fwknop

fwknop implements Single Packet Authorization (SPA), a way to conceal network services so that they are invisible until an authorized client asks for access. A single encrypted, non-replayable packet authenticated with an HMAC tells the server to open a firewall rule for that client. Services such as SSH stay behind a default-drop firewall, which makes exploitation of both unknown and unpatched vulnerabilities harder and means the services cannot be found by port scanners such as Nmap.

The README presents SPA as the next generation of port knocking. Port knocking struggles with replay attacks, cannot easily use asymmetric ciphers or HMACs, and can be disrupted by spoofed packets, while SPA addresses these problems and still keeps the default-drop policy. The server acquires SPA data passively, usually through libpcap, and uses standard cryptographic operations to authenticate and decrypt packets.

The project supports four firewalls, iptables, firewalld, PF and ipfw, across Linux, OpenBSD, FreeBSD and macOS, and custom scripts allow other infrastructure such as ipset or nftables. It is released under GPL-2.0 and runs entirely on your own systems, so it suits administrators who want a zero-trust layer in front of remote-access services.