Match on portkng allows to open ports based on port knocking method.

--knock xx,xx...
    To knock a set of ports by the order of insertion (xx - Port number).

--timeout
    To set time in seconds in order to keep destionation port open since last inbound connection.

--knock-timeout
    To time in seconds between valid knocks.

Examples:

$ iptables -A INPUT -m portkng --knock 45,67,89 -p tcp --dport 22 -j ACCEPT
      Will open port 22 when ports 45,67 and 89 are knocked (in order).

$ iptables -A INPUT -m portkng --knock 45,67,89 --timeout 30 -p tcp --dport 22 -j ACCEPT
      Will open port 22 when ports 45,67 and 89 are knocked (in order) and will close port 22 after 30 seconds since last inbound connection

$ iptables -A INPUT -m portkng --knock 45,67,89 --knock-timeout 2 -p tcp --dport 22 -j ACCEPT
      Will open port 22 when ports 45,67 and 89 are knocked (in order) if the time between port knock is less than 2 seconds.