# mrash/fwknop

Single Packet Authorization > Port Knocking

Repository: https://github.com/mrash/fwknop
Canonical: https://ross.abutalabs.com/products/fwknop
Homepage: http://www.cipherdyne.org/fwknop/
Language: Perl
License: GPL-2.0
License Family: copyleft
Topics: port-knocker, authentication, authorization, spa, zero-trust, firewall, hmac
Last push: 2026-06-01T21:08:30+00:00

## Health v2 (maintenance only)
Score: 61/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 85, release rhythm 8, longevity 100
- inputs: {"age_days": 5560, "days_push": 93, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1442, forks 254 (observed 2026-08-28T04:04:44.761093+00:00)

## What it is
fwknop implements Single Packet Authorization (SPA), a next-generation port knocking scheme that conceals services behind a default-drop firewall. A single encrypted, HMAC-authenticated packet grants temporary firewall access to protected services like SSH.

## Use cases
- hide ssh behind a firewall with single packet authorization
- protect sshd from nmap scans and 0-day exploits
- replace port knocking with replay-resistant spa
- open firewall ports temporarily for remote access
- conceal services on linux bsd or macos firewalls
- add zero-trust access layer to self-hosted servers

## When to choose
- you need to hide services like SSH from port scanners and exploit attempts
- you want replay-resistant, HMAC-authenticated port knocking
- you run iptables, firewalld, PF, or ipfw and want default-drop concealment

## When to avoid
- you need a full VPN or interactive network-layer access rather than per-service firewall openings
- you cannot tolerate an extra authentication step before connecting
- your firewall is not among the supported backends and custom scripting is not an option

## Facets
- artifact type: application
- maturity: maintenance
- function: auth, security, networking
- domain: security, networking, self-hosted
- platform: bsd, windows, cross-platform, cli
- tags: single-packet-authorization, port-knocking, firewall, hmac, zero-trust, ssh-protection, libpcap, linux, macos

## Member repositories
- mrash/fwknop (main) score 61

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:44.761093+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:36:24.794472+00:00, confidence not recorded.
  - readme: https://github.com/mrash/fwknop (fetched 2026-08-28T04:04:44.761093+00:00, sha fc59daf9868e)
  - homepage: http://www.cipherdyne.org/fwknop/ (fetched 2026-08-29T11:46:39.812559+00:00, sha 0930dbf8ff3c)
  - site_page: http://www.cipherdyne.org/about.html (fetched 2026-08-29T11:46:39.833316+00:00, sha 4f156a68fbfe)
  - site_page: http://www.cipherdyne.org/fwknop/docs/SPA.html (fetched 2026-08-29T11:46:39.835457+00:00, sha 215f0bd7b30d)
  - site_page: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html (fetched 2026-08-29T11:46:39.838000+00:00, sha 4c19b72f8608)
  - site_page: http://www.cipherdyne.org/fwknop/docs (fetched 2026-08-29T11:46:39.843626+00:00, sha c000a8b0c58b)
  - site_page: http://www.cipherdyne.org/fwknop/docs/features.html (fetched 2026-08-29T11:46:39.845361+00:00, sha 9e90e472902b)
  - site_page: http://www.cipherdyne.org/blog/categories/software-releases.html (fetched 2026-08-29T11:46:39.847168+00:00, sha 4d86c00b66a9)
- Data as of 2026-08-30T08:39:29.467469+00:00.