{"id":30859,"date":"2025-10-02T23:41:40","date_gmt":"2025-10-02T20:41:40","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=30859"},"modified":"2025-10-02T23:41:40","modified_gmt":"2025-10-02T20:41:40","slug":"ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/","title":{"rendered":"Ubuntu VPS’te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?"},"content":{"rendered":"

<\/p>\n

Ubuntu VPS’te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?<\/h2>\n

Giri\u015f<\/h3>\n

G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda, sunucu g\u00fcvenli\u011fi her zamankinden daha kritik bir \u00f6neme sahiptir. \u00d6zellikle Ubuntu tabanl\u0131 bir Sanal \u00d6zel Sunucu (VPS) kullan\u0131yorsan\u0131z, olas\u0131 sald\u0131r\u0131lara kar\u015f\u0131 savunma mekanizmalar\u0131n\u0131z\u0131 g\u00fc\u00e7lendirmek hayati bir ad\u0131md\u0131r. A\u00e7\u0131k portlar, k\u00f6t\u00fc niyetli ki\u015filerin sunucunuzu taramas\u0131 ve zafiyet aray\u0131\u015f\u0131 i\u00e7in birer hedef te\u015fkil eder. Port knocking, bu t\u00fcr tehditlere kar\u015f\u0131 al\u0131\u015f\u0131lmad\u0131k ama son derece etkili bir savunma katman\u0131 sunar. Bu makalede, herhangi bir ek yaz\u0131l\u0131m (\u00f6rne\u011fin knockd<\/code>) kullanmadan, sadece Linux’un yerle\u015fik g\u00fcvenlik duvar\u0131 olan iptables<\/code> ve onun recent<\/code> mod\u00fcl\u00fc ile port knocking’i nas\u0131l yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 ayr\u0131nt\u0131l\u0131 bir \u015fekilde inceleyece\u011fiz.<\/p>\n

Port knocking, bir servise (\u00f6rne\u011fin SSH) eri\u015fim izni vermeden \u00f6nce, belirli bir dizi “kap\u0131 vuru\u015fu” (yani belirli portlara ba\u011flant\u0131 denemeleri) yap\u0131lmas\u0131 prensibine dayan\u0131r. Bu vuru\u015flar genellikle kapal\u0131 veya gizli (stealth) portlara yap\u0131l\u0131r ve g\u00fcvenlik duvar\u0131 bu vuru\u015f dizisini do\u011fru alg\u0131lad\u0131\u011f\u0131nda, as\u0131l servisin portunu ge\u00e7ici olarak a\u00e7ar. Bu sayede, SSH gibi kritik servisleriniz varsay\u0131lan olarak kapal\u0131 kal\u0131r ve yaln\u0131zca do\u011fru “\u015fifreyi” bilenler taraf\u0131ndan eri\u015filebilir hale gelir. Bu yakla\u015f\u0131m, otomatik port taray\u0131c\u0131lar\u0131n\u0131 ve rastgele sald\u0131r\u0131lar\u0131 b\u00fcy\u00fck \u00f6l\u00e7\u00fcde engeller, \u00e7\u00fcnk\u00fc d\u0131\u015far\u0131dan bak\u0131ld\u0131\u011f\u0131nda sunucunuzun ilgili portlar\u0131 tamamen kapal\u0131 g\u00f6r\u00fcn\u00fcr.<\/p>\n

Bu makale boyunca, iptables<\/code>‘\u0131n recent<\/code> mod\u00fcl\u00fcn\u00fc kullanarak bu karma\u015f\u0131k ancak g\u00fc\u00e7l\u00fc mekanizmay\u0131 ad\u0131m ad\u0131m nas\u0131l kuraca\u011f\u0131n\u0131z\u0131, hangi komutlar\u0131 kullanaca\u011f\u0131n\u0131z\u0131 ve g\u00fcvenlik i\u00e7in nelere dikkat etmeniz gerekti\u011fini \u00f6\u011freneceksiniz. Amac\u0131m\u0131z, Ubuntu VPS’inizi daha g\u00fcvenli hale getirirken, mevcut kaynaklar\u0131 en verimli \u015fekilde kullanmakt\u0131r.<\/p>\n

Port Knocking Nedir ve Neden Kullan\u0131lmal\u0131d\u0131r?<\/h3>\n

Port knocking, bir sunucudaki belirli bir servise eri\u015fimi kontrol etmek i\u00e7in kullan\u0131lan bir a\u011f eri\u015fim kontrol mekanizmas\u0131d\u0131r. Temel fikir, bir kullan\u0131c\u0131n\u0131n \u00f6nceden belirlenmi\u015f bir “knock” (vuru\u015f) dizisini, yani bir dizi kapal\u0131 veya a\u00e7\u0131k portta belirli bir s\u0131rada ba\u011flant\u0131 denemeleri yapmas\u0131n\u0131 gerektirmesidir. Bu dizi do\u011fru \u015fekilde tamamland\u0131\u011f\u0131nda, g\u00fcvenlik duvar\u0131 kullan\u0131c\u0131n\u0131n IP adresine belirli bir servisin portunu (\u00f6rne\u011fin SSH i\u00e7in 22 numaral\u0131 port) ge\u00e7ici olarak a\u00e7ar.<\/p>\n

Neden Kullan\u0131lmal\u0131d\u0131r?<\/strong><\/p>\n

1. Geli\u015fmi\u015f G\u00fcvenlik:<\/strong> En belirgin faydas\u0131, sunucunuzun a\u00e7\u0131k portlar\u0131n\u0131 d\u0131\u015f d\u00fcnyaya kar\u015f\u0131 gizlemesidir. Normalde a\u00e7\u0131k olan SSH portu (22), port knocking uyguland\u0131\u011f\u0131nda d\u0131\u015far\u0131dan kapal\u0131 g\u00f6r\u00fcn\u00fcr. Bu, otomatik port taray\u0131c\u0131lar\u0131n\u0131n ve botlar\u0131n sunucunuzu hedef almas\u0131n\u0131 zorla\u015ft\u0131r\u0131r.
\n2. Sald\u0131r\u0131 Y\u00fczeyinin Azalt\u0131lmas\u0131:<\/strong> A\u00e7\u0131k portlar, sald\u0131r\u0131 y\u00fczeyini art\u0131r\u0131r. Port knocking, bu y\u00fczeyi \u00f6nemli \u00f6l\u00e7\u00fcde k\u00fc\u00e7\u00fclterek, potansiyel zafiyetlerin ke\u015ffedilme olas\u0131l\u0131\u011f\u0131n\u0131 azalt\u0131r.
\n3. Brute-Force Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Koruma:<\/strong> SSH gibi servisler s\u0131k\u00e7a brute-force sald\u0131r\u0131lar\u0131na maruz kal\u0131r. Port knocking, bu t\u00fcr sald\u0131r\u0131lar\u0131 daha ba\u015flamadan engeller, \u00e7\u00fcnk\u00fc sald\u0131rgan do\u011fru knock dizisini bilmedi\u011fi s\u00fcrece SSH portuna eri\u015femez.
\n4. Kaynak Verimlili\u011fi:<\/strong> iptables<\/code> tabanl\u0131 bir \u00e7\u00f6z\u00fcm, ek bir daemon \u00e7al\u0131\u015ft\u0131rmad\u0131\u011f\u0131 i\u00e7in sistem kaynaklar\u0131n\u0131 minimal d\u00fczeyde t\u00fcketir. Bu, \u00f6zellikle s\u0131n\u0131rl\u0131 kaynaklara sahip VPS’ler i\u00e7in \u00f6nemlidir.
\n5. Esneklik:<\/strong> iptables<\/code> kurallar\u0131 ile port knocking’i, istedi\u011finiz karma\u015f\u0131kl\u0131kta ve istedi\u011finiz servisler i\u00e7in yap\u0131land\u0131rabilirsiniz.<\/p>\n

Port knocking tek ba\u015f\u0131na bir \u00e7\u00f6z\u00fcm olmamakla birlikte, mevcut g\u00fcvenlik \u00f6nlemlerinize (g\u00fc\u00e7l\u00fc parolalar, SSH anahtarlar\u0131, fail2ban vb.) g\u00fc\u00e7l\u00fc bir ek katman sa\u011flar.<\/p>\n

