Single Packet Authorization (SPA): Zero-Port Stealth Firewall Defense for VPNs

Every server connected to the public Internet faces continuous automated reconnaissance. Distributed scanners like Shodan, Censys, and mass botnets scan IPv4 space relentlessly, cataloging listening sockets. When organizations expose remote gateways—whether OpenSSH, IPsec daemons, or VPN endpoints—those public ports invite credential stuffing, protocol downgrades, and zero-day memory exploits.

Traditional perimeter firewalls keep service ports permanently open to accommodate remote users with dynamic IP addresses. Single Packet Authorization (SPA) eliminates this exposure by decoupling authentication from transport connection establishment. Under an SPA architecture, a gateway exposes zero open ports to port scans. The firewall runs in a default-drop posture, silently discarding unsolicited SYN frames and UDP probes without generating TCP resets or ICMP unreachable notices. Access requires transmitting a single encrypted, tamper-proof authorization datagram before initiating service handshakes.

+-------------------------------------------------------------------------+
|                  PERIMETER RECONNAISSANCE: STATIC VS SPA                |
+-------------------------------------------------------------------------+
|  Static Firewall:                                                       |
|  [Attacker] ---> Port Scan (TCP 22, UDP 51820) ---> [Open Port Responds] |
|                                                                         |
|  Single Packet Authorization (SPA):                                     |
|  [Attacker] ---> Port Scan ---> [Firewall DEFAULT DROP: Black Hole]     |
|  [User]     ---> 1x Encrypted SPA UDP Packet                            |
|                  │ (Sniffed via libpcap / eBPF without listening socket)|
|                  ▼                                                      |
|             [Ephemeral nftables rule dynamically opened for 30 seconds] |
+-------------------------------------------------------------------------+

Fatal Flaws of Traditional Port Knocking

To appreciate SPA, one must understand the shortcomings of its predecessor: classic Port Knocking. Introduced in 2003 by Martin Krzywinski, port knocking required clients to send a sequence of TCP SYN or UDP packets to closed ports in a fixed order (for example: ports 7000, 8000, 9000). A daemon monitoring firewall logs detected the sequence and temporarily unblocked the client's source IP.

Despite its initial popularity, classic port knocking suffered from critical engineering flaws:

1. Packet Reordering Sensitivity: Modern packet-switched routing frequently delivers datagrams out of sequence. If transit networks deliver knock packets out of order (e.g., 7000, 9000, 8000), the daemon rejects the attempt.
2. Replay Vulnerability: Knock sequences carried no cryptographic payloads. Observers on local Wi-Fi or compromised transits could record the port sequence and replay it to open the firewall for their own IP.
3. Port Scan Disruption: Automated scanners probing consecutive ports trigger partial sequences, resetting internal state machines and causing denial-of-service for legitimate clients.
4. Latency Overhead: Sending multiple sequential probes adds substantial connection delay before application traffic can begin.

What is Single Packet Authorization (SPA)?

Single Packet Authorization was designed by Michael Rash (creator of fwknop) to resolve the systemic vulnerabilities of multi-packet knocking. Instead of sequential port hits, SPA encapsulates identity, authorization parameters, and session constraints inside a single, strongly encrypted UDP datagram.

Under SPA, servers bind no listening external sockets. Target services (such as OpenSSH or WireGuard) bind strictly to localhost or internal virtual interfaces, while the external network interface runs under a stateless default DROP policy:

nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }

When an external host scans the system, the Linux kernel silently discards the frames. To port scanners and automated crawlers, the host behaves identically to unallocated IP space: completely dark.

Data Structure and SPA Packet Anatomy

An SPA payload bundles structured authentication data encrypted using authenticated ciphers (AES-256-CBC or GnuPG keys) and verified through HMAC-SHA256 digests. This delivers confidentiality, message integrity, and origin authenticity in a single atomic transaction.

