Dear Sirs,
a curious thing is happening to me. I'm using Proxmox 4, and for security reasons I always used knockd in every my debian server. Also in ProxMox 3, where it worked fine.
In ProxMox4 it doesn't work anymore.
If I test it from the same subnet works fine. From any other network it doesn't. But if I inspect my packets coming on the network card where knockd daemon is listening with tcpdump, it works normally! I'm starting to became crazy. The Proxmox firewall was not used for the moment, while i'm in testing.
This is my network interfaces in Proxmox
Knockd was installed with apt-get and this is /etc/default/knockd
and his /etc/knockd.conf
This is one packet captured with tcpdump ( tcpdump -i vmbr1 dst xxx.11.2.1 -vvv ):
For knoking, on the client side. I use indifferently the knock client found in package (/usr/bin/knock) or a simple nmap script:
a curious thing is happening to me. I'm using Proxmox 4, and for security reasons I always used knockd in every my debian server. Also in ProxMox 3, where it worked fine.
In ProxMox4 it doesn't work anymore.
If I test it from the same subnet works fine. From any other network it doesn't. But if I inspect my packets coming on the network card where knockd daemon is listening with tcpdump, it works normally! I'm starting to became crazy. The Proxmox firewall was not used for the moment, while i'm in testing.
This is my network interfaces in Proxmox
Code:
auto lo
iface lo inet loopback
auto vmbr0
iface vmbr0 inet static
address 192.168.1.10
netmask 255.255.255.0
gateway 192.168.1.254
bridge_ports eth0
bridge_stp off
bridge_fd 0
auto vmbr1
iface vmbr1 inet static
address xxx.11.2.1
netmask 255.255.255.248
bridge_ports eth1
bridge_stp off
bridge_fd 0
auto vmbr2
iface vmbr2 inet static
address 192.168.0.254
netmask 255.255.255.0
bridge_ports eth2
bridge_stp off
bridge_fd 0
post-up iptables -t nat -A POSTROUTING -o vmbr0 -j MASQUERADE
post-up iptables -A FORWARD -i vmbr0 -o vmbr2 -m state --state RELATED,ESTABLISHED -j ACCEPT
post-up iptables -A FORWARD -i vmbr2 -o vmbr0 -j ACCEPTKnockd was installed with apt-get and this is /etc/default/knockd
Code:
################################################
#
# knockd's default file, for generic sys config
#
################################################
# control if we start knockd at init or not
# 1 = start
# anything else = don't start
#
# PLEASE EDIT /etc/knockd.conf BEFORE ENABLING
START_KNOCKD=1
# command line options
KNOCKD_OPTS="-i vmbr1"and his /etc/knockd.conf
Code:
[options]
logfile = /var/log/knockd.log
[open]
sequence = 7000,8000,9000
seq_timeout = 5
tcpflags = syn
command = sh /etc/open_p %IP%
[close]
sequence = 6000,6005,6010
seq_timeout = 5
tcpflags = syn
command = sh /etc/close_pThis is one packet captured with tcpdump ( tcpdump -i vmbr1 dst xxx.11.2.1 -vvv ):
Code:
13:55:40.122368 IP (tos 0x0, ttl 53, id 17708, offset 0, flags [none], proto TCP (6), length 44)
host5-2-static.11-xxx-b.xxx.xxx.xx.37494 > host1-2-static.11-xxx-b.xxx.xxx.xx.4001: Flags [S], cksum 0x2397 (correct), seq 1758914948, win 1024, options [mss 1460], length 0For knoking, on the client side. I use indifferently the knock client found in package (/usr/bin/knock) or a simple nmap script:
Code:
#!/bin/bash
HOST=$1
echo "Elenco degli argomenti con \"\$@\":"
shift
for ARG in "$@"
do
nmap -Pn --host_timeout 100 --max-retries 0 -p $ARG $HOST
sleep 1
done
Last edited:
