--------------------------------------
KnockKnock - Port Knocking for Windows
--------------------------------------

1. Overview

A Windows implementation of port knocking developed to work alongside an existing firewall (CHX-I Packet Filter v3.0)


2. Files 

KnockKnock.zip - archive containing all files
|- Shortcut to KnockKnock - Shortcut to knock client
|
|- Shortcut to KnockMonitor - Shortcut to knock server
|
|- KnockLoggerFilter.gif - screenshot of the settings for the Knock Logger filter
|
|- CHX_Filters.sfd - example set of filters for CHX (what I use)
|
|- readme.txt - this file
|
|- Project Files\KnockKnock - Visual C++ 6 project files and source code for the client (KnockKnock.exe)
|
|- Project Files\KnockMonitor - NetBeans project files and source code for the server (KnockMonitor.jar)
|
|- images - folder for 'About' box image


3. Getting Started

a) Install Java from Sun (just the runtime environment if you don't want to develop)

b) Get the Packet Filter.  
Download and install "CHX Packet Filter 3.0" from http://www.idrci.net/

c) Set up CHX filters.
I've included an export of my filters in this package (CHX_Filters.sfd) which you can import in the management console by right clicking on "Packet Filters (Global)" and selecting "Import filters from file".  Or you might like to read the documentation on irdci.net - they should have some example sets of filters also.

d) Set up the log file location in CHX.
In the management console expand 'Logs' and right-click on 'Packet Filter Logs' and select 'Properties'. In the dialog box that appears, set the location of the file to where you want it ("C:\WINDOWS\ChxMpf.log" is fine).

e) Set up the 'Knock Logger' filter in CHX
Set up a filter to log TCP connection attempts in the knock range (arbitrarily set to 9000-10000 in my example filter).  In CHX-I right-click 'Packet Filters(Global)' and select New->New Filter.  Set up as in the screenshot "KnockLoggerFilter.gif".  Note: if you've imported the filter from CHX_Filters.sfd, just look at the properties to make sure they're ok on your machine.

f) Configure your router/Windows
I had to put my computer in my router's DMZ in order that it was publicly visible on the Internet - I also disabled the windows firewall (as this blocks stuff before it gets to CHX-I)

g) Start KnockMonitor
Use the shortcut or...
open a command window and go to C:\KnockMonitor\dist the format of the command is:

java -jar KnockMonitor.java

Go to Tools->Options and set up your knock sequence and the locations of the CHX log file and ChxPfCon.exe (which is found in the directory you installed CHX to).

h) Start KnockKnock (preferably on the remote machine you're connecting from)
Use the shortcut, or run KnockKnock.exe in KnockKnock\Release
Set up the knock sequence and send that sucker!

- you should see the knock sequence being received by KnockMonitor and a command executed which sets up a filter in CHX-I (in the 'Volatile' section in the Management Console) which has been set to the IP address of the computer that sent the knock sequence with the port specified in the client.  You should then of course be able to connect to that port from the client computer (for testing I use two machines on my LAN with the client sending the knock sequence to the ip of my router).

4. Dev Environment

MS Visual C++ 6.0
NetBeans IDE 5.5 beta2 / javac 1.5.0_06

5. Runtime Environment

java 1.5.0_06


Notes:

Possible known bug: CHX seems to ignore the port parameter when calling ChxPfCon.exe (as far as it looks in the Management Console anyway), if anyone can verify this please let me know.

Thanks for trying KnockKnock,
Please send comments and/or questions to phil@philreeve.com
http://knockknock.sourceforge.net