+-------------------------------------------------------------------------+
|                        SPA ENCRYPTED PACKET FORMAT                      |
+-------------------------------------------------------------------------+
| [16-Byte Random Salt] : [Rijndael/AES Ciphertext Payload]               |
|                                                                         |
| Decrypted Payload Fields:                                               |
| 1. Random Nonce (16 alphanumeric chars)                                 |
| 2. Client Username (identifies policy stanza)                          |
| 3. Unix Timestamp (32-bit epoch for expiration enforcement)             |
| 4. fwknop Client Version                                                |
| 5. Mode Indicator (e.g., Access Request)                                |
| 6. Target Service Tuple: proto/port (e.g., udp/51820 or tcp/22)         |
| 7. Source IP Resolution (client external IP or dynamic marker)          |
| 8. SHA-256 Digest of preceding plaintext fields                         |
+-------------------------------------------------------------------------+

Standardized SPA Payload Layout

The decrypted payload string concatenates discrete tokens using standard colon delimiters:

[nonce]:[user]:[timestamp]:[version]:[mode]:[proto/port]:[client_ip]:[sha256_hash]

• Random Nonce: Prevents identical ciphertext generation across successive sessions even with identical parameters.
• Unix Timestamp: Enables servers to enforce strict validity windows (rejecting packets where $|\Delta t| > 60$ seconds).
• Client IP Specification: The client either requests access for its public IP or instructs the server to extract the source IP from the IP packet header (crucial when traversing NAT).

Passive Sniffing Mechanism: libpcap and eBPF/XDP

The primary security advantage of SPA is that servers process authorization datagrams without maintaining an open socket. Standard services rely on bind() and listen(), exposing transport stacks to network probes.

Instead, the SPA daemon (fwknopd) inspects raw frames at the data link layer using libpcap or kernel-level eBPF/XDP filters:

1. Kernel Hook: Packet capture mechanisms grab incoming frames directly from the network interface driver prior to firewall evaluation.
2. Payload Parsing: When an incoming frame matches the designated SPA UDP port, fwknopd copies the payload into user space.
3. Decryption and Verification: The daemon verifies the HMAC signature first. If invalid, the frame is dropped immediately with zero decryption overhead. Valid packets are decrypted using AES or private GPG keys.
4. Dynamic Firewall Mutation: Upon validation, the daemon injects an ephemeral temporary rule into the kernel nftables set.

Replay Attack Prevention and Nonce Caching

Because an SPA packet travels as a standalone datagram, an eavesdropper might attempt to capture and replay it to unlock access.

SPA prevents replay attacks through dual-layer validation:

• Strict Temporal Expiration: The receiver checks the embedded timestamp against its local clock. If the deviation exceeds the tolerance window (typically 60 seconds), the packet is rejected. Old captures cannot be reused.
• Persistent Nonce Cache: To stop replays within the active window, the server maintains an in-memory and on-disk database of processed SHA-256 digests. If an identical nonce arrives again, the server discards it without modifying firewall state.

Hardening VPN Gateways and WireGuard Tunnels

Modern VPN protocols like WireGuard provide exceptional cryptography and silent default behavior: unauthenticated handshakes produce no response.

However, in production deployments, relying solely on protocol-level silence leaves exposures:

1. Active Handshake Probing: Adversaries possessing compromised client keys can initiate handshakes, confirming gateway presence and topology.
2. DPI Port Identification: Censors and deep packet inspection appliances flag static UDP port numbers (e.g., 51820) and fixed handshake message lengths (148-byte initiations) to identify VPN traffic.
3. Control Plane Vulnerability: Gateways run auxiliary services—SSH daemons, REST orchestration APIs, telemetry exporters. Leaving these ports open creates major attack surfaces.

Pairing WireGuard with SPA resolves this: the WireGuard UDP port and management interfaces remain blocked. Only authenticated clients transmitting an SPA packet can dynamically unlock the port for their IP.

How RiceGuard Implements Zero-Port Stealth Defense

VPNRice designs network infrastructure around active routing resilience and cryptographic boundary defense. By combining the RiceGuard engine with zero-trust perimeter controls, VPNRice isolates client communications from external scanning.

