[options]
    UseSyslog
    # Uncomment to specify interface:
    # Interface = eth0

# Knock sequence: 7000 → 8000 → 9000 to OPEN SSH
[openSSH]
    sequence    = 7000,8000,9000
    seq_timeout = 10
    command     = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

# Knock sequence: 9000 → 8000 → 7000 to CLOSE SSH again
[closeSSH]
    sequence    = 9000,8000,7000
    seq_timeout = 10
    command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn