fwknop - Software Defined Perimeter Client and Gateway Components
This project is an open source implementation of the client and gateway components for a Software Defined Perimeter (SDP). This code has been tested on *nix type systems only.
For more information on SDP, see the following sites:
This project is a fork of the fwknop project. fwknop originally implemented an authorization scheme known as Single Packet Authorization (SPA) for strong service concealment. Because SPA later became the basis for SDP, fwknop was forked and built upon to implement the additional features required to create an SDP system. The only component of SDP not included in this repo is the controller, which is also freely available at:
A manual for installation and configuration of SDP can be found here:
A comprehensive tutorial on SPA (and how fwknop used to work) can be found here:
The fwknop project is released as open source software under the terms of the GNU General Public License (GPL v2).
This distribution uses GNU autoconf for setting up the build. Please see
INSTALL file for the general basics on using autoconf.
There are some "configure" options that are specific to fwknop. They are (extracted from ./configure --help):
--disable-client Do not build the fwknop client component. The default is to build the client. --disable-server Do not build the fwknop server component. The default is to build the server. --with-gpgme support for gpg encryption using libgpgme [default=check] --with-gpgme-prefix=PFX prefix where GPGME is installed (optional) --with-gpg=/path/to/gpg Specify path to the gpg executable that gpgme will use [default=check path] --with-firewalld=/path/to/firewalld Specify path to the firewalld executable [default=check path] --with-iptables=/path/to/iptables Specify path to the iptables executable [default=check path] --with-ipfw=/path/to/ipfw Specify path to the ipfw executable [default=check path] --with-pf=/path/to/pfctl Specify path to the pf executable [default=check path] --with-ipf=/path/to/ipf Specify path to the ipf executable [default=check path] Examples: ./configure --disable-client --with-firewalld=/bin/firewall-cmd ./configure --disable-client --with-iptables=/sbin/iptables --with-firewalld=no