How To Knock Into Your Network (DD-WRT)

Enhancing Router Security with Knock daemon on DD-WRT

Many users desire a heightened level of security for their home networks. A unique method involves establishing a specific "knock" sequence with your router, allowing access only upon recognition of this pre-defined pattern.

How-To Geek provides a detailed guide on implementing the Knock daemon on routers running DD-WRT firmware.

Image credit: Bfick and Aviad Raviv.

Prerequisites: Familiarizing Yourself with DD-WRT

Before proceeding, it's recommended to review earlier articles in this series to ensure a solid understanding of the foundational concepts.

Transforming Your Router: Learn how to convert your home router into a more capable device with DD-WRT.
Software Installation: Discover the process of installing additional software packages on your DD-WRT router.
Ad Blocking: Explore how to eliminate advertisements using Pixelserv on DD-WRT.

This particular guide delves into more advanced techniques. Users new to router modification should exercise caution and proceed with careful consideration.

Remember that a thorough understanding of the preceding topics will greatly assist in successfully implementing this security enhancement.

Introduction

Historically, establishing communication with a device or service necessitated a complete network connection. This approach, however, inherently introduces an attack surface, a potential entry point for malicious actors. The Knock daemon offers a different solution. It functions as a network listener, responding only when a specific, pre-defined sequence of packets is detected.

Because a full connection isn't required for the Knock daemon to identify the configured sequence, the potential for security breaches is minimized, all while preserving the intended functionality. Essentially, the router is prepared to respond to a specific "signal" – a concept notably different from the unfortunate situation faced by Roger.

Demonstrations

This article will demonstrate practical applications of Knockd. We will explore how to utilize it to remotely wake a computer on your local network using Wake-on-Lan (WoL). Furthermore, we will illustrate how to initiate the Knock sequence from both an Android application and a desktop computer.

Wake-on-Lan with Knockd

Knockd can be configured to trigger a Wake-on-Lan packet when the correct sequence is received. This allows for remote power-on of machines without exposing them directly to the internet.

Triggering the Knock Sequence

The Knock sequence itself can be initiated from various platforms. This provides flexibility in how you remotely interact with your network.

Android Application: A dedicated Android app can be used to send the required packet sequence.
Computer: Command-line tools or custom scripts can be employed to generate and transmit the Knock sequence from a computer.

Please note that while the original installation guides may be outdated, a video series documenting the complete configuration process is available. Although the presentation quality is somewhat dated, it provides a comprehensive overview of setting up Knockd.

Security Considerations

The question of Knockd's security has been debated extensively online for a considerable period. However, the fundamental conclusion remains consistent.

Knockd functions as a security measure based on obscurity. It should be implemented to supplement existing security protocols, such as encryption, rather than relied upon as a standalone solution.

Understanding the Limitations

Employing Knockd as the sole defense mechanism is insufficient. Its effectiveness is diminished when not combined with robust, established security practices.

The principle of security through obscurity is generally discouraged as a primary security strategy. It offers a limited degree of protection and can be easily circumvented.

Best Practices

Encryption: Always prioritize strong encryption methods for data transmission and storage.
Firewall: Utilize a properly configured firewall to control network access.
Regular Updates: Keep all software, including Knockd, updated to the latest versions to patch vulnerabilities.
Layered Security: Implement a multi-layered security approach, combining various techniques for comprehensive protection.

Knockd can be a useful addition to a well-rounded security posture, but it should never be considered a replacement for fundamental security principles.

Relying solely on obscurity for security is a risky proposition. A comprehensive approach is vital for protecting your systems.

Essential Requirements, Underlying Principles & Guidance

This guide operates on the understanding that your router is running DD-WRT with Opkg functionality enabled.

Be prepared to dedicate some time to the configuration process, as completion may require a considerable duration.

Obtaining a DDNS account is strongly advised to track your external IP address, which is often subject to change.

Initial Conditions and Helpful Suggestions

A DD-WRT router with Opkg support is a fundamental prerequisite.
A degree of patience is necessary, as the setup procedure can be time-consuming.
Securing a Dynamic DNS (DDNS) account for your public, potentially fluctuating IP address is highly recommended.

Understanding the Core Components

The successful implementation of this process relies on three key elements: a compatible router, sufficient time for configuration, and a reliable method for resolving your dynamic IP address.

Without these foundational aspects, achieving the desired outcome may prove challenging.

Why These Considerations Matter

Opkg provides the package management system needed for installation. Time is a factor due to the multiple steps involved.

A DDNS service ensures consistent access to your network, even when your ISP assigns a new IP address.

Prior to proceeding, ensure all three conditions are met to streamline the setup and minimize potential issues.

Initiating Knockd: Installation and Initial Setup

The installation process for the Knock daemon begins by accessing the router's terminal. From there, execute the following command:

opkg update ; opkg install knockd

With Knockd successfully installed, the next step involves configuring the sequences that will initiate actions and the corresponding commands to be executed upon activation.

Configuration is managed through the "knockd.conf" file, which can be opened using a text editor on the router. Typically, this is done with:

vi /opt/etc/knockd.conf

The file's content should be structured as follows:

[options]logfile = /var/log/knockd.logUseSyslog

[wakelaptop]sequence = 56,56,56,43,43,43,1443,1443,1443seq_timeout = 30command = /usr/sbin/wol aa:bb:cc:dd:ee:22 -i $( nvram get lan_ipaddr | cut -d . -f 1,2,3 ).255tcpflags = sync

Understanding the Configuration Elements

Let's break down the components of this configuration.

