Hi It looks great but what about NAT? I think that it's probably useless for clients behind the NAT becouse it's very likely that source port will be changed by NAT. Any idea?
MK ----- Original Message ----- From: "Alexey E. Suslikov" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, April 27, 2004 12:29 PM Subject: low-cost pf port-knocking idea Dear [EMAIL PROTECTED], $ext - stands for server listening interface, ($ext) - stands for server listening interface's address. server side: pass in quick on $ext inet proto udp \ from any port 333 to ($ext) port 333 keep state \ tag knock333 pass in quick on $ext inet proto udp \ from any port 444 to ($ext) port 444 keep state tagexist knock333 \ tag knock444 pass in quick on $ext inet proto udp \ from any port 555 to ($ext) port 555 keep state tagexist knock444 \ tag knock555 pass in quick on $ext inet proto tcp \ from any to ($ext) port 22 flags S/SA keep state tagexist knock555 client side: # perl -e 'print split /\./, rand()' | nc -u -p 333 ($ext) 333 # perl -e 'print split /\./, rand()' | nc -u -p 444 ($ext) 444 # perl -e 'print split /\./, rand()' | nc -u -p 555 ($ext) 555 # ssh user@($ext) constructive criticism are welcomed. Truly yours Alexey E. Suslikov
