I use a simplified one port "port knocker" with iptables setup such that an ascending or descending linear port-scan will leave the ssh port closed upon complet

I use a simplified one port "port knocker" with iptables setup such that an ascending or descending linear port-scan will leave the ssh port closed upon completion. Only one knock is needed to keep the port open for my current IP address indefinitely, or it can be closed immediately without losing my ssh connection. It also precludes the necessity of filling up iptables with boatloads of DROPs to keep out the riff-raff.