> Maybe it's technically not port knocking anymore, but it's the same idea. At that point, it’s equivalent to a point-to-point VPN, which is the same as IPSec

> Maybe it's technically not port knocking anymore, but it's the same idea. At that point, it’s equivalent to a point-to-point VPN, which is the same as IPSec transport mode. Which is what you ought to be using instead of port knocking, if your threat model includes 0-day vulnerabilities in public-facing services like SSH.