\u00d6n Gereksinimler<\/h3>\n

Bu rehbere ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki \u00f6n ko\u015fullar\u0131n kar\u015f\u0131land\u0131\u011f\u0131ndan emin olman\u0131z gerekmektedir:<\/p>\n

1. Ubuntu VPS:<\/strong> \u00c7al\u0131\u015f\u0131r durumda bir Ubuntu tabanl\u0131 Sanal \u00d6zel Sunucuya sahip olmal\u0131s\u0131n\u0131z. Rehber Ubuntu 20.04 veya 22.04 LTS s\u00fcr\u00fcmleri i\u00e7in ge\u00e7erlidir.
\n2. Root Eri\u015fimi veya Sudo Yetkileri:<\/strong> iptables<\/code> kurallar\u0131n\u0131 de\u011fi\u015ftirmek i\u00e7in root kullan\u0131c\u0131s\u0131 olman\u0131z veya sudo<\/code> yetkilerine sahip bir kullan\u0131c\u0131 ile oturum a\u00e7m\u0131\u015f olman\u0131z gerekmektedir.
\n3. Temel Iptables Bilgisi:<\/strong> iptables<\/code> komutlar\u0131n\u0131n genel yap\u0131s\u0131, zincirler (INPUT, OUTPUT, FORWARD) ve hedefler (ACCEPT, DROP, REJECT) hakk\u0131nda temel bilgiye sahip olman\u0131z faydal\u0131 olacakt\u0131r.
\n4. SSH Eri\u015fimi:<\/strong> Kurallar\u0131 yap\u0131land\u0131r\u0131rken sunucunuza SSH \u00fczerinden eri\u015fiyor olman\u0131z \u00f6nemlidir. Yanl\u0131\u015f yap\u0131land\u0131rma durumunda kendinizi d\u0131\u015far\u0131da b\u0131rakmamak i\u00e7in, VPS sa\u011flay\u0131c\u0131n\u0131z\u0131n web tabanl\u0131 konsol eri\u015fiminin (VNC veya benzeri) oldu\u011fundan emin olun. Bu, kritik bir g\u00fcvenlik \u00f6nlemidir.
\n5. A\u011f Temelleri Bilgisi:<\/strong> TCP\/UDP portlar\u0131, IP adresleri ve temel a\u011f ileti\u015fimi hakk\u0131nda bilgi sahibi olman\u0131z, kurallar\u0131 anlaman\u0131za yard\u0131mc\u0131 olacakt\u0131r.<\/p>\n

Bu \u00f6n ko\u015fullar sa\u011fland\u0131\u011f\u0131nda, port knocking yap\u0131land\u0131rmas\u0131na g\u00fcvenle ba\u015flayabiliriz.<\/p>\n

Iptables ve Recent Mod\u00fcl\u00fc: Port Knocking’in Temel Ta\u015f\u0131<\/h3>\n

iptables<\/code>, Linux \u00e7ekirde\u011finin netfilter \u00e7er\u00e7evesi i\u00e7in bir kullan\u0131c\u0131 alan\u0131 program\u0131d\u0131r. Paket filtreleme, a\u011f adresi \u00e7evirisi (NAT) ve ba\u011flant\u0131 takibi gibi g\u00f6revleri yerine getirir. Port knocking i\u00e7in iptables<\/code>‘\u0131n g\u00fcc\u00fcn\u00fc, \u00f6zellikle recent<\/code> mod\u00fcl\u00fc ile birle\u015ftirerek kullanaca\u011f\u0131z.<\/p>\n

recent<\/code> Mod\u00fcl\u00fc Nedir?<\/strong>
\nrecent<\/code> mod\u00fcl\u00fc, iptables<\/code>‘a belirli bir IP adresinden gelen ba\u011flant\u0131 denemelerini izleme ve kaydetme yetene\u011fi kazand\u0131r\u0131r. Bu mod\u00fcl sayesinde, belirli bir s\u00fcre i\u00e7inde belirli bir IP adresinden ka\u00e7 tane ba\u011flant\u0131 denemesi yap\u0131ld\u0131\u011f\u0131n\u0131, hangi portlara yap\u0131ld\u0131\u011f\u0131n\u0131 ve bu IP adresini belirli bir listeye ekleyip \u00e7\u0131karmay\u0131 kontrol edebiliriz. Port knocking i\u00e7in bu \u00f6zellikler vazge\u00e7ilmezdir.<\/p>\n

recent<\/code> mod\u00fcl\u00fcn\u00fcn temel parametreleri \u015funlard\u0131r:<\/p>\n

* --set<\/code>: Belirli bir IP adresini, belirtilen recent<\/code> listesine ekler. E\u011fer IP zaten listedeyse, zaman damgas\u0131n\u0131 g\u00fcnceller.
\n* --rcheck<\/code>: Belirli bir IP adresinin, belirtilen recent<\/code> listesinde olup olmad\u0131\u011f\u0131n\u0131 kontrol eder. E\u011fer listede ise kural\u0131 e\u015fle\u015ftirir.
\n * --seconds <\/code>: IP’nin listede kalma s\u00fcresini saniye cinsinden belirtir. Bu s\u00fcre i\u00e7inde listede olmas\u0131 gerekir.
\n * --hitcount <\/code>: IP’nin listede belirtilen say\u0131da vuru\u015f yapm\u0131\u015f olmas\u0131 gerekir.
\n* --update<\/code>: --rcheck<\/code> ile birlikte kullan\u0131l\u0131r. E\u011fer IP listedeyse ve e\u015fle\u015firse, IP’nin zaman damgas\u0131n\u0131 g\u00fcnceller.
\n* --remove<\/code>: Belirli bir IP adresini, belirtilen recent<\/code> listesinden kald\u0131r\u0131r.
\n* --name <\/code>: Kullan\u0131lacak recent<\/code> listesinin ad\u0131n\u0131 belirtir. Varsay\u0131lan olarak DEFAULT<\/code> kullan\u0131l\u0131r. Her bir knocking a\u015famas\u0131 i\u00e7in farkl\u0131 bir liste ad\u0131 kullanaca\u011f\u0131z (\u00f6rn. KNOCK_1<\/code>, KNOCK_2<\/code>, ACCESS<\/code>).
\n* --rsource<\/code> \/ --rdest<\/code>: Kaynak IP adresini (--rsource<\/code>) veya hedef IP adresini (--rdest<\/code>) izlemek i\u00e7in kullan\u0131l\u0131r. Genellikle --rsource<\/code> kullan\u0131l\u0131r.<\/p>\n

Bu parametreleri kullanarak, bir kullan\u0131c\u0131n\u0131n do\u011fru port dizisini takip edip etmedi\u011fini kontrol eden karma\u015f\u0131k bir mant\u0131k olu\u015fturaca\u011f\u0131z. \u00d6rne\u011fin, ilk porta vuran IP’yi bir listeye ekleyece\u011fiz, ikinci porta vuran ve ilk listede olan IP’yi ikinci bir listeye ekleyip ilk listeden \u00e7\u0131karaca\u011f\u0131z ve bu \u015fekilde devam edece\u011fiz.<\/p>\n

Ad\u0131m Ad\u0131m Yap\u0131land\u0131rma<\/h3>\n

Bu b\u00f6l\u00fcmde, iptables<\/code> kullanarak port knocking’i ad\u0131m ad\u0131m nas\u0131l yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 \u00f6\u011freneceksiniz. G\u00fcvenli bir \u015fekilde ilerlemek i\u00e7in ad\u0131mlar\u0131 dikkatlice takip edin.<\/p>\n

