I'm not intending to deploy fwknop as anything more than a first line of defence, a way to make reconnaisance of the system harder. Fwknop is valuable as a tool to hide the existence of a certain service, and to reduce the surface area of possible attack. This is true whether you use fwknop to protect access to a VPN service or to protect access to SSH.
For example – ssh is a strong security measure, in theory. When working properly, I trust it to keep the bad guys out. However, a zero-day exploit in ssh would make it possible to gain access if the firewall port is unconditionally open. The same could be said about VPN services like OpenVPN.
In other words, I'm not expecting fwknop to be the solution to all security problems, but rather to be an extra layer of obscurity in a defence-in-depth security scheme. What they can't see, they can't attack. And as a first layer of defence, I'd argue it's more secure than any other scheme, because it's 100% stealthy to any attacker who isn't able to sniff the network, and because the code is so small that finding a security hole will be that much harder. Finally, breaking fwknop security barely even gets you in the door.
Also fwknop is more advanced than simple port knocking. All authorization is done in a single packet, which is protected by strong encryption, and is not vulnerable to replay attacks, like other port knocking schemes are.
Either way, the feature I'm requesting help with is not specific to fwknop itself, but will be useful for other security schemes or even VPN servers that require creation of custom firewall tables.
