Port Knocking on MikroTik: Hiding SSH and Winbox

Port Knocking on MikroTik

Port knocking is a method of opening ports on a firewall by sending a sequence of connection attempts to pre-defined closed ports. Until the correct knock sequence is sent, management ports appear completely closed — even to scanners.

How Port Knocking Works

1. Your management port (e.g., SSH on 22) is blocked by default.
2. You "knock" on a sequence of ports — e.g., 1111, 2222, 3333.
3. The firewall tracks the sequence. If all three are knocked in order within a time window, your IP is added to an "allowed" list.
4. SSH is then open to your IP for a limited time.

Implementing Port Knocking in RouterOS

We use address lists and firewall rules to track the knock sequence:

/ip firewall filter

# Rule 1: Accept SSH for IPs that completed the sequence
add chain=input protocol=tcp dst-port=22 src-address-list=knock_allowed action=accept comment="SSH open for knockers"

# Rule 2: Stage 3 knock — final knock adds to allowed list
add chain=input protocol=tcp dst-port=3333 src-address-list=knock_stage2 action=add-src-to-address-list address-list=knock_allowed address-list-timeout=30m comment="Knock stage 3 → allowed"

# Rule 3: Stage 2 knock
add chain=input protocol=tcp dst-port=2222 src-address-list=knock_stage1 action=add-src-to-address-list address-list=knock_stage2 address-list-timeout=15s comment="Knock stage 2"

# Rule 4: Stage 1 knock — first knock
add chain=input protocol=tcp dst-port=1111 connection-state=new action=add-src-to-address-list address-list=knock_stage1 address-list-timeout=15s comment="Knock stage 1"

# Rule 5: Drop SSH from everyone else
add chain=input protocol=tcp dst-port=22 action=drop comment="Default drop SSH"

• address-list-timeout=15s — the user must complete the sequence within 15 seconds
• address-list-timeout=30m — SSH access is granted for 30 minutes

Sending the Knock Sequence

knock 203.0.113.1 1111 2222 3333

(requires knockd client: apt install knockd)

Or using nmap:

nmap -Pn --host-timeout 100 --max-retries 0 -p 1111 203.0.113.1
nmap -Pn --host-timeout 100 --max-retries 0 -p 2222 203.0.113.1
nmap -Pn --host-timeout 100 --max-retries 0 -p 3333 203.0.113.1

$ip = "203.0.113.1"
foreach ($port in 1111,2222,3333) {
    try { [System.Net.Sockets.TcpClient]::new($ip, $port) } catch {}
    Start-Sleep -Milliseconds 200
}

Verify It Works

After knocking, check if your IP is in the allowed list:

/ip firewall address-list print where list=knock_allowed

Then try SSHing in — it should work. After the 30-minute timeout, the entry disappears and SSH closes again.

Important Notes

• Port knocking is security through obscurity — it delays attackers but does not replace strong passwords or key-based SSH auth.
• Combine it with SSH key authentication for maximum security.
• Choose non-obvious port numbers (not 1111, 2222 — use random high ports in production).

Combining with SSH Key Auth

/ip ssh set strong-crypto=yes

Upload your public key to the router:

/user ssh-keys import public-key-file=id_rsa.pub user=netadmin

Now even if someone discovers the knock sequence, they still need the private key.