sa-port-knock

custom_knock_default_props:
    - {regexp: "^[#]?START_KNOCKD=*", line: "START_KNOCKD=1"}
    - {regexp: "^[#]?KNOCKD_OPTS=*", line: '#KNOCKD_OPTS="-i eth1"'}

custom_knock_ports:
  - {
    name: "ssh",
    sequence: "15000, 16000, 17000",
    seq_timeout: 5,
    port: 22,
    tcpflags: syn,
    cmd_timeout: 10
    }
  - {
    name: "pptp",
    sequence: "15001, 16001, 17001",
    seq_timeout: 5,
    port: 1723,
    tcpflags: syn,
    cmd_timeout: 1000
    }

     - {
         role: "sa-port-knock",
         knock_ports: "{{custom_knock_ports}}"
       }

     - {
         role: "sa-port-knock",
         knock_ports: "{{custom_knock_ports}}",
         knock_default_props: "{{custom_knock_default_props}}",
         knock_firewall_type: ufw # ufw | iptables,
         option_close_hardened_ports: true        
       }

ufw_rules_allow_from_hosts:
  - {
      port: 22,
      proto: tcp,
      address: 192.168.0.264
    }