DOCSEARCHbyAlgolia
Submit Docs

fn-knock Documentation

website·Indexed 31 days ago

https://docs.fnknock.cn

Documentation for fn-knock, a gateway service providing secure access, subdomain routing, and tunnel publishing. It includes deployment guides for Docker, Linux, Windows, macOS, OpenWrt, and Synology DSM 7, as well as integrations with Cloudflare Tunnel, Alibaba Cloud ESA, and Tencent Cloud EdgeOne.

Tokens
163.3K
Snippets
200
Records
1K
Agent score
50%

What's inside fn-knock

  1. Overview of Gateway Visibility

    Gateway Visibility restricts access to the gateway entry point by filtering requests based on geographic region or CIDR ranges. It acts as a preliminary filter before a request reaches an application mapping. It is intended for limiting access to known regions, company egress addresses, or VPN networks. It is not a replacement for sign-in authentication or a full host firewall.

  2. Overview of Subdomain Routing in fn-knock

    Subdomain mapping routes multiple domains to local web services based on the HTTP Host header. It is the default routing method for new deployments and supports two network topologies:

    1. Subdomain mode: Domains resolve directly to a reachable public entry point.
    2. Reverse proxy mode → Subdomain mapping: Requests are carried to the gateway via FRP or Cloudflared.

    Both topologies use a single shared gateway and a dedicated sign-in entry point (e.g., auth.example.com) for authentication across all application Hosts (e.g., nas.example.com, alist.example.com).

  3. Overview of fn-knock Intranet Penetration via Subdomain Routing

    Intranet penetration via subdomain routing is designed for environments without public inbound access or port forwarding capabilities. Public traffic is routed through a tunnel (such as FRP or Cloudflared) to the fn-knock gateway, which then forwards the traffic to internal business services based on the Host header.

    Key Details:

    • Routing Method: Distinguished by Host.
    • Recommended Strategy: Login-first.
    • Configuration Path: System Settings $\rightarrow$ Mode $\rightarrow$ Intranet Penetration $\rightarrow$ Subdomain Mapping.
    • Default Gateway Port: 7999 (for FPK, Docker, OpenWrt, Linux, macOS, Synology DSM 7).

  4. Overview of fn-knock Cloudflared Managed Mode

    fn-knock provides a managed mode for Cloudflared tunnels where the application automatically discovers Zones and Accounts, creates or connects to Tunnels, maintains wildcard DNS and Ingress rules, and manages the Cloudflared process using a Tunnel Token. This eliminates the need to manually add Public Hostnames in the Cloudflare dashboard. It is recommended to use the 'Intranet Penetration → Subdomain Mapping' (内网穿透 → 子域映射) mode for new deployments to allow fn-knock to distribute requests based on the Host header (e.g., auth.example.com, nas.example.com).

  5. Overview of Subdomain Advanced Authentication

    Advanced Authentication allows you to add conditional bypass rules to a business Host that has 'Require Login' enabled. It supports HTTP/HTTPS reverse proxies and single file or directory responses.

    When a request matches a rule, it is granted a one-time bypass. If the client supports cookies, the system returns a short-term probe; once the client returns this probe in subsequent requests, a persistent temporary credential for that specific Host is created.

    Key Distinctions:

    • It is an independent bypass path, not an additional layer of security on top of existing login rules.
    • Temporary credentials are NOT system logins: they do not create login sessions, grant IP authorization, or allow access to other Hosts.

  6. Overview of Knock security gateway

    Knock is a security gateway that acts as a unified entry point for public access to home services (like NAS, photo galleries, and downloaders). Instead of exposing multiple individual service ports to the internet, Knock intercepts all requests, requires the visitor to authenticate, and only forwards the request to the internal service after verifying permissions. This prevents attackers from directly interacting with potentially vulnerable service login pages or APIs.

  7. Overview of IP Location Services in fn-knock

    The IP Location service provides location and ISP data for sessions, whitelists, WAF logs, event centers, scanner interception, SSH security, and gateway visibility. It consists of two independently configurable data sources:

    1. IP Identification Library: Converts a single public IP into country, province, city, and ISP information.
    2. CIDR Address Library: Provides a list of provinces/cities and converts regional or ISP conditions into CIDR rules for use in security policies.

    Note: Location results are for auxiliary judgment and should not be the sole authentication condition for high-risk entry points.

  8. Overview of fn-knock Direct Mode for raw port access

    Direct Mode is used when a device has a public inbound IP and requires direct access to raw TCP/UDP ports (e.g., SSH, Remote Desktop). Instead of a proxy, fn-knock manages the host firewall to temporarily open the protected ports for the visitor's current exit IP after they successfully authenticate via the fn-knock gateway (default port 7999).

  9. Overview of fn-knock Web Application Firewall (WAF)

    The WAF inspects HTTP requests passing through fn-knock to log or block suspicious content based on rules. It uses Coraza for rule loading. Note that WAF only protects traffic passing through the gateway; it cannot protect ports that bypass the gateway, TCP/UDP traffic, or host services. Security events can be monitored under Request Analysis → WAF logs.

  10. Overview of IP Geolocation services in fn-knock

    fn-knock uses two independently configurable data sources for geolocation. These services provide data for sessions, allowlists, WAF logs, the Event Center, automated scan blocking, SSH hardening, and Gateway Visibility.

    1. IP lookup database: Converts a single public IP into country, province/city, ISP, and other related information.
    2. CIDR database: Provides province and city lists and converts region/carrier conditions into CIDRs used by rules.

    Note: Geolocation results are supporting evidence and should not be the sole authentication condition for high-risk entry points.

  11. Overview of Protocol Mapping for non-HTTP services

    Protocol Mapping allows fn-knock to add TCP/UDP listening ports for non-HTTP services such as SSH, databases, and DNS. Unlike Web services, it does not read domain Host headers or URL paths; it simply forwards the byte stream from a public port to a specific host:port destination. This feature is a supplement to the 'Subdomain Mode' for public direct connections.

  12. Overview of QQ Quick Sign-in in fn-knock

    QQ Quick Sign-in allows a user to bind a QQ account to a specific TOTP credential. Once bound, the user can authenticate using QQ on the sign-in page. The QQ identity inherits the service scope and session policy of the associated TOTP credential; it is not a separate identity. fn-knock provides a built-in integration, meaning users do not need to register an application on the QQ Open Platform or manually configure Client IDs, Secrets, or callback addresses.