selfhost.directory

The index of self-hostable projects — ranked, categorized and served with live updates.
Own your data and stop giving it to big tech.

GitHubWebsite
fn-knock logo

Self-host fn-knock

v2.5.7

Multi-platform secure gateway for NAS and home servers

ReleaseOpen SourceMIT
GitHubWebsite
Install
Updated11 hours ago
LanguageRust
Setup difficultyModerate
Stars
198
Ports
7991 (Management web UI), 7999 (Gateway traffic (reverse proxy)), 7998 (Rust control plane API (internal)), 7997 (Auth service (internal)), 7996 (gRPC between Rust and Go (internal))
Docker
kcilnk/fn-knock
Install with Linux

What is fn-knock?

fn-knock is a high-performance secure gateway designed for NAS devices, software routers, and home servers. It uses a dual Rust (control plane) and Go (data plane) architecture with embedded SQLite storage, eliminating the need for external Redis or Node.js at runtime. The gateway consolidates reverse proxy, authentication (password, time-based one-time passwords, hardware security keys, OpenID Connect, and LDAP/Active Directory), SSL/ACME certificate management, multi-provider DDNS, WAF protection, IP allowlists, geo-blocking, and tunnel management (FRP and Cloudflared) into a single web console. It supports deployment on fnOS (FPK), OpenWrt (APK/IPK), Docker, Linux (systemd/OpenRC), macOS (launchd), Synology DSM 7 (SPK), and Windows (NSIS installer). The management UI runs on port 7991 and the gateway traffic port defaults to 7999. All configuration is managed through the web interface with optional environment variable overrides for container deployments.

Should you self-host fn-knock?

fn-knock scores 50/100 on selfhost.directory (how scoring works) and ranks #42 of 78 in Security. It has 198 GitHub stars.

It shipped 10 stable releases in the past year. The latest, v2.5.7, came out on 27 October 2026. New versions land roughly every 5 days.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Rust.

Its closest alternative on selfhost.directory is pentagi (83/100, 32 639 stars). It scores higher overall, so compare the two before you pick. See fn-knock vs pentagi side by side.

Features

  • Audit logs and request logging
  • Authentication (TOTP, Passkey, OIDC, LDAP)
  • Backup and Restore
  • Challenge/CAPTCHA (PoW, Turnstile)
  • Embedded SQLite (no external DB)
  • IP allowlist and geo-blocking
  • Multi-platform deployment
  • Multi-provider DDNS
  • Reverse Proxy
  • Service DiscoveryScans local IPv4 HTTP only; up to 16 CIDRs / 1024 hosts
  • SSL/ACME certificate management
  • System monitoring and notificationsDefault alert at 80% sustained for 30s; Windows lacks system monitoring
  • Tunneling (FRP and Cloudflare Tunnel)
  • WAF (Web Application Firewall)
  • Web terminal (SSH)Local PTY disabled by default; only remote SSH on Docker, Windows, macOS, Synology

fn-knock README

How to install fn-knock

Install fn-knock with Linux

Linux with systemd or OpenRC (Alpine)

wget -qO- https://cdn.fnknock.cn/install.sh | { if [ "$(id -u)" -eq 0 ]; then sh; else sudo sh; fi; }

One-line installer sets up systemd or OpenRC service

How to configure fn-knock

  • ADMIN_VIEW_HOST0.0.0.0Admin panel listen address

    Admin panel listen address

    values: IP address

  • ADMIN_VIEW_PORT7991Management panel host port

    Management panel host port

    values: 1-65535

  • AUTH_PORT7997Auth service internal port

    Auth service internal port

    values: 1-65535

  • BACKEND_HOST127.0.0.1Rust backend listen address

    Rust backend listen address

    values: IP address

  • BACKEND_PORT7998Rust backend internal port

    Rust backend internal port

    values: 1-65535

  • DOCKER_ADMIN_TRUSTED_PROXY_CIDRSTrusted proxy CIDRs for admin panel when behind reverse proxy

    Trusted proxy CIDRs for admin panel when behind reverse proxy

    values: CIDR notation (e.g., 10.0.0.0/8)

  • DOCKER_DISCOVER_LAN_IPManual LAN IP for Docker when auto-discovery fails

    Manual LAN IP for Docker when auto-discovery fails

    values: IP address

  • FN_KNOCK_AUTH_BRIDGE_MAX_IN_FLIGHTMax in-flight auth requests (auto 32-256 based on CPU)

    Max in-flight auth requests (auto 32-256 based on CPU)

    values: 32-256

  • FN_KNOCK_DATA_DIR/var/lib/fn-knockData directory path

    Data directory path

    values: Absolute path

  • FN_KNOCK_GATEWAY_CONFIG_DIR/usr/local/etc/fn-knockGateway config directory path

