1

I have been having some trouble with port knocking my VNC, as when I nmap my rpi, the vnc ports are still open, here is my config file (excuse the lame sequence, I haven't fully set it up yet) :

[options]
    UseSyslog

[SSH]
    sequence    = 6000,7000,8000
    seq_timeout = 5
    command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 3197 -j 
    ACCEPT
    tcpflags    = syn
    cmd_timeout = 10
    stop_command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 3197 -j 
    ACCEPT

[openVNC1]
    sequence    = 8000,6000,4000
    seq_timeout = 5
    command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 3197 -j 
    ACCEPT
    tcpflags    = syn,ack

[closeVNC1]
    sequence    = 4000,6000,8000
    seq_timeout = 5
    command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 3197 -j 
    ACCEPT
    tcpflags    = syn,ack

 [openVNC2]
    sequence    = 3000,5000,7000
    seq_timeout = 5
    command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 3197 -j 
    ACCEPT
    tcpflags    = syn,ack

[closeVNC2]
    sequence    = 7000,5000,3000
    seq_timeout = 5
    command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 3197 -j 
ACCEPT
    tcpflags    = syn,ack

It still appears as open, and I can assess it too. This is strange, as it worked for my ssh. Any suggestions?

0

Solution 1

I got it to work, iptables was not being executed, nor was knockd as a service, unless you ran the knockd command. I fixed this by using a start file, and ufw.

I discovered that the iptables directory was not a thing, and it wan't being executed, so I was thinking about similar applications which allow you to do basically the same. So I thought, ufw.

I edited /etc/knockd.conf, and restarted it. This is what I was done:

[options]
    logfile = /var/log/knockd.log
    interface = wlan0
[SSH]
    sequence    = 0001:tcp,0021:udp,1011:udp
    tcpflags = syn
    seq_timeout = 15
    start_command = ufw allow 3197
    cmd_timeout = 10
    stop_command = ufw deny 3197

[VNC1]
    sequence    = 3002:udp,5000:udp,2892:tcp
    tcpflags = syn
    seq_timeout = 15
    start_command = ufw allow 5900
    cmd_timeout = 25
    stop_command = ufw deny 5900

[VNC2]
    sequence    = 3003:udp,9083:tcp,8909:udp
    tcpflags = syn
    seq_timeout = 15
    start_command = ufw allow 5901
    cmd_timeout = 25
    stop_command = ufw deny 5901

I made a file in /etc/init.d/ , and named it startup.sh, I followed this guide: https://www.cyberciti.biz/tips/linux-how-to-run-a-command-when-boots-up.html

This is what I wrote: https://imgur.com/a/rgHP3

Basically, it resets the firewall on startup, and then sets the allowed ports for my pi, and puts it in the background, just like a service.

After this, reboot your pi, and it should all work! This is a nice workaround and overall efficiency.

Solution 2

Well. a friend found out this link, just do it from here instead: https://www.howtoforge.com/tutorial/how-to-use-port-knocking-to-hide-the-ssh-port-from-attackers-on-ubuntu

Have fun not being paranoid!


Posted by the OP as an edit to the question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.