Last active
April 7, 2024 03:03
-
-
Save daniel-corbett/ec7059cbfccf12c8f41d060ac25403a5 to your computer and use it in GitHub Desktop.
HAProxy Port Knocking
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Listens on 6000-9000 for a sequence of port knocks. | |
| # Requires an explicit order of port access before opening | |
| # Current defined order is 6001,7001,8001,9000 | |
| # If another port is accessed during the sequence it must be started from the beginning | |
| listen portknock | |
| mode tcp | |
| bind *:6000-9000 | |
| stick-table type ip size 1m expire 24h store conn_cnt,gpt0 | |
| tcp-request connection track-sc0 src | |
| tcp-request connection sc-set-gpt0(0) 1 if { dst_port 6001 } { sc_get_gpt0(0) -m int lt 4 } | |
| tcp-request connection sc-set-gpt0(0) 2 if { dst_port 7001 } { sc_get_gpt0(0) -m int eq 1 } | |
| tcp-request connection sc-set-gpt0(0) 3 if { dst_port 8001 } { sc_get_gpt0(0) -m int eq 2 } | |
| tcp-request connection sc-set-gpt0(0) 4 if { dst_port 9000 } { sc_get_gpt0(0) -m int eq 3 } | |
| tcp-request connection sc-set-gpt0(0) 0 unless { dst_port 6001 7001 8001 9000 } | |
| tcp-request connection silent-drop unless { sc_get_gpt0(0) 4 } | |
| server ssh 127.0.0.1:22 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment