Secure the NAT Port Redirection connections by Port Knocking
DrayOS 5
Configuring NAT Port Redirection rules is the typical way to allow the internal servers to be accessible from the Internet. However, once the port opens, it is exposed to the Internet and can be scanned by the malware. Port knocking is a technology that can add an extra layer of protection to the internal servers. Its basic idea is that only open ports are at risk of being attacked, so it allows all ports to be closed at the beginning. Do not open them, and then set a password based on the port combination. Only those who know the password can open the ports and connect.
Vigor Router supports Port Knocking with TOTP. The supported models are:
• Vigor3912S fw 4.3.5.1
• Vigor3910/ 2962 fw 4.4.3
• Vigor2927/2865 fw 4.4.5.3
• Vigor2136/ C510/ C410 fw 5.3.2*
* Future Support
Below are the configuration steps for using the Port Knocking feature on Vigor Router.
1. Browse DrayTek Portknock Tool
2. Login to the router’s Web, and navigate to System Maintenance / Device Settings / Time. Ensure the router gets the correct system time.
3. Navigate to IAM / Users & Groups / Users, click +Add to create an IAM user profile.
• Enter Username and Password
• Select Router Management as Usage
• Select Administrator as Role
• Enable MFA and select TOTP as the MFA method
• Click Apply to proceed with the TOTP setup. A TOTP Secret window will appear - copy the TOTP secret.
• Go to the Port Knocking Tool web page, and paste the TOTP secret. A 6-digit authentication code will be generated.
• Return to the TOTP Secret window, paste the 6-digit code, and click Verify.
• Wait for the OK message to appear on the right-top corner, indicating the IAM user setup is complete.
• Log in using the new admin user account to confirm that the login with TOTP is successful.
4. Navigate to Security > Port Knocking, and click +Add to create a Port Knocking profile.
• Enter a Profile Name
• Toggle Enabled
• Configure the 1st Knock Port
• Click +Add under Allowed Users and select the users to allow
• Click Apply to save the settings
5. Navigate to Configuration / NAT / Port Forwarding, and click +Add to create a Port Forwarding profile for the local server that will be accessed from the Internet after successful Port Knocking. In this example, we use an RDP server.
• Enter a name for the profile.
• Toggle Enabled.
• Select the appropriate WAN Interface and WAN IP.
• Set Source IP to Port Knocking.
The Port Knocking list will appear. Click +Add to select the Port Knocking profile, then click Close.
• Select the Private IP Type as needed and enter the Server IP address.
• Click +Add to create a port forwarding rule.
• Choose the Protocol, then enter the Start and End values for both Public Port and Private Port.
• Click Apply to save the settings.
6. Go to the Port Knocking Tool web page and click Knock Ports. The tool will knock the router’s ports by sequence.
7. Try accessing the RDP server. We should now be able to see the login windows that requires the username and password. Once the client successfully unlocks the ports, that client - or any other client using the same public IP will be able to access the router. The established connection will remain active for an hour. After the session expires, the client will need to use the Port Knocking tool again to regain access.
8. Navigate to Utility / Web CLI, login with the username and password, and enter the command “exec portkncok”. The IP address passing the PortKnock checking will display here.