SSH_P=4224

KN_SSH_P1=53486
KN_SSH_P2=23597
KN_SSH_P3=47354

ipt_create_chain knock_ssh_g1
ipt_create_chain knock_ssh_g2
ipt_create_chain knock_ssh_g3
ipt_create_chain knock_ssh_pass
ipt_create_chain knock_ssh_clear

if [ "$MODE" != "start" ]; then
	ipt -F knock_ssh_g1
	ipt -F knock_ssh_g2
	ipt -F knock_ssh_g3
	ipt -F knock_ssh_pass
	ipt -F knock_ssh_clear
fi

# check gates
ipt -A in_inet -p tcp --dport ${KN_SSH_P1} -j knock_ssh_g1
ipt -A in_inet -p tcp --dport ${KN_SSH_P2} -m recent --rcheck --seconds 5 --name knock_ssh_a1 -j knock_ssh_g2
ipt -A in_inet -p tcp --dport ${KN_SSH_P3} -m recent --rcheck --seconds 5 --name knock_ssh_a2 -j knock_ssh_g3
ipt -A in_inet -p tcp --dport ${SSH_P} -m recent --rcheck --seconds 30 --name knock_ssh_a3 -j knock_ssh_pass
# reset state if any other port was hit
ipt -A in_inet -m state ! --state ESTABLISHED,RELATED -m recent --rcheck --name knock_ssh_a1 -j knock_ssh_clear
ipt -A in_inet -m state ! --state ESTABLISHED,RELATED -m recent --rcheck --name knock_ssh_a2 -j knock_ssh_clear
ipt -A in_inet -m state ! --state ESTABLISHED,RELATED -m recent --rcheck --name knock_ssh_a3 -j knock_ssh_clear

# gate 1
ipt -A knock_ssh_g2 -m recent --name knock_ssh_a2 --remove
ipt -A knock_ssh_g2 -m recent --name knock_ssh_a3 --remove
ipt -A knock_ssh_g1 -m recent --name knock_ssh_a1 --set -j DROP

# gate 2
ipt -A knock_ssh_g2 -m recent --name knock_ssh_a1 --remove
ipt -A knock_ssh_g2 -m recent --name knock_ssh_a3 --remove
ipt -A knock_ssh_g2 -m recent --name knock_ssh_a2 --set -j DROP

# gate 3
ipt -A knock_ssh_g3 -m recent --name knock_ssh_a1 --remove
ipt -A knock_ssh_g3 -m recent --name knock_ssh_a2 --remove
ipt -A knock_ssh_g3 -m recent --name knock_ssh_a3 --set -j DROP

# pass
ipt -A knock_ssh_pass -m recent --name knock_ssh_a1 --remove
ipt -A knock_ssh_pass -m recent --name knock_ssh_a2 --remove
ipt -A knock_ssh_pass -m recent --name knock_ssh_a3 --remove
ipt -A knock_ssh_pass -j ACCEPT

# clear
ipt -A knock_ssh_clear -m recent --name knock_ssh_a1 --remove
ipt -A knock_ssh_clear -m recent --name knock_ssh_a2 --remove
ipt -A knock_ssh_clear -m recent --name knock_ssh_a3 --remove
ipt -A knock_ssh_clear -j RETURN