Mevcut Iptables Kurallar\u0131n\u0131 Yedekleme<\/h4>\n

Herhangi bir g\u00fcvenlik duvar\u0131 de\u011fi\u015fikli\u011fine ba\u015flamadan \u00f6nce, mevcut kurallar\u0131n\u0131z\u0131 yedeklemek kritik \u00f6neme sahiptir. Bu, bir sorunla kar\u015f\u0131la\u015ft\u0131\u011f\u0131n\u0131zda kolayca geri d\u00f6nebilmenizi sa\u011flar.<\/p>\n

sudo iptables-save > \/etc\/iptables\/rules.v4.bak\nsudo ip6tables-save > \/etc\/iptables\/rules.v6.bak<\/code><\/pre>\n
Varsay\u0131lan Politikalar\u0131 Belirleme<\/h4>\n
G\u00fcvenli\u011fi art\u0131rmak i\u00e7in INPUT<\/code> zincirinin varsay\u0131lan politikas\u0131n\u0131 DROP<\/code> olarak ayarlamak en iyi uygulamad\u0131r. Bu, a\u00e7\u0131k\u00e7a izin verilmeyen t\u00fcm ba\u011flant\u0131lar\u0131n engellenece\u011fi anlam\u0131na gelir. OUTPUT<\/code> ve FORWARD<\/code> zincirlerini genellikle ACCEPT<\/code> olarak b\u0131rakabiliriz, ancak daha s\u0131k\u0131 g\u00fcvenlik gereksinimleriniz varsa bunlar\u0131 da \u00f6zelle\u015ftirebilirsiniz.<\/p>\n
sudo iptables -P INPUT DROP\nsudo iptables -P FORWARD DROP\nsudo iptables -P OUTPUT ACCEPT<\/code><\/pre>\n
UYARI:<\/strong> Bu komutu \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra, mevcut SSH oturumunuz da dahil olmak \u00fczere t\u00fcm ba\u011flant\u0131lar kesilebilir! Bu y\u00fczden, \u00f6ncelikle SSH portunu a\u00e7an kurallar\u0131 eklemeniz veya bu ad\u0131m\u0131, t\u00fcm knocking kurallar\u0131n\u0131 ekledikten sonra en son \u00e7al\u0131\u015ft\u0131rman\u0131z \u00f6nerilir. En g\u00fcvenli yol, SSH eri\u015fiminizi a\u00e7an kural\u0131 (knock sonras\u0131) ekledikten sonra bu varsay\u0131lan politikay\u0131 uygulamakt\u0131r. Ancak, bu makalede knocking mekanizmas\u0131n\u0131 kurduktan sonra SSH eri\u015fimi sa\u011flayaca\u011f\u0131m\u0131z i\u00e7in, varsay\u0131lan olarak DROP<\/code> ile ba\u015flay\u0131p, knocking ile eri\u015fim sa\u011flayaca\u011f\u0131z.<\/p>\n
Gerekli Mod\u00fclleri Y\u00fckleme<\/h4>\n
recent<\/code> mod\u00fcl\u00fc genellikle varsay\u0131lan olarak y\u00fckl\u00fcd\u00fcr, ancak emin olmak i\u00e7in kontrol edebilirsiniz:<\/p>\n
sudo modprobe xt_recent<\/code><\/pre>\n
E\u011fer herhangi bir hata vermezse, mod\u00fcl zaten y\u00fckl\u00fc demektir.<\/p>\n
SSH Portunu Kapatma (Knock \u00d6ncesi Durum)<\/h4>\n
Varsay\u0131lan olarak, SSH portu (genellikle 22) d\u0131\u015far\u0131dan eri\u015filebilir olmamal\u0131d\u0131r. E\u011fer mevcut kurallar\u0131n\u0131zda SSH portunu a\u00e7an bir kural varsa, onu silmeniz veya devre d\u0131\u015f\u0131 b\u0131rakman\u0131z gerekir. Bizim senaryomuzda, INPUT<\/code> zincirinin varsay\u0131lan politikas\u0131 DROP<\/code> oldu\u011fu i\u00e7in, SSH portu zaten kapal\u0131 olacakt\u0131r.<\/p>\n
Ancak, kendi IP adresinizden SSH eri\u015fimine izin veren bir kural\u0131n\u0131z varsa, bunu \u015fimdilik koruyun veya VPS konsol eri\u015fiminizin oldu\u011fundan emin olun. Bu rehberde, SSH portunun tamamen kapal\u0131 oldu\u011funu ve sadece knock dizisi ile a\u00e7\u0131laca\u011f\u0131n\u0131 varsay\u0131yoruz.<\/p>\n
Lokal Loopback Aray\u00fcz\u00fcne \u0130zin Verme:<\/strong>
\nSunucunun kendisiyle ileti\u015fim kurabilmesi i\u00e7in lo<\/code> aray\u00fcz\u00fcne izin verilmelidir. Bu, bir\u00e7ok servisin d\u00fczg\u00fcn \u00e7al\u0131\u015fmas\u0131 i\u00e7in gereklidir.<\/p>\n
sudo iptables -A INPUT -i lo -j ACCEPT<\/code><\/pre>\n
Mevcut Ba\u011flant\u0131lara \u0130zin Verme:<\/strong>
\nHalihaz\u0131rda kurulmu\u015f ba\u011flant\u0131lar\u0131n devam etmesine izin vermek ve g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131n yeni ba\u011flant\u0131lar i\u00e7in ge\u00e7erli olmas\u0131n\u0131 sa\u011flamak \u00f6nemlidir.<\/p>\n
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n
Port Knocking Zincirlerini Olu\u015fturma<\/h4>\n
Port knocking mant\u0131\u011f\u0131n\u0131 uygulamak i\u00e7in \u00f6zel iptables<\/code> zincirleri olu\u015fturaca\u011f\u0131z. Bu zincirler, knocking a\u015famalar\u0131n\u0131 ve eri\u015fim iznini y\u00f6netecek.<\/p>\n
*   KNOCKING_STAGE_1<\/code>: \u0130lk vuru\u015fu bekler.
\n*   KNOCKING_STAGE_2<\/code>: \u0130kinci vuru\u015fu bekler.
\n*   KNOCKING_STAGE_3<\/code>: \u00dc\u00e7\u00fcnc\u00fc vuru\u015fu bekler.
\n*   ACCESS_GRANTED<\/code>: Do\u011fru vuru\u015f dizisinden sonra eri\u015fim izni verir.
\n*   INVALID_KNOCK<\/code>: Hatal\u0131 vuru\u015flar\u0131 y\u00f6netir ve recent<\/code> listelerini temizler.<\/p>\n
sudo iptables -N KNOCKING_STAGE_1\nsudo iptables -N KNOCKING_STAGE_2\nsudo iptables -N KNOCKING_STAGE_3\nsudo iptables -N ACCESS_GRANTED\nsudo iptables -N INVALID_KNOCK<\/code><\/pre>\n
Knocking A\u015famalar\u0131n\u0131 Tan\u0131mlama<\/h4>\n
\u015eimdi, her bir knocking a\u015famas\u0131 i\u00e7in kurallar\u0131 tan\u0131mlayaca\u011f\u0131z. \u00d6rnek olarak, 3 a\u015famal\u0131 bir knocking dizisi kullanaca\u011f\u0131z: 10001<\/code> (TCP), 10002<\/code> (UDP), 10003<\/code> (TCP). SSH portunu 22 olarak kabul ediyoruz.<\/p>\n
1. Hatal\u0131 Vuru\u015flar\u0131 Y\u00f6netme (INVALID_KNOCK)<\/strong>
\nBu zincir, herhangi bir a\u015famada yanl\u0131\u015f bir porta veya yanl\u0131\u015f s\u0131rayla gelen bir ba\u011flant\u0131 denemesini yakalayarak, ilgili IP adresini t\u00fcm recent<\/code> listelerinden temizler ve potansiyel sald\u0131rganlar\u0131 s\u0131f\u0131rlar. Bu, birinin knocking dizisini tahmin etmeye \u00e7al\u0131\u015f\u0131rken kilitlenmesini sa\u011flar.<\/p>\n
# INVALID_KNOCK zinciri: IP'yi t\u00fcm knocking listelerinden kald\u0131r\nsudo iptables -A INVALID_KNOCK -m recent --name KNOCK_1 --remove -j LOG --log-prefix \"INVALID_KNOCK: KNOCK_1 removed \"\nsudo iptables -A INVALID_KNOCK -m recent --name KNOCK_2 --remove -j LOG --log-prefix \"INVALID_KNOCK: KNOCK_2 removed \"\nsudo iptables -A INVALID_KNOCK -m recent --name KNOCK_3 --remove -j LOG --log-prefix \"INVALID_KNOCK: KNOCK_3 removed \"\nsudo iptables -A INVALID_KNOCK -m recent --name ACCESS --remove -j LOG --log-prefix \"INVALID_KNOCK: ACCESS removed \"\nsudo iptables -A INVALID_KNOCK -j DROP # Hatal\u0131 vuru\u015flar\u0131 d\u00fc\u015f\u00fcr<\/code><\/pre>\n
Not:<\/strong> LOG<\/code> kurallar\u0131, \/var\/log\/syslog<\/code> veya \/var\/log\/kern.log<\/code> dosyalar\u0131na hatal\u0131 denemelerin kaydedilmesini sa\u011flar. Bu, g\u00fcvenlik denetimi i\u00e7in faydal\u0131d\u0131r.<\/p>\n