    Gateway config directory path

    values: Absolute path

  • FN_KNOCK_IMAGEhub.fnknock.cn/kcilnk/fn-knock:latestDocker image reference

    Docker image reference

    values: Docker Hub: kcilnk/fn-knock:latest or China mirror: hub.fnknock.cn/kcilnk/fn-knock:latest

  • FN_KNOCK_RUNTIME_TARGETdockerRuntime target identifier

    Runtime target identifier

    values: docker

  • GO_BACKEND_PORT7996Go gateway gRPC internal port

    Go gateway gRPC internal port

    values: 1-65535

  • GO_REPROXY_PORT7999Gateway traffic host port

    Gateway traffic host port

    values: 1-65535

  • TZAsia/ShanghaiTimezone

    Timezone

    values: Any valid TZ identifier

fn-knock releases & version history

Even more releases RSS

FAQ

Where to enable request logs?

System Settings → Logs. After enabling, Request Logs appears in sidebar with date-based filtering of matched Host, upstream, and response status.

Why are fnOS share links being blocked?

fnOS share bypass works only for subdomain routing and tunnel modes, not direct mode. Check that /s/... requests route to fnOS; if another path rule or wrong default route captures it, bypass won't work.

How to handle .knock backup import warnings?

Warnings mean config restored but some runtime sync (gateway, WAF, SSL) failed. Keep admin access, check each warning item, manually re-save affected configs. Don't re-import same file repeatedly.

How to update/rollback/uninstall on macOS?

sudo knock update (install new), sudo knock rollback (revert), sudo knock uninstall (remove program/LaunchDaemon, keep config/data/logs), sudo knock uninstall --purge (interactive DELETE to fully wipe).

How to install on OpenWrt?

Install matching .ipk or .apk for your architecture. Access via Services → 敲门 Knock. Upgrade by installing new package; in-app FPK update not applicable. Config and data preserved at /etc/config/fn-knock, /etc/fn-knock/gateway, /etc/fn-knock/data.

Docker upgrade resulted in empty data - how to recover?

Stop writes, confirm old data volume exists. Current version uses SQLite; only Redis-to-SQLite migration runs when upgrading from early Redis versions. Don't delete old volumes or overlay with empty ones. Follow Docker deployment backup/migration steps.

Why should I configure HTTPS early?

HTTPS protects login credentials and session cookies, and is required for Passkey to work. Public domains, FRP, and Cloudflared public ingress should all use trusted certificates.

What's the difference between general blocklist and scanner blocklist?

Scanner blocklist: auto-bans based on unauthenticated anomalous path probing. General blocklist: admin manually bans specific IPs from logs or blocklist page. General blocklist only accepts exact IPv4/IPv6, not CIDR.

Why does login succeed but redirect back to login page?

Check: 1) auth and service domains use same public protocol, 2) root domain, cookie scope, and Passkey RP ID match, 3) browser allows cookies, 4) edge platform doesn't cache login response, 5) reverse proxy passes correct Host/X-Forwarded-Host/X-Forwarded-Proto, 6) system time is accurate.

Should Cloudflared use HTTP or HTTPS for origin?

Use HTTP if fn-knock local gateway has no certificate. Use HTTPS if local gateway has a valid certificate that Cloudflared trusts. When in different containers, use container name or LAN IP instead of localhost.

Do I need DDNS when using tunnels?

Usually not. FRP uses server address and external port; Cloudflared uses the Cloudflare Tunnel bound domain. Only configure DDNS if the tunnel ingress itself depends on a dynamic public IP.

Why can't I access my services from the internet even though the admin panel works?

Check: 1) correct network topology (public IP vs tunnel), 2) external traffic reaches gateway port (7999) not admin port (7991), 3) DNS points to correct ingress, 4) router port forwarding and host firewall allow traffic, 5) tunnel is online and targets correct local gateway, 6) request logs show the request.

How do I reset the admin password?

Use platform-specific reset commands: Docker (see Docker deployment docs), OpenWrt (see OpenWrt deployment), fnOS (re-enter from desktop), macOS (sudo knock reset-panel-password), Windows (use management app 'Clear admin password' or run .\fn-knock-service.exe reset-panel-password as admin).

Which entry point should I use: desktop icon or gateway port?

Use the desktop icon (fnOS/群晖/OpenWrt/macOS/Windows) for configuration, logs, and mode switching. Use the gateway port (default 7999) or external domain for verifying public access, domains, tunnels, or service mappings.

More in Reverse Proxy

Rate this project

Click to rate — no account needed.

0 comments

Posting as guest
Loading comments…