Forge Home


Knockd Module


9,573 latest version

1.5 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 0.0.4 (latest)
  • 0.0.3
  • 0.0.2
  • 0.0.1
released Mar 2nd 2015

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'xdrum-knockd', '0.0.4'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add xdrum-knockd
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install xdrum-knockd --version 0.0.4

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



xdrum/knockd — version 0.0.4 Mar 2nd 2015


This module manages knockd.

Class: knockd

A class for managing knockd server options


package name.

service name (initscript name).

log action messages through syslog().

log actions directly to a file, (defaults to: /var/log/knockd.log).

pidfile to use when in daemon mode, (defaults to: /var/run/

[interface]: network interface to listen on (mandatory).


 class { "knockd":
   interface => 'eth0',

Define: knockd::sequence

A defined type for managing knockd sequences


port sequence used in single knock mode.

port sequence used in the open knock (two knock mode).

port sequence used in the close knock (two knock mode).

file containing the one time sequences to be used. (instead of using a fixed sequence).

port sequence timeout.

only pay attention to packets that have this flag set.

command executed when a client makes a correct port knock (both modes).

command executed when cmd_timeout seconds are passed or when a close sequence was received (both modes).

time to wait between start and stop command (only required in two knock mode).


An Open/Close example that uses a single knock to control access to port 22(ssh):

 class { "knockd":
   interface => 'eth3',
 knockd::sequence {
     sequence      => '2222:udp,3333:tcp,4444:udp',
     seq_timeout   => '15',
     tcpflags      => 'syn,ack',
     start_command => '/usr/sbin/iptables -A INPUT -s %IP% -p tcp --syn --dport 22 -j ACCEPT',
     cmd_timeout   => '10',
     stop_command  => '/usr/sbin/iptables -D INPUT -s %IP% -p tcp --syn --dport 22 -j ACCEPT',

An example using two knocks: the first allow access to port 22(ssh), the second will close the port:

 class { "knockd":
   interface => 'eth0',
 knockd::sequence {
     open_sequence      => '7000,8000,9000',
     close_sequence     => '9000,8000,7000',
     seq_timeout        => '10',
     tcpflags           => 'syn',
     start_command      => '/usr/sbin/iptables -A INPUT -s %IP% -p tcp --syn --dport 22 -j ACCEPT',
     stop_command       => '/usr/sbin/iptables -D INPUT -s %IP% -p tcp --syn --dport 22 -j ACCEPT',


Copyright 2015 Alessio Cassibba (X-Drum), unless otherwise noted.