points by LoganDark 2 days ago | 0 comments
I mean, it suffers from some of the same issues with knocks, like being replayable. Wonder if anyone's come up with a TOTP-like thing for port knocks, where the code changes every little bit...
[–] dns_snek 1 day ago
[–] ilikepi 3 hours ago
Yep, we used fwknop for several years at work, back when it was written in perl. And now we use Wireguard.
[–] LoganDark 1 day ago
LOL'd at Wireguard, but I really miss Plan 9-style networking, where you can basically just scope VPNs to a subprocess rather than having to use some system wide network filter with split tunneling or whatever. Wireguard has huge usability issues due to that.
Reading the fwknop README is such a breath of fresh air, thank you for that treat. I hate AI-generated documentation so much.
[–] SV_BubbleTime 2 days ago
That’s cute. Have Claude do it. There is already an echo system of TOPT QR to communicate it, so you would just need to convert your six digit code to two or more hits on the 16bit port range.
I’m not even sure you need more than two. One seems bad because that’s just a lucky port scanner one time.
I jest, but you're describing authentication protocol which uses the UDP destination port field to carry each character of the "one time password" in a roundabout way. You could simply send 1 packet containing the password to the daemon.
I've never seen it used in the wild but apparently, it exists: https://github.com/mrash/fwknop