2. Eri\u015fim Verme Zinciri (ACCESS_GRANTED)<\/strong>
\nBu zincir, do\u011fru knock dizisi tamamland\u0131\u011f\u0131nda \u00e7a\u011fr\u0131l\u0131r. Belirli bir IP adresine SSH portuna eri\u015fim izni verir ve bu IP’yi ACCESS<\/code> listesine ekler.<\/p>\n
# ACCESS_GRANTED zinciri: SSH eri\u015fimi verir ve ACCESS listesine ekler\n
E\u011fer IP zaten ACCESS listesindeyse, zaman damgas\u0131n\u0131 g\u00fcncelle<\/h2>\nsudo iptables -A ACCESS_GRANTED -m recent --name ACCESS --set -j ACCEPT\n
SSH portunu a\u00e7 (\u00f6rne\u011fin 22)<\/h2>\nsudo iptables -A ACCESS_GRANTED -p tcp --dport 22 -j ACCEPT\n
Di\u011fer a\u00e7\u0131lacak servisler buraya eklenebilir<\/h2>\n
sudo iptables -A ACCESS_GRANTED -p tcp --dport 80 -j ACCEPT<\/h2>\n
sudo iptables -A ACCESS_GRANTED -p tcp --dport 443 -j ACCEPT<\/code><\/pre>\n<\/h2>\n
3. Knocking A\u015famalar\u0131 Kurallar\u0131<\/strong><\/p>\n
\u015eimdi ana INPUT<\/code> zincirine kurallar ekleyece\u011fiz. Bu kurallar, gelen ba\u011flant\u0131 denemelerini yakalayacak ve do\u011fru knocking zincirlerine y\u00f6nlendirecektir.<\/p>\n
Knock Dizisi:<\/strong>
\n*   1. Knock:<\/strong> TCP port 10001
\n*   2. Knock:<\/strong> UDP port 10002
\n*   3. Knock:<\/strong> TCP port 10003<\/p>\n
a. Birinci Knock (10001\/TCP)<\/strong>
\n\u0130lk porta gelen ba\u011flant\u0131 denemesini yakalar. E\u011fer bir IP bu porta vurursa, KNOCK_1<\/code> listesine eklenir ve KNOCKING_STAGE_1<\/code> zincirine y\u00f6nlendirilir.<\/p>\n
# INPUT zincirinden KNOCKING_STAGE_1'e y\u00f6nlendirme\nsudo iptables -A INPUT -p tcp --dport 10001 -m recent --name KNOCK_1 --set -j KNOCKING_STAGE_1\nsudo iptables -A KNOCKING_STAGE_1 -j DROP # Bu portu d\u0131\u015far\u0131dan kapal\u0131 tut<\/code><\/pre>\n
A\u00e7\u0131klama:<\/strong>
\n*   -p tcp --dport 10001<\/code>: TCP 10001 portuna gelen paketleri e\u015fle\u015ftir.
\n*   -m recent --name KNOCK_1 --set<\/code>: Paketin kaynak IP adresini KNOCK_1<\/code> adl\u0131 recent<\/code> listesine ekle.
\n*   -j KNOCKING_STAGE_1<\/code>: E\u015fle\u015fen paketi KNOCKING_STAGE_1<\/code> zincirine y\u00f6nlendir.
\n*   iptables -A KNOCKING_STAGE_1 -j DROP<\/code>: KNOCKING_STAGE_1<\/code> zincirine gelen paketleri d\u00fc\u015f\u00fcr. Bu, knocking portlar\u0131n\u0131n d\u0131\u015far\u0131dan kapal\u0131 g\u00f6r\u00fcnmesini sa\u011flar.<\/p>\n
b. \u0130kinci Knock (10002\/UDP)<\/strong>
\n\u0130kinci porta gelen ba\u011flant\u0131 denemesini yakalar. Ancak, bu denemenin ge\u00e7erli say\u0131lmas\u0131 i\u00e7in IP’nin \u00f6nce<\/em> KNOCK_1<\/code> listesinde olmas\u0131 gerekir. E\u011fer \u00f6yleyse, IP KNOCK_2<\/code> listesine eklenir ve KNOCK_1<\/code> listesinden \u00e7\u0131kar\u0131l\u0131r.<\/p>\n
# INPUT zincirinden KNOCKING_STAGE_2'e y\u00f6nlendirme\nsudo iptables -A INPUT -p udp --dport 10002 -m recent --name KNOCK_1 --rcheck --seconds 15 --hitcount 1 \\\n  -m recent --name KNOCK_2 --set -j KNOCKING_STAGE_2\nsudo iptables -A KNOCKING_STAGE_2 -j DROP # Bu portu d\u0131\u015far\u0131dan kapal\u0131 tut<\/code><\/pre>\n
A\u00e7\u0131klama:<\/strong>
\n*   -p udp --dport 10002<\/code>: UDP 10002 portuna gelen paketleri e\u015fle\u015ftir.
\n*   -m recent --name KNOCK_1 --rcheck --seconds 15 --hitcount 1<\/code>: Kaynak IP’nin KNOCK_1<\/code> listesinde olup olmad\u0131\u011f\u0131n\u0131 kontrol et. Son 15 saniye i\u00e7inde en az 1 kez bu listeye eklenmi\u015f olmal\u0131.
\n*   -m recent --name KNOCK_2 --set<\/code>: E\u011fer kontrol ba\u015far\u0131l\u0131ysa, IP’yi KNOCK_2<\/code> listesine ekle.
\n*   -j KNOCKING_STAGE_2<\/code>: E\u015fle\u015fen paketi KNOCKING_STAGE_2<\/code> zincirine y\u00f6nlendir.
\n*   iptables -A KNOCKING_STAGE_2 -j DROP<\/code>: KNOCKING_STAGE_2<\/code> zincirine gelen paketleri d\u00fc\u015f\u00fcr.<\/p>\n
c. \u00dc\u00e7\u00fcnc\u00fc Knock (10003\/TCP)<\/strong>
\n\u00dc\u00e7\u00fcnc\u00fc porta gelen ba\u011flant\u0131 denemesini yakalar. Bu denemenin ge\u00e7erli say\u0131lmas\u0131 i\u00e7in IP’nin \u00f6nce<\/em> KNOCK_2<\/code> listesinde olmas\u0131 gerekir. E\u011fer \u00f6yleyse, IP ACCESS<\/code> listesine eklenir ve KNOCK_2<\/code> listesinden \u00e7\u0131kar\u0131l\u0131r.<\/p>\n
# INPUT zincirinden KNOCKING_STAGE_3'e y\u00f6nlendirme\nsudo iptables -A INPUT -p tcp --dport 10003 -m recent --name KNOCK_2 --rcheck --seconds 15 --hitcount 1 \\\n  -m recent --name ACCESS --set -j KNOCKING_STAGE_3\nsudo iptables -A KNOCKING_STAGE_3 -j DROP # Bu portu d\u0131\u015far\u0131dan kapal\u0131 tut<\/code><\/pre>\n
A\u00e7\u0131klama:<\/strong>
\n*   -p tcp --dport 10003<\/code>: TCP 10003 portuna gelen paketleri e\u015fle\u015ftir.
\n*   -m recent --name KNOCK_2 --rcheck --seconds 15 --hitcount 1<\/code>: Kaynak IP’nin KNOCK_2<\/code> listesinde olup olmad\u0131\u011f\u0131n\u0131 kontrol et. Son 15 saniye i\u00e7inde en az 1 kez bu listeye eklenmi\u015f olmal\u0131.
\n*   -m recent --name ACCESS --set<\/code>: E\u011fer kontrol ba\u015far\u0131l\u0131ysa, IP’yi ACCESS<\/code> listesine ekle.
\n*   -j KNOCKING_STAGE_3<\/code>: E\u015fle\u015fen paketi KNOCKING_STAGE_3<\/code> zincirine y\u00f6nlendir.
\n*   iptables -A KNOCKING_STAGE_3 -j DROP<\/code>: KNOCKING_STAGE_3<\/code> zincirine gelen paketleri d\u00fc\u015f\u00fcr.<\/p>\n
d. Knocking Listelerini Temizleme (\u00d6nemli!)<\/strong>
\nHer ba\u015far\u0131l\u0131 a\u015famadan sonra bir \u00f6nceki a\u015faman\u0131n listesinden IP’yi \u00e7\u0131karmak \u00f6nemlidir. Bu, dizinin do\u011fru s\u0131rada takip edildi\u011finden emin olur ve eski durumlar\u0131n kar\u0131\u015fmas\u0131n\u0131 \u00f6nler. Bu kurallar\u0131 ilgili KNOCKING_STAGE_X<\/code> zincirlerinin i\u00e7ine koymak en mant\u0131kl\u0131 yakla\u015f\u0131md\u0131r.<\/p>\n
