Another really good option is single packet authorization. Which, again, a little more complex than port knocking but also another step up in security.

https://www.cipherdyne.org/fwknop/docs/SPA.html