Skip to main content

IPFilter

The Knocknoc Agent integrates with IPFilter to dynamically control network access on the host it runs on. When a user authenticates, their IP address is allowed through IPFilter, and blocked again when their access ends.

A granted user can reach every port on the host through the knoc's interface. To protect a single service, write your default-deny for that service only (see Step 3).

Requirements

  • The Knocknoc agent installed and running on the IPFilter host.
  • IPFilter installed and enabled.

Setup

Step 1: Install the Agent

Deploy the Knocknoc agent on the host running IPFilter. It connects out to the Knocknoc server and needs no inbound port.

Step 2: Enable IPFilter

Confirm IPFilter is running:

ipf -V

The output includes Running: yes when it is active. If it is not, enable it as your operating system's documentation describes.

Step 3: Write Your Default-Deny

Knocknoc's rules use quick, and are added after the rules in your ipf.conf. Write your block rules without quick so that a granted user's rule can override them. For example, to protect SSH:

block in on lan0 proto tcp from any to any port = 22

Or, to block all inbound traffic except granted users:

block in on lan0 all

A block in quick rule that matches a user's traffic is applied before Knocknoc's rule, and the user stays blocked. Make sure the host can still reach the Knocknoc server.

Step 4: Create the Knoc

  1. Go to Knocs, choose New, then pick Host firewall under On host.

  2. Select the agent on the IPFilter host.

  3. Set Backend Type to IPFilter Firewall.

  4. Configure the rule:

    Field Description
    Interface The interface the rule applies to, such as lan0. Leave empty for all interfaces.
    Direction Inbound (default) for traffic arriving from the user.

  5. Assign users and/or groups, then save.

Use a different interface or direction for each IPFilter knoc on the same host.

Step 5: Test

  1. Log in as a test user.

  2. On the host, confirm a rule for the user's IP is loaded:

    ipfstat -io

  3. Verify access to the protected service.

  4. Log out, and confirm the rule is removed.