# KNOCKING_STAGE_1 zinciri\nsudo iptables -A KNOCKING_STAGE_1 -j DROP # \u0130lk knock portuna gelenleri d\u00fc\u015f\u00fcr\n\n
KNOCKING_STAGE_2 zinciri<\/h2>\nsudo iptables -A KNOCKING_STAGE_2 -m recent --name KNOCK_1 --remove -j DROP # KNOCK_1'den kald\u0131r ve d\u00fc\u015f\u00fcr\n\n
KNOCKING_STAGE_3 zinciri<\/h2>\nsudo iptables -A KNOCKING_STAGE_3 -m recent --name KNOCK_2 --remove -j ACCESS_GRANTED # KNOCK_2'den kald\u0131r ve ACCESS_GRANTED'e y\u00f6nlendir<\/code><\/pre>\n
Yukar\u0131daki DROP<\/code> komutlar\u0131, knock portlar\u0131na yap\u0131lan ba\u011flant\u0131 denemelerinin yan\u0131t vermemesini (yani kapal\u0131 g\u00f6r\u00fcnmesini) sa\u011flar.<\/p>\n
e. Eri\u015fim \u0130zni S\u00fcresi ve Temizleme<\/strong>
\nACCESS<\/code> listesindeki IP’ler i\u00e7in belirli bir s\u00fcre sonra eri\u015fimi otomatik olarak sonland\u0131rmak \u00f6nemlidir. Bu, e\u011fer ba\u011flant\u0131 kesilirse veya unutulursa a\u00e7\u0131k kalmas\u0131n\u0131 engeller. Bu kural\u0131 INPUT<\/code> zincirinin ba\u015f\u0131na ekleyece\u011fiz, ancak ESTABLISHED,RELATED<\/code> kurallar\u0131ndan sonra.<\/p>\n
# ACCESS listesindeki IP'lerin SSH eri\u015fimine izin ver\n
E\u011fer IP ACCESS listesindeyse ve 60 saniye i\u00e7inde tekrar ba\u011flant\u0131 denemesi yaparsa, zaman damgas\u0131n\u0131 g\u00fcncelle<\/h2>\n
Bu kural, ACCESS_GRANTED'dan sonra \u00e7al\u0131\u015f\u0131r, bu y\u00fczden ACCESS_GRANTED zinciri asl\u0131nda sadece bir kez \u00e7a\u011fr\u0131l\u0131r<\/h2>\n
ve IP'yi ACCESS listesine ekler. Buradaki kural ise o listedeki IP'lere s\u00fcrekli eri\u015fim sa\u011flar.<\/h2>\nsudo iptables -A INPUT -m recent --name ACCESS --rcheck --seconds 60 --update -j ACCEPT<\/code><\/pre>\n
A\u00e7\u0131klama:<\/strong>
\n*   -m recent --name ACCESS --rcheck --seconds 60 --update<\/code>: Kaynak IP ACCESS<\/code> listesinde mi? Son 60 saniye i\u00e7inde bir kez e\u015fle\u015fti mi? E\u011fer evet ise, zaman damgas\u0131n\u0131 g\u00fcncelle.
\n*   -j ACCEPT<\/code>: Bu IP’den gelen t\u00fcm ba\u011flant\u0131lara (\u00f6rne\u011fin SSH) izin ver.
\nBu kural, kullan\u0131c\u0131n\u0131n SSH oturumu s\u0131ras\u0131nda veya 60 saniye i\u00e7inde ba\u015fka bir ba\u011flant\u0131 denemesi yapt\u0131\u011f\u0131nda, ACCESS<\/code> listesindeki IP’nin zaman damgas\u0131n\u0131 g\u00fcncelleyerek eri\u015fimin devaml\u0131l\u0131\u011f\u0131n\u0131 sa\u011flar. E\u011fer 60 saniye i\u00e7inde hi\u00e7bir aktivite olmazsa, IP ACCESS<\/code> listesinden otomatik olarak \u00e7\u0131kar\u0131l\u0131r ve SSH eri\u015fimi kapan\u0131r.<\/p>\n
f. Hatal\u0131 Knock Denemelerini Yakalama<\/strong>
\nAna INPUT<\/code> zincirinde, yukar\u0131daki knocking kurallar\u0131yla e\u015fle\u015fmeyen her t\u00fcrl\u00fc ba\u011flant\u0131 denemesini INVALID_KNOCK<\/code> zincirine y\u00f6nlendirmeliyiz. Bu, yanl\u0131\u015f porta vuran veya do\u011fru s\u0131ray\u0131 takip etmeyen IP’leri temizler.<\/p>\n
# Knocking portlar\u0131na (10001, 10002, 10003) gelen ancak kurallarla e\u015fle\u015fmeyen veya\n
di\u011fer t\u00fcm istenmeyen ba\u011flant\u0131 denemelerini INVALID_KNOCK zincirine y\u00f6nlendir.<\/h2>\n
Bu kural en sonda olmal\u0131.<\/h2>\nsudo iptables -A INPUT -j INVALID_KNOCK<\/code><\/pre>\n
Bu kural, INPUT<\/code> zincirindeki di\u011fer t\u00fcm kurallardan sonra gelmelidir.<\/p>\n
T\u00fcm Iptables Kurallar\u0131 (\u00d6zet):<\/strong>
\n\u015eimdi t\u00fcm kurallar\u0131 mant\u0131ksal bir s\u0131raya koyal\u0131m. Bu s\u0131rayla komutlar\u0131 \u00e7al\u0131\u015ft\u0131rman\u0131z gerekmektedir.<\/p>\n
# Mevcut kurallar\u0131 temizle (Dikkatli olun, kendinizi d\u0131\u015far\u0131da b\u0131rakabilirsiniz!)\n
sudo iptables -F<\/h2>\n
sudo iptables -X<\/h2>\n\n
Varsay\u0131lan politikalar\u0131 ayarla<\/h2>\nsudo iptables -P INPUT DROP\nsudo iptables -P FORWARD DROP\nsudo iptables -P OUTPUT ACCEPT\n\n
Gerekli temel izinler<\/h2>\nsudo iptables -A INPUT -i lo -j ACCEPT\nsudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n\n
\u00d6zel zincirleri olu\u015ftur<\/h2>\nsudo iptables -N KNOCKING_STAGE_1\nsudo iptables -N KNOCKING_STAGE_2\nsudo iptables -N KNOCKING_STAGE_3\nsudo iptables -N ACCESS_GRANTED\nsudo iptables -N INVALID_KNOCK\n\n
INVALID_KNOCK zinciri: Hatal\u0131 denemelerde t\u00fcm listelerden IP'yi kald\u0131r<\/h2>\nsudo iptables -A INVALID_KNOCK -m recent --name KNOCK_1 --remove -j LOG --log-prefix \"INVALID_KNOCK: KNOCK_1 removed \"\nsudo iptables -A INVALID_KNOCK -m recent --name KNOCK_2 --remove -j LOG --log-prefix \"INVALID_KNOCK: KNOCK_2 removed \"\nsudo iptables -A INVALID_KNOCK -m recent --name KNOCK_3 --remove -j LOG --log-prefix \"INVALID_KNOCK: KNOCK_3 removed \"\nsudo iptables -A INVALID_KNOCK -m recent --name ACCESS --remove -j LOG --log-prefix \"INVALID_KNOCK: ACCESS removed \"\nsudo iptables -A INVALID_KNOCK -j DROP\n\n
ACCESS_GRANTED zinciri: SSH eri\u015fimi verir ve ACCESS listesine ekler<\/h2>\nsudo iptables -A ACCESS_GRANTED -m recent --name ACCESS --set -j ACCEPT\nsudo iptables -A ACCESS_GRANTED -p tcp --dport 22 -j ACCEPT # SSH portu\n
sudo iptables -A ACCESS_GRANTED -p tcp --dport 80 -j ACCEPT # Di\u011fer servisler<\/h2>\n
sudo iptables -A ACCESS_GRANTED -p tcp --dport 443 -j ACCEPT # Di\u011fer servisler<\/h2>\nsudo iptables -A ACCESS_GRANTED -j RETURN # Geri d\u00f6n\n\n
Knocking a\u015famalar\u0131<\/h2>\n
1. Knock: TCP 10001<\/h2>\nsudo iptables -A INPUT -p tcp --dport 10001 -m recent --name KNOCK_1 --set -j KNOCKING_STAGE_1\nsudo iptables -A KNOCKING_STAGE_1 -j DROP\n\n
2. Knock: UDP 10002 (KNOCK_1 listesinde olmal\u0131)<\/h2>\nsudo iptables -A INPUT -p udp --dport 10002 -m recent --name KNOCK_1 --rcheck --seconds 15 --hitcount 1 \\\n  -m recent --name KNOCK_2 --set -j KNOCKING_STAGE_2\nsudo iptables -A KNOCKING_STAGE_2 -m recent --name KNOCK_1 --remove -j DROP\n\n