The "options" section defines global settings for the daemon. Here, logging is enabled for both syslog and a dedicated file. Employing both logging methods simultaneously is permissible, but consider utilizing only one for simplicity.
The "wakelaptop" section exemplifies a sequence designed to trigger a Wake-on-LAN (WOL) command for a device on the LAN, identified by the MAC address aa:bb:cc:dd:ee:22. It's important to note that the provided command assumes a standard Class C subnet configuration.

Expanding functionality is straightforward. Duplicate the "wakelaptop" segment and modify the parameters and commands to accommodate additional sequences and desired actions.

This allows for a highly customizable system for remotely triggering actions on your network.

Startup Configuration

For the router to automatically launch the daemon during the boot process, the following line should be added to the "geek-init" script, as detailed in the OPKG guide.

knockd -d -c /opt/etc/knockd.conf -i "$( nvram get wan_ifname )"

This command initiates the Knock daemon, configuring it to monitor the router's "WAN" interface for incoming packets originating from the internet.

By implementing this, the Knock daemon will be active immediately upon router startup, ensuring continuous listening for knock sequences.

Interface Specification

The inclusion of -i "$( nvram get wan_ifname )" is crucial.

It dynamically determines the name of the WAN interface using the nvram get wan_ifname command, ensuring compatibility across different router configurations.

This approach avoids hardcoding the interface name, making the configuration more robust and adaptable.

Knock from Android

In today’s mobile-centric world, having a dedicated application for specific tasks is often essential. StavFX recognized this need and developed an app to facilitate knocking sequences directly from an Android device.

This application enables the execution of knocking sequences from your Android smartphone or tablet, and also provides the functionality to create home screen widgets for quick access.

Install the Knocker application from the Android marketplace, and consider leaving a positive rating if you find it useful.
After installation, launch the application. You will be presented with an initial screen.
A long press on the example icon allows for editing, or you can select "menu" to add a new knocking profile. A new entry will appear as follows:
Add the necessary lines and input the required information for your desired Knocking sequence. For a Wake-on-LAN (WOL) configuration, for instance:
You can customize the icon associated with each Knock by long-pressing the icon next to the Knock name.
Save the newly configured Knock.
Activate the Knock by simply tapping it on the main screen.
For even faster access, create a widget for the Knock on your home screen.

While the example configuration file utilizes groups of three for each port, due to the Telnet section, this application doesn’t impose any limitations on the number of repetitions for a given port.

Enjoy utilizing the application generously provided by StavFX!

Knock from Windows/Linux

Although performing knocking sequences is achievable with basic network utilities like Telnet, Microsoft has deemed Telnet a potential security vulnerability and no longer includes it as a default installation on contemporary Windows systems. Some argue that sacrificing essential freedoms for temporary security is unwise, but that is a separate discussion.

The example sequence was designed with groups of three for each port because Telnet automatically retries a connection up to two additional times if the initial attempt fails. Therefore, Telnet effectively knocks three times before giving up. Consequently, executing the Telnet command once for each port within a group is sufficient. A 30-second timeout interval is recommended to allow for Telnet’s timeout period for each port before proceeding to the next group. Automating this process with a simple Batch or Bash script is advisable after testing.

Using the example sequence, the commands would be:

If using Windows, follow Microsoft’s instructions to install Telnet.
Open a command line interface and execute the following commands: telnet geek.dyndns-at-home.com 56 telnet geek.dyndns-at-home.com 43 telnet geek.dyndns-at-home.com 1443

If successful, the desired action should be triggered.

Troubleshooting

If your router isn't responding to the knocking sequences, consider these troubleshooting steps:

Examine the log file – Knockd maintains a log that allows you to monitor incoming knocking sequences and verify successful command execution. To view the log in real-time, use the following command in a terminal:
```
tail -f /var/log/knockd.log
```
Account for firewalls – Your Internet Service Provider (ISP), workplace, or public Wi-Fi network might block certain types of communication. If this occurs, knocks on blocked ports will not reach your router, hindering its ability to respond. Utilizing well-known ports like 80, 443, or 3389 initially is recommended, and the log file can confirm which ports are reaching the router’s WAN interface.
Test sequences internally – Before addressing potential network complexities, test the sequences internally to ensure they reach the router as expected and execute the intended commands. To achieve this, start Knockd bound to your LAN interface using:
```
knockd -d -i "$( nvram get lan_ifnameq )" -c /opt/etc/knockd.conf
```
Then, direct the Knocking client to the router’s internal IP address instead of its external one. Consider running a Knockd instance on the LAN interface continuously, as the Knocker application now supports two hosts for knocking, simplifying your configuration.
Be aware of your network position – In the current configuration, knocking the WAN interface from the LAN interface is not possible. To enable knocking from either side, run the daemon twice: once bound to the WAN as described in the article, and once bound to the LAN as demonstrated in the debugging step. Both instances can run concurrently by appending the LAN-bound command to the same startup script.

Observations

Numerous alternative approaches could achieve the results demonstrated above, but it is our intention that this example serves as a learning tool for tackling more complex tasks.

A follow-up article detailing how to conceal a VPN service using a knock sequence is currently in development; please check back for updates.

Employing a knocking technique will grant you the capability to: open ports on demand, activate or deactivate services, initiate remote Wake-on-LAN functionality, and explore a range of other possibilities.

Key Capabilities Enabled by Knocking

The implementation of knocking protocols facilitates a dynamic level of control over your network infrastructure.

Dynamic Port Management: Ports can be opened and closed as needed, enhancing security.
Service Control: Remote activation and deactivation of network services is possible.
Remote Wake-on-LAN: Computers can be remotely powered on, streamlining access.

These features collectively contribute to a more flexible and secure network environment.

Further Exploration

The potential applications of knocking extend beyond the examples provided.

Consider its utility in scenarios requiring granular control over network access and service availability.

Topics

More