This line in /etc/init.d/knockd: 3: # atftpd - Script to launch atftpd server. Based on Skeleton. should, probably, be changed to something more appropriate ;-) This line in /etc/knockd.conf: 8: command = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT might be more accomodating (and maybe less error prone) if changed to: 8: command = /usr/sbin/iptables -I INPUT -s .... Cheers, Cristian