mrash/fwknop

Health v2 · maintenance only

Adoption not part of the score

1442 stars · 254 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

fwknop implements Single Packet Authorization (SPA), a next-generation port knocking scheme that conceals services behind a default-drop firewall. A single encrypted, HMAC-authenticated packet grants temporary firewall access to protected services like SSH.

Use cases

• hide ssh behind a firewall with single packet authorization
• protect sshd from nmap scans and 0-day exploits
• replace port knocking with replay-resistant spa
• open firewall ports temporarily for remote access
• conceal services on linux bsd or macos firewalls
• add zero-trust access layer to self-hosted servers

When to choose

• you need to hide services like SSH from port scanners and exploit attempts
• you want replay-resistant, HMAC-authenticated port knocking
• you run iptables, firewalld, PF, or ipfw and want default-drop concealment

When to avoid

• you need a full VPN or interactive network-layer access rather than per-service firewall openings
• you cannot tolerate an extra authentication step before connecting
• your firewall is not among the supported backends and custom scripting is not an option

Facets

application · maturity maintenance

auth security networking security networking self-hosted bsd windows cross-platform cli single-packet-authorization port-knocking firewall hmac zero-trust ssh-protection libpcap linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mrash/fwknop")