+-------------------------------------------------------------------------+
|                  RICEGUARD ZERO-PORT ENCLAVE ARCHITECTURE               |
+-------------------------------------------------------------------------+
|  [ Client Node ]                                                        |
|        │                                                                |
|        ├─ 1. Authenticated SPA Datagram (Encrypted + HMAC-SHA256)       |
|        │     ▼                                                          |
|  [ Anycast Edge VIP ] ---> [ Silent Firewall (eBPF Kernel Drop) ]       |
|                                    │ (Cryptographic match verified)     |
|                                    ▼                                    |
|                             [ Ephemeral Dynamic Ingress Set: 30s ]      |
|                                    │                                    |
|        └─ 2. WireGuard Handshake (ChaCha20-Poly1305 / Noise_IK)         |
|              ▼                                                          |
|        [ RiceGuard Core Tunnel Active ]                                 |
+-------------------------------------------------------------------------+

RiceGuard enforces stealth through integrated operational principles:

• Ephemeral Access Enclaves: External interfaces present zero permanently open ports to network crawlers.
• Dynamic Ingress Pinning: When connection negotiation begins, authenticated signals dynamically authorize client IPs within packet filters for 30 seconds.
• Stateless Endpoint Mobility: When switching from Wi-Fi to cellular data, cryptographic session keys re-authorize the new remote socket without exposing core infrastructure.

Users seeking high-speed encrypted connectivity protected by stealth network engineering can download dedicated apps from the VPN download page.

Practical Deployment with fwknop and nftables

Deploying Single Packet Authorization on Linux combines fwknopd with the nftables packet filtering subsystem.

Configuring fwknopd.conf and access.conf

In /etc/fwknop/fwknopd.conf, configure the capture engine and firewall backend:

# Capture incoming frames on external interface via libpcap
PCAP_INTF                   eth0;
ENABLE_NFTABLES             Y;
NFT_TABLE                   filter;
NFT_CHAIN                   input;
ENABLE_SPA_PACKET_AGING     Y;
MAX_SPA_PACKET_AGE          60;
ENABLE_DIGEST_CACHE         Y;

In /etc/fwknop/access.conf, define authorization policies and cryptographic credentials:

# Define access stanza for authorized engineering workstation
SOURCE                      ANY;
OPEN_PORTS                  udp/51820, tcp/22;
KEY_BASE64                  +n8kZ3fV9g5wJkL8x7Qp1vYw2z4mR6tP8s0uA2bC4dE=;
HMAC_KEY_BASE64             k9P2wL4mR6tP8s0uA2bC4dE+n8kZ3fV9g5wJkL8x7Q=;
FW_ACCESS_TIMEOUT           30;
REQUIRE_SOURCE_ADDRESS      N;

When a client runs fwknop -A udp/51820 -D 198.51.100.1 -R, the daemon validates the payload, adds a temporary rule to nftables for 30 seconds, and lets the client complete its handshake. Once established, connection tracking (ct state established,related accept) preserves the session while the firewall returns to complete darkness.

Architectural Comparison: Port Knocking, SPA, and Zero Trust

Performance Tuning and High-Throughput DoS Defense

In production environments, running an SPA daemon requires careful tuning to prevent packet drops during volumetric denial-of-service events:

1. HMAC Pre-Authentication Filtering: Always configure an independent HMAC key alongside AES encryption. fwknopd verifies HMAC digests before invoking symmetric decryption, eliminating CPU exhaustion attacks from forged probes.
2. Raw Capture Ring Buffers: Increase socket receive buffers (SO_RCVBUFFORCE) in the capture configuration to prevent libpcap ring buffer drops during traffic spikes.
3. Kernel eBPF Offloading: In environments handling massive packet rates, deploy eBPF/XDP hooks to evaluate datagram lengths and magic bytes directly in network drivers before passing frames to user-space daemons.

Security Checklist for Stealth Firewall Architecture

Administrators securing infrastructure with Single Packet Authorization should follow this operational checklist:

1. Enforce Default-Drop Policy: Verify nftables drops all unsolicited incoming packets without returning ICMP unreachable responses.
2. Isolate Administrative Ports: Ensure management daemons (SSH, control APIs) bind to 127.0.0.1 and rely on SPA for access.
3. Use Dual-Key Architecture: Implement distinct Base64 keys for symmetric encryption and HMAC verification.
4. Synchronize Network Clocks: Configure authenticated NTP or NTS to keep system clocks within the 60-second temporal tolerance window.
5. Set Minimal Ephemeral Timeouts: Restrict firewall opening windows (FW_ACCESS_TIMEOUT) to 15–30 seconds—ample time for handshakes while minimizing exposure.

Eliminating open listening ports transforms network defense. By combining cryptographic authentication with passive packet filtering, Single Packet Authorization ensures that critical VPN gateways remain invisible to hostile network probes worldwide.