3. Knock: TCP 10003 (KNOCK_2 listesinde olmal\u0131)<\/h2>\nsudo iptables -A INPUT -p tcp --dport 10003 -m recent --name KNOCK_2 --rcheck --seconds 15 --hitcount 1 \\\n  -m recent --name ACCESS --set -j KNOCKING_STAGE_3\nsudo iptables -A KNOCKING_STAGE_3 -m recent --name KNOCK_2 --remove -j ACCESS_GRANTED\n\n
ACCESS listesindeki IP'lerin SSH eri\u015fimine izin ver (60 saniye zaman a\u015f\u0131m\u0131 ile)<\/h2>\nsudo iptables -A INPUT -m recent --name ACCESS --rcheck --seconds 60 --update -j ACCEPT\n\n
Di\u011fer a\u00e7\u0131k olmas\u0131 gereken portlar (\u00f6rne\u011fin DNS sorgular\u0131 i\u00e7in UDP 53)<\/h2>\n
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT<\/h2>\n\n
Hatal\u0131 knock denemelerini yakala ve INVALID_KNOCK zincirine y\u00f6nlendir<\/h2>\nsudo iptables -A INPUT -j INVALID_KNOCK<\/code><\/pre>\n
Bu komutlar\u0131 \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra sudo iptables -L -n -v<\/code> komutu ile kurallar\u0131 kontrol edebilirsiniz.<\/p>\n
Iptables Kurallar\u0131n\u0131 Kaydetme<\/h4>\n
iptables<\/code> kurallar\u0131 varsay\u0131lan olarak kal\u0131c\u0131 de\u011fildir. Sunucu yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda kaybolurlar. Kurallar\u0131 kal\u0131c\u0131 hale getirmek i\u00e7in kaydetmeniz gerekir. Ubuntu’da netfilter-persistent<\/code> paketi bu i\u015fi yapar.<\/p>\n
sudo apt update\nsudo apt install netfilter-persistent iptables-persistent -y<\/code><\/pre>\n
Kurulum s\u0131ras\u0131nda mevcut kurallar\u0131 kaydetmek isteyip istemedi\u011finiz sorulacakt\u0131r. “Evet” yan\u0131t\u0131n\u0131 verin. E\u011fer daha sonra kurallar\u0131 g\u00fcncellerseniz, manuel olarak kaydetmeniz gerekir:<\/p>\n
sudo netfilter-persistent save<\/code><\/pre>\n
Port Knocking Uygulamas\u0131 (Client Taraf\u0131)<\/h3>\n
Sunucu taraf\u0131nda kurallar\u0131 yap\u0131land\u0131rd\u0131\u011f\u0131m\u0131za g\u00f6re, istemci taraf\u0131ndan nas\u0131l “kap\u0131 \u00e7alaca\u011f\u0131m\u0131z\u0131” \u00f6\u011frenmemiz gerekiyor. Bunun i\u00e7in nmap<\/code> veya netcat<\/code> gibi basit ara\u00e7lar\u0131 kullanabiliriz.<\/p>\n
1. Nmap Kullanarak Knocking:<\/strong>
\nnmap<\/code>, port tarama i\u00e7in pop\u00fcler bir ara\u00e7t\u0131r, ancak ayn\u0131 zamanda knocking i\u00e7in de kullan\u0131labilir.<\/p>\n
nmap -Pn --host-timeout 200 --max-retries 0 -p 10001,10002U,10003 YOUR_VPS_IP<\/code><\/pre>\n
*   -Pn<\/code>: Host discovery’yi atla (ping atma).
\n*   --host-timeout 200<\/code>: Her bir host i\u00e7in maksimum bekleme s\u00fcresi 200ms.
\n*   --max-retries 0<\/code>: Her porta sadece bir deneme yap.
\n*   -p 10001,10002U,10003<\/code>: Belirli portlar\u0131 hedefle. U<\/code> eki UDP portunu belirtir (10002U = UDP 10002).<\/p>\n
Bu komut, belirtilen portlara s\u0131rayla SYN paketleri g\u00f6nderir. iptables<\/code> bu paketleri yakalayacak ve kurallar\u0131 i\u015fleyecektir.<\/p>\n
2. Netcat (nc) Kullanarak Knocking:<\/strong>
\nnetcat<\/code> daha basit bir ara\u00e7t\u0131r ve her bir knock i\u00e7in ayr\u0131 ayr\u0131 komut \u00e7al\u0131\u015ft\u0131rman\u0131z gerekir.<\/p>\n
# 1. Knock (TCP 10001)\nnc -vz YOUR_VPS_IP 10001 -w 1\n\n
2. Knock (UDP 10002)<\/h2>\nnc -vu YOUR_VPS_IP 10002 -w 1\n\n
3. Knock (TCP 10003)<\/h2>\nnc -vz YOUR_VPS_IP 10003 -w 1<\/code><\/pre>\n
*   -v<\/code>: Ayr\u0131nt\u0131l\u0131 \u00e7\u0131kt\u0131.
\n*   -z<\/code>: Tarama modu (veri g\u00f6ndermeden sadece ba\u011flant\u0131 denemesi).
\n*   -w 1<\/code>: 1 saniye zaman a\u015f\u0131m\u0131.
\n*   -u<\/code>: UDP i\u00e7in.<\/p>\n
Bu komutlar\u0131 s\u0131rayla \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra, 60 saniye i\u00e7inde SSH ba\u011flant\u0131s\u0131 kurmay\u0131 deneyebilirsiniz:<\/p>\n
ssh user@YOUR_VPS_IP<\/code><\/pre>\n
E\u011fer ba\u011flant\u0131 ba\u015far\u0131l\u0131 olursa, port knocking d\u00fczg\u00fcn \u00e7al\u0131\u015f\u0131yor demektir.<\/p>\n
Otomatik Knocking Beti\u011fi (Bash):<\/strong>
\nHer seferinde manuel olarak komut yazmak yerine, k\u00fc\u00e7\u00fck bir betik olu\u015fturabilirsiniz:<\/p>\n
#!\/bin\/bash\n\nVPS_IP=\"YOUR_VPS_IP\"\nKNOCK_PORTS=\"10001 10002 10003\" # TCP UDP TCP\n\necho \"Port knocking ba\u015flat\u0131l\u0131yor...\"\n\n
Knock 1 (TCP)<\/h2>\necho \"Knocking TCP port 10001...\"\nnc -vz $VPS_IP 10001 -w 1 > \/dev\/null 2>&1\n\n
Knock 2 (UDP)<\/h2>\necho \"Knocking UDP port 10002...\"\nnc -vu $VPS_IP 10002 -w 1 > \/dev\/null 2>&1\n\n
Knock 3 (TCP)<\/h2>\necho \"Knocking TCP port 10003...\"\nnc -vz $VPS_IP 10003 -w 1 > \/dev\/null 2>&1\n\necho \"Knocking tamamland\u0131. \u015eimdi SSH ile ba\u011flanmay\u0131 deneyebilirsiniz.\"\nssh user@$VPS_IP<\/code><\/pre>\n
Bu beti\u011fi bir dosyaya kaydedip (knock.sh<\/code> gibi), chmod +x knock.sh<\/code> ile \u00e7al\u0131\u015ft\u0131r\u0131labilir hale getirdikten sonra .\/knock.sh<\/code> ile kullanabilirsiniz.<\/p>\n
G\u00fcvenlik Hususlar\u0131 ve En \u0130yi Uygulamalar<\/h3>\n
Port knocking, g\u00fc\u00e7l\u00fc bir g\u00fcvenlik katman\u0131 sunsa da, baz\u0131 hususlar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurmak ve en iyi uygulamalar\u0131 takip etmek \u00f6nemlidir.<\/p>\n
1.  Port Dizisi Karma\u015f\u0131kl\u0131\u011f\u0131:<\/strong> Knocking i\u00e7in kullan\u0131lan portlar tahmin edilmesi zor, standart olmayan portlar olmal\u0131d\u0131r. \u00d6rne\u011fin, 10001, 10002 gibi s\u0131ral\u0131 portlar yerine 4567, 23456, 1234 gibi rastgele portlar se\u00e7in. Protokol (TCP\/UDP) s\u0131ras\u0131n\u0131 da kar\u0131\u015ft\u0131r\u0131n.
\n2.  Knock Dizisi Uzunlu\u011fu:<\/strong> Daha uzun bir knock dizisi (4-5 port) daha fazla g\u00fcvenlik sa\u011flar. Her bir a\u015fama, tahmin etme olas\u0131l\u0131\u011f\u0131n\u0131 katlanarak azalt\u0131r.
