That's not a knock, it's a password :-)
I mean, it suffers from some of the same issues with knocks, like being replayable. Wonder if anyone's come up with a TOTP-like thing for port knocks, where the code changes every little bit...
Yes something like that has been done, the solution uses asymmetric cryptography instead of symmetric and it protects the entire communication stream instead of just opening the gates - it's called Wireguard.
I jest, but you're describing authentication protocol which uses the UDP destination port field to carry each character of the "one time password" in a roundabout way. You could simply send 1 packet containing the password to the daemon.
I've never seen it used in the wild but apparently, it exists: https://github.com/mrash/fwknop
LOL'd at Wireguard, but I really miss Plan 9-style networking, where you can basically just scope VPNs to a subprocess rather than having to use some system wide network filter with split tunneling or whatever. Wireguard has huge usability issues due to that.
Reading the fwknop README is such a breath of fresh air, thank you for that treat. I hate AI-generated documentation so much.
That’s cute. Have Claude do it. There is already an echo system of TOPT QR to communicate it, so you would just need to convert your six digit code to two or more hits on the 16bit port range.
I’m not even sure you need more than two. One seems bad because that’s just a lucky port scanner one time.