The authentication part does not look much different from password authentication (key ≈ password), and the "Configurable TTL" bit is somewhat confusing, the first part of the sentence assigns the TTL to API keys but the second part says it applies to IPs being whitelisted. I would expect that TTL for a key means that after the TTL expires the key itself becomes unusable.
Knocker, a knock based access control system for your homelab
11–20 of 175 posts
Re: Knocker, a knock based access control system for your homelab
#12Its 2025, Just use Tailscale.
If you're running a homelab, the likelihood that you're interested in removing cloud-dependencies from your stack is above average. If that's the case, Tailscale is out. Tailscale is just an added unnecessary external dependency layer (& security attack surface) on top of vanilla Wireguard. And in 2025 it's easier to run vanilla Wireguard than it's ever been.
Also, Headscale exists.
Re: Knocker, a knock based access control system for your homelab
#13Port knocking is a very hacky technique that was used:
1- In the 90s were security was whatever
2- In modern days as a way to keep your logs squeaky clean ( although you get 99% there with custom ports)
3- As a cute warm up exercise that you code yourself with what's available in your system. (iptables? a couple of python scripts communicating with each other?)
It's not a security mechanism, and downloading external dependencies or code (especially if vibecoded) is a net loss (by a huge margin).
It's also a waste of time to overengineer for the reasons noted above, I've seen supposedly encrypted port knocking implementations. It feels as if someone had a security checklist and then a checklist for that checklist.
Re: Knocker, a knock based access control system for your homelab
#14Nowadays public facing client IPs are often shared by thousands of users behind CGNAT. IP based firewall rules are useful when the peers have their own static IP address, but provide no real security when the IP address is shared.
This is vibe coded security through obscurity, i. e. quite useless. Use Tailscale or a self hosted VPN.
Re: Knocker, a knock based access control system for your homelab
#15Earlier quoted context omitted.
If you're running a homelab, the likelihood that you're interested in removing cloud-dependencies from your stack is above average. If that's the case, Tailscale is out. Tailscale is just an added unnecessary external dependency layer (& security attack surface) on top of vanilla Wireguard. And in 2025 it's easier to run vanilla Wireguard than it's ever been.
Also, Headscale exists.
I haven't tried Headscale but isn't it more complicated than Wireguard?
The selling point of Tailscale is that they simplify Wireguard UX by adding a proprietary control server - this adds complexity to the stack (extra component) but simplifies user experience (Tailscale run the control server for you).
Headscale seems like it's complicating the stack (adding an extra component) as well as complicating the user experience (you have to maintain two components yourself now instead of just the one Wireguard instance).
Granted I presume the Headscale control server might simplify management of your Wireguard instance but... you're still maintaining the control server yourself.
Re: Knocker, a knock based access control system for your homelab
#16Neat project, thanks for sharing. I'll stay away since it was vibecoded, but I appreciate the honesty.
Though this is not technically a "knocker", but a typical token-based auth gateway. I experimented with something similar recently as well, and think it has its use cases.
But I would agree with some of the comments here. If you need to expose many services to the internet, especially if their protocols are not encrypted, then a tunneling/mesh/overlay network would be a better solution. I was a happy tinc user for several years, and WireGuard now fills that purpose well. As much as people use solutions like Tailscale, ZeroTier, etc., I personally don't trust them, and would prefer to roll my own with WG. It's not that difficult anyway.
There's also Teleport, which is more of an identity-aware proxy, and it worked well last time I tried it, but I wouldn't use it for personal use.
Re: Knocker, a knock based access control system for your homelab
#17Earlier quoted context omitted.
Also, Headscale exists.
I haven't tried Headscale but isn't it more complicated than Wireguard? The selling point of Tailscale is that they simplify Wireguard UX by adding a proprietary control server - this adds complexity to the stack (extra component) but simplifies user experience (Tailscale run the control server for you). Headscale seems like it's complicating the stack (adding an extra component) as well as complicating the user expe…
It likely does add some complexity, though it’s relative. Self-hosting is always going to have some overhead. Managing WireGuard servers and clients and associated keys etc is probably the part that is most annoying, so I can see how it might be easier to throw that over the fence to Headscale even though it is introducing another dependency.
I was speaking more to doing it all in-house, versus outsourcing things to Tailscale, a third party not fully under one’s control, even if they act of behalf of the user. I think I largely agree with what you said.
Re: Knocker, a knock based access control system for your homelab
#18IP based exclusion should not be considered a security measure, not even for a low risk environment like a home lab
Re: Knocker, a knock based access control system for your homelab
#19[dead]
Re: Knocker, a knock based access control system for your homelab
#20Port knocking is a very hacky technique that was used: 1- In the 90s were security was whatever 2- In modern days as a way to keep your logs squeaky clean ( although you get 99% there with custom ports) 3- As a cute warm up exercise that you code yourself with what's available in your system. (iptables? a couple of python scripts communicating with each other?) It's not a security mechanism, and downloading external…
There's nothing "hacky" about port knocking. It was never meant to be a complete security solution—nothing is.
But it works very well as an additional layer of security. Sec nerds often scoff at "security through obscurity", but it is a very valid strategy. Running sshd on a random high port is not inherently more secure, but it avoids the vast majority of dumb scanners that spam port 22, which is why all my systems do that. Camouflage is underrated, yet wildly effective. You can see how well it works in nature.
In any case, this is not a port knocking solution anyway, as I mentioned in another comment.