Port Knocking issue

Hello,

I'm running shorewall 5.2.8 on a Raspberry with Raspbian Linux
11

Working like a charm except this issue

I'm trying to implement a simple port knocking mechanism as per
the documentation.

The first issue is the event reporting:

action.Knock:

#

?format 2

###############################################################################

#ACTION SOURCE DEST PROTO DPORT

IfEvent(SSH,ACCEPT:info,60,1,src,reset)\

- - tcp 40555

SetEvent(SSH,ACCEPT) - - tcp 62222

ResetEvent(SSH,DROP:info)\

- - tcp 40555

when I type command: shorewall events

I just get SSH without any extra details

The second issue is that it works perfectly on the local subnet
but not on the wan interface

rules for local subnet test:

REJECT net loc:10.10.3.104 all

DROP loc:10.10.3.104 net all

REJECT net loc:10.10.3.100 all

DROP loc:10.10.3.100 net all

DROP net:162.142.125.0/24 all

DROP net:167.94.138.0/24 all

DROP net:167.94.145.0/24 all

DROP net:167.94.146.0/24 all

DROP net:167.248.133.0/24 all

DROP net:62.210.206.0/24 all

DROP net:185.73.124.0/24 all

DROP net:185.190.24.0/24 all

Knock loc fw tcp 40555,62220-62224

ACCEPT net fw udp 9100 #OpenVPN

DROP net fw tcp 40555

DROP loc fw tcp 40555

REJECT net fw tcp 8123

I have traces in the log:

kernel: [12550.115398] Knock ACCEPT IN=eth0 OUT=
MAC=e4:5f:01:d3:f7:d9:9c:eb:e8:74:8b:2f:08:00 SRC=10.10.0.25
DST=10.10.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=41964 DF
PROTO=TCP SPT=35008 DPT=40555 WINDOW=64240 RES=0x00 SYN URGP=0
MARK=0x400

rules for wan interface test:

REJECT net loc:10.10.3.104 all

DROP loc:10.10.3.104 net all

REJECT net loc:10.10.3.100 all

DROP loc:10.10.3.100 net all

DROP net:162.142.125.0/24 all

DROP net:167.94.138.0/24 all

DROP net:167.94.145.0/24 all

DROP net:167.94.146.0/24 all

DROP net:167.248.133.0/24 all

DROP net:62.210.206.0/24 all

DROP net:185.73.124.0/24 all

DROP net:185.190.24.0/24 all

Knock net fw tcp 40555,62220-62224

ACCEPT net fw udp 9100 #OpenVPN

DROP net fw tcp 40555

REJECT net fw tcp 8123

Nothing displayed in the log about the knock from wan

Thx,

Jean-Francois Bogaerts