I used the program pivpn to build my vpn server on a raspberry pi 3. When the build was completed, I forwarded the correct port in my router to my raspberry pi. Now I used one of the web programs on grc.com to test my ports and found that the vpn port is open. Is there any way to protect this port and still have access to my vpn? Thank you.
1 Answer
You could use port knocking; using something like knockd (See details here https://www.vultr.com/docs/port-knocking-on-debian or here https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-to-hide-your-ssh-daemon-from-attackers-on-ubuntu). Basically what it does is that all ports appear to be closed, but if you try to access a sequence of ports in a specific order and within a certain time, knockd will detect it, and you can configure it to open a specific port when that happens.
It is also possible to enable port knocking using only iptables, if you prefer.
On your router, you will then have to forward all the ports used for port knocking to your Raspberry Pi. One thing I am not sure of is how these ports will appear to a port scanner like the one on grc.com. You could do a test beforehand. Forward a port from your router to your rpi that you know is closed on the rpi, and perform a scan using grc.com to make sure that port appears as being stealth.
answered Sep 29, 2017 at 15:08
