@queerhackerwitch knockd exists, and it shells out to iptables, but shelling out to iptables is fragile and miserable and I hate it >.> We can do better.