\n3.  Zaman A\u015f\u0131m\u0131 (Timeout) Ayarlar\u0131:<\/strong> recent<\/code> mod\u00fcl\u00fcndeki --seconds<\/code> parametresi, bir knock a\u015famas\u0131 i\u00e7in IP’nin listede ne kadar kalaca\u011f\u0131n\u0131 belirler. Bu s\u00fcreyi \u00e7ok k\u0131sa tutmak, kullan\u0131c\u0131 deneyimini k\u00f6t\u00fcle\u015ftirebilir; \u00e7ok uzun tutmak ise sald\u0131rganlara daha fazla zaman tan\u0131yabilir. Genellikle 10-30 saniye aras\u0131 uygun bir aral\u0131kt\u0131r. Eri\u015fim izni i\u00e7in belirlenen s\u00fcre de (\u00f6rne\u011fin 60 saniye) dikkatlice se\u00e7ilmelidir.
\n4.  G\u00fcnl\u00fckleme (Logging):<\/strong> INVALID_KNOCK<\/code> zincirindeki LOG<\/code> kurallar\u0131 sayesinde ba\u015far\u0131s\u0131z knock denemelerini izleyebilirsiniz. Bu, potansiyel sald\u0131r\u0131 giri\u015fimlerini veya yanl\u0131\u015f yap\u0131land\u0131rmalar\u0131 tespit etmenize yard\u0131mc\u0131 olur. \/var\/log\/syslog<\/code> veya \/var\/log\/kern.log<\/code> dosyalar\u0131n\u0131 d\u00fczenli olarak kontrol edin.
\n5.  DDoS Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Diren\u00e7:<\/strong> Port knocking, brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 etkilidir ancak yo\u011fun bir DDoS (Distributed Denial of Service) sald\u0131r\u0131s\u0131na kar\u015f\u0131 tek ba\u015f\u0131na yeterli de\u011fildir. iptables<\/code>‘\u0131n recent<\/code> mod\u00fcl\u00fc, belirli bir IP’den gelen \u00e7ok say\u0131da denemeyi bir dereceye kadar s\u0131n\u0131rlayabilir, ancak b\u00fcy\u00fck \u00f6l\u00e7ekli bir DDoS, sunucunuzu yine de yorabilir. DDoS korumas\u0131 i\u00e7in ek \u00e7\u00f6z\u00fcmler (CDN, \u00f6zel donan\u0131m\/yaz\u0131l\u0131m) gerekebilir.
\n6.  Tek Y\u00f6nl\u00fc Knocking:<\/strong> Genellikle sadece SYN (TCP) veya UDP paketleri kullan\u0131larak knocking yap\u0131l\u0131r. Sunucunun bu portlara yan\u0131t vermemesi (yani DROP<\/code> hedefi kullan\u0131lmas\u0131), portlar\u0131n d\u0131\u015far\u0131dan kapal\u0131 g\u00f6r\u00fcnmesini sa\u011flar ve bilgi s\u0131zmas\u0131n\u0131 \u00f6nler.
\n7.  Servislerin G\u00fcvenli\u011fi:<\/strong> Port knocking, bir ek g\u00fcvenlik katman\u0131d\u0131r. As\u0131l servislerinizin (SSH, web sunucusu vb.) kendilerinin de g\u00fcvenli oldu\u011fundan emin olun. G\u00fc\u00e7l\u00fc parolalar, SSH anahtar tabanl\u0131 kimlik do\u011frulama, fail2ban<\/code> gibi ara\u00e7lar hala gereklidir.
\n8.  IP Adresi K\u0131s\u0131tlamalar\u0131:<\/strong> M\u00fcmk\u00fcnse, port knocking’i sadece belirli g\u00fcvenilir IP adreslerinden (statik IP’niz varsa) gelen ba\u011flant\u0131lara izin verecek \u015fekilde yap\u0131land\u0131rabilirsiniz. Bu, genel g\u00fcvenlik seviyesini daha da art\u0131r\u0131r.
\n9.  Kurtarma Plan\u0131:<\/strong> Yanl\u0131\u015f yap\u0131land\u0131rma durumunda kendinizi sunucudan kilitleme riski her zaman vard\u0131r. Bu nedenle, VPS sa\u011flay\u0131c\u0131n\u0131z\u0131n web tabanl\u0131 konsol eri\u015fimine (VNC veya benzeri) sahip oldu\u011funuzdan emin olun. Bu, kritik bir g\u00fcvenlik \u00f6nlemidir.
\n10. Test Etme:<\/strong> Kurallar\u0131 uygulamadan \u00f6nce veya uygulad\u0131ktan hemen sonra, farkl\u0131 senaryolar\u0131 (do\u011fru knock, yanl\u0131\u015f knock, eksik knock, zaman a\u015f\u0131m\u0131) test ederek sistemin beklendi\u011fi gibi \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun.<\/p>\n
Avantajlar ve Dezavantajlar<\/h3>\n
Avantajlar:<\/h4>\n
1.  Y\u00fcksek G\u00fcvenlik:<\/strong> A\u00e7\u0131k portlar\u0131 gizleyerek sald\u0131r\u0131 y\u00fczeyini \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r. Otomatik taray\u0131c\u0131lar ve botlar i\u00e7in sunucunuz “\u00f6l\u00fc” g\u00f6r\u00fcn\u00fcr.
\n2.  Brute-Force Korumas\u0131:<\/strong> SSH gibi servislere y\u00f6nelik brute-force sald\u0131r\u0131lar\u0131n\u0131 daha ba\u015flamadan engeller.
\n3.  Kaynak Verimlili\u011fi:<\/strong> iptables<\/code>‘\u0131n yerle\u015fik recent<\/code> mod\u00fcl\u00fcn\u00fc kulland\u0131\u011f\u0131 i\u00e7in ek bir daemon \u00e7al\u0131\u015ft\u0131rmaya gerek kalmaz, bu da sistem kaynaklar\u0131n\u0131 minimal d\u00fczeyde t\u00fcketir.
\n4.  Esneklik:<\/strong> iptables<\/code> kurallar\u0131 sayesinde, knocking dizisini, zaman a\u015f\u0131mlar\u0131n\u0131 ve eri\u015fim verilecek servisleri tamamen kendi ihtiya\u00e7lar\u0131n\u0131za g\u00f6re \u00f6zelle\u015ftirebilirsiniz.
\n5.  Obscurity (Gizlilik):<\/strong> G\u00fcvenli\u011fi gizlilikle art\u0131r\u0131r. Bir sald\u0131rgan, hangi portlar\u0131n a\u00e7\u0131lmas\u0131 gerekti\u011fini veya hangi s\u0131rayla vurulmas\u0131 gerekti\u011fini bilmedi\u011fi s\u00fcrece eri\u015fim sa\u011flayamaz.<\/p>\n
Dezavantajlar:<\/h4>\n
1.  Karma\u015f\u0131k Yap\u0131land\u0131rma:<\/strong> iptables<\/code> kurallar\u0131, \u00f6zellikle recent<\/code> mod\u00fcl\u00fc ile birlikte kullan\u0131ld\u0131\u011f\u0131nda, do\u011fru bir \u015fekilde yap\u0131land\u0131rmak ve hata ay\u0131klamak karma\u015f\u0131k olabilir. Yanl\u0131\u015f bir kural, kendinizi sunucudan kilitlemenize neden olabilir.
\n2.  Eri\u015fim Sorunlar\u0131:<\/strong> E\u011fer knocking dizisini unutursan\u0131z veya yanl\u0131\u015f girerseniz, sunucunuza eri\u015fim sa\u011flayamayabilirsiniz. Bu durum, \u00f6zellikle acil durumlarda sorun yaratabilir.
\n3.  Paket Yakalama (Packet Sniffing) Zafiyeti:<\/strong> E\u011fer knocking dizisi \u015fifrelenmemi\u015f bir a\u011f \u00fczerinden g\u00f6nderilirse, k\u00f6t\u00fc niyetli bir ki\u015fi paket yakalama (packet sniffing) yoluyla bu diziyi \u00f6\u011frenebilir. Bu nedenle, knocking dizisini m\u00fcmk\u00fcnse g\u00fcvenli a\u011flar \u00fczerinden kullanmak veya ek g\u00fcvenlik \u00f6nlemleri almak \u00f6nemlidir.
\n4.  DDoS’a Tam Diren\u00e7sizlik:<\/strong> Port knocking, hedefli DDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 tam bir koruma sa\u011flamaz. Yo\u011fun trafik, iptables<\/code> kurallar\u0131n\u0131 i\u015fleyen sunucuyu yine de yorabilir.
