Hacker News Reader

Comment by mlyle | Hacker News Reader

> The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect.

You can type http://hostname:porttoknock in a browser.

As long as you're not behind a super restrictive gateway that doesn't let you connect to arbitrary ports, you're golden.

View on HN

I've actually been behind a firewall that blocked outgoing connections except on several well-known ports. Had to run my SSH server over the port usually used for HTTPS just to get it unblocked.

Some versions of port knocking require a specific type of packet.

https://github.com/moxie0/knockknock

Likely won't be enough if you're behind CGNAT and you get a different public IP on different connections.

Most decent CGNAT will give you the same source IP when you connect to the same dest IP repeatedly.

It seems like there’d be a pretty big overlap between those kinds of hosts.

I'm a bit of a noob about this. Can you explain what this means?

Port knocking involves sending a packet to certain ports on a host. It's overkill but typing http://host:port/ in your browser will, as part of trying to make a TCP connection, send a packet to that port.

Thanks, I didn't realize port knocking could be done manually like this as a way to "unlock" an eventual regular ssh attempt outside the browser. This makes sense now and is super clever!

TIL another interesting browser feature. Thank you.

That's just the usual way of attempting to connect to an HTTP server running on a different port. Sometimes you see websites hosted on port 8080 or something like that.

Oh. Duh.

I suppose I should have said it was a new-to-me use case for that feature.

Reply on news.ycombinator.com