knock is intercepted on an unencrypted network and replayed, or in theory brute-forced across the full range of ports and orderings. It's best understood as a supplementary layer added in front of real authentication like SSH keys or strong passwords, not a replacement for them.

A more advanced approach: SPA (Single Packet Authorization)

Instead of a sequence of multiple connection attempts, SPA sends a single encrypted packet containing authorization data — the server decrypts and validates it before opening the port. Because the packet's contents differ every time, unlike classic port knocking it isn't vulnerable to a captured packet simply being replayed. fwknop is a well-known open-source SPA implementation.

Real-world use cases

Mainly adopted selectively by administrators of personal servers or small infrastructure who want an extra layer of concealment on SSH or admin ports exposed to the internet. It's impractical for always-on public services like a web server, and the more complex the setup, the more inconvenient it can become even for the admin's own remote access — a tradeoff worth weighing before adopting it.

For background on port scanning itself

Understanding how attackers discover open ports in the first place — the port scanning process and how it's used for both attacks and legitimate security checks — provides useful context for why port knocking exists.

Firewall basics, for the layer underneath

Port knocking is a supplement to a firewall, not a replacement — a primer on firewall fundamentals covers the underlying mechanism it's built on top of.

Frequently Asked Questions

Does port knocking alone make a server fully secure?

No. It's a supplementary measure that reduces how attractive a server looks as a target by hiding its ports — it can't replace fundamental authentication like SSH key auth or a strong password. The two are meant to be used together.

Can a typical home router do port knocking?

Most consumer routers don't include port knocking as a built-in feature. It's mostly configured on Linux-based servers or open-source firewall software using a separate knock daemon.