Thanks. Gotta be a bit careful there, though, as somebody could be accessing our web server legitimately from the same IP as I'm using to connect to SSH. Say, both of us behind the same hotel/corporate NAT firewall.

But yeah, good idea for ports with nothing public on them.

Something like this line, after the existing -j ssh_add line:

ipt -A INPUT -p tcp --syn -m recent --name ssh_knock --rcheck -j ssh_del

Cheers!