\n5.  \u0130stemci Taraf\u0131 Ara\u00e7 Gereksinimi:<\/strong> Sunucuya eri\u015fmek i\u00e7in istemci taraf\u0131nda belirli ara\u00e7lar (nmap, netcat veya \u00f6zel bir betik) kullanman\u0131z gerekir. Bu, mobil cihazlardan veya k\u0131s\u0131tl\u0131 ortamlardan eri\u015fimi zorla\u015ft\u0131rabilir.
\n6.  Kullan\u0131c\u0131 Deneyimi:<\/strong> Her ba\u011flant\u0131dan \u00f6nce knocking yapmak, \u00f6zellikle s\u0131k s\u0131k ba\u011flant\u0131 kuran kullan\u0131c\u0131lar i\u00e7in ek bir ad\u0131m ve potansiyel bir gecikme anlam\u0131na gelir.<\/p>\n
Bu avantaj ve dezavantajlar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurarak, port knocking’in sizin g\u00fcvenlik modelinize uygun olup olmad\u0131\u011f\u0131na karar vermelisiniz. Genellikle, di\u011fer g\u00fcvenlik \u00f6nlemleriyle birlikte kullan\u0131ld\u0131\u011f\u0131nda \u00e7ok g\u00fc\u00e7l\u00fc bir katman sa\u011flar.<\/p>\n
Sonu\u00e7<\/h3>\n
Bu makalede, Ubuntu VPS’inizde sadece iptables<\/code> ve recent<\/code> mod\u00fcl\u00fcn\u00fc kullanarak port knocking’i nas\u0131l yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 ayr\u0131nt\u0131l\u0131 bir \u015fekilde inceledik. Port knocking, sunucunuzun a\u00e7\u0131k portlar\u0131n\u0131 d\u0131\u015f d\u00fcnyaya kar\u015f\u0131 gizleyerek, otomatik taray\u0131c\u0131lardan ve brute-force sald\u0131r\u0131lar\u0131ndan korunmak i\u00e7in olduk\u00e7a etkili bir y\u00f6ntemdir.<\/p>\n
Ad\u0131m ad\u0131m yap\u0131land\u0131rma s\u00fcrecini takip ederek, \u00f6zel iptables<\/code> zincirleri olu\u015fturduk, knocking a\u015famalar\u0131n\u0131 tan\u0131mlad\u0131k ve recent<\/code> mod\u00fcl\u00fcn\u00fcn set<\/code>, rcheck<\/code>, update<\/code> ve remove<\/code> parametrelerini kullanarak karma\u015f\u0131k bir eri\u015fim kontrol mekanizmas\u0131 kurduk. Ayr\u0131ca, istemci taraf\u0131ndan nmap<\/code> ve netcat<\/code> gibi ara\u00e7larla knocking i\u015flemini nas\u0131l ger\u00e7ekle\u015ftirece\u011finizi ve bu s\u00fcreci otomatikle\u015ftirmek i\u00e7in basit bir betik \u00f6rne\u011fi sunduk.<\/p>\n
Unutulmamal\u0131d\u0131r ki, port knocking tek ba\u015f\u0131na bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc de\u011fildir, ancak mevcut g\u00fcvenlik \u00f6nlemlerinize (SSH anahtarlar\u0131, g\u00fc\u00e7l\u00fc parolalar, fail2ban<\/code> vb.) g\u00fc\u00e7l\u00fc bir ek katman sa\u011flar. Do\u011fru yap\u0131land\u0131rma, karma\u015f\u0131k bir knock dizisi, uygun zaman a\u015f\u0131m\u0131 ayarlar\u0131 ve d\u00fczenli g\u00fcnl\u00fck denetimi ile sunucunuzun g\u00fcvenli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rabilirsiniz. Her zaman oldu\u011fu gibi, g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 de\u011fi\u015ftirirken dikkatli olun ve kendinizi sunucudan kilitlememek i\u00e7in bir kurtarma plan\u0131n\u0131z oldu\u011fundan emin olun. Bu rehber, VPS’inizin g\u00fcvenli\u011fini bir \u00fcst seviyeye ta\u015f\u0131mak i\u00e7in size sa\u011flam bir temel sunmaktad\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Ubuntu VPS’te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?\nGiri\u015f\nG\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda, sunucu g\u00fcvenli\u011fi her z","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-30859","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nUbuntu VPS'te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ubuntu VPS'te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?\" \/>\n<meta property=\"og:description\" content=\"Ubuntu VPS'te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? Giri\u015f G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda, sunucu g\u00fcvenli\u011fi her z\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-02T20:41:40+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"26 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Ubuntu VPS’te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?\",\"datePublished\":\"2025-10-02T20:41:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/\"},\"wordCount\":3794,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/\",\"name\":\"Ubuntu VPS'te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-02T20:41:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ubuntu VPS’te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Ubuntu VPS'te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/","og_locale":"tr_TR","og_type":"article","og_title":"Ubuntu VPS'te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?","og_description":"Ubuntu VPS'te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? Giri\u015f G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda, sunucu g\u00fcvenli\u011fi her z","og_url":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-02T20:41:40+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"26 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Ubuntu VPS’te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?","datePublished":"2025-10-02T20:41:40+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/"},"wordCount":3794,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/","url":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/","name":"Ubuntu VPS'te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-02T20:41:40+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-vpste-sadece-iptables-kullanarak-port-knocking-nasil-yapilandirilir\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Ubuntu VPS’te Sadece Iptables Kullanarak Port Knocking Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30859","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=30859"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30859\/revisions"}],"predecessor-version":[{"id":30860,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/30859\/revisions\/30860"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=30859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=30859"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=30859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}