System: Ubuntu Server 18.04, stock install, nothing tampered with.

I cannot get knockd to work, even though I'm using the default knockd.conf and simply trying to get it do to anything. I can't see any change in iptables when I knock, nor can I see anything happening whatsoever when I run knockd manually with -D (debug flag).

I've done:

```
apt-get install knockd

```

It installs without errors.

I then edit

```
/etc/default/knockd

```

And set:

```
START_KNOCKD=1

```

I run:

```
service knockd start

```

I can observe that knockd is indeed running with ps aux.

The config is the default one, and it looks as follows:

```
[options]                                                                           
        UseSyslog                                                                   

[openSSH]                                                                           
        sequence    = 7000,8000,9000                                                
        seq_timeout = 5                                                             
        command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT   
        tcpflags    = syn                                                           

[closeSSH]                                                                          
        sequence    = 9000,8000,7000                                                
        seq_timeout = 5                                                             
        command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT   
        tcpflags    = syn      

```

I knock like this:

```
knock -v localhost 7000 8000 9000

```

What I've tried to do to debug/resolve the problem:

I've tried:

* Specifying :tcp on each port in the arguments to knock.
* Using nc -z instead of the "knock" utility.
* Tried running knock in debug mode to see if there's anything useful.
* Tried changing knockd.conf to just use echo and write some string to a file when a knock is successful.
* Tried listening with nc on the ports specified in knockd.conf and running the knock command to see if there is any connection attempt (there is).

I've seen the following question over at askubuntu:

<https://askubuntu.com/questions/550185/what-is-wrong-with-knockd>

Short of doing as suggested in that question --- logging incoming connections using iptables to debug the problem more carefully --- I don't know what to do.

It cannot be needed to debug something so trivial this deeply, on a standard Ubuntu Server install? Surely I'm just missing something obvious here. But what?