For some time know, knockd has been broken on my mail server.  I finally
spent some time trying to troubleshoot it.  Attaching to it with strace
showed that the kernel was not giving it any notification to knocks.
After some time chatting with our new AI overlord, it indicated this may
be because it is forking under systemd, and that is silently restricting
its ability to listen to raw packets.  It suggesed this systemd
override to cause it to not fork, and this worked:

[Service]
# Clear the original ExecStart line (Mandatory in systemd to reset it)
ExecStart=
# Run knockd in the foreground (-D) so it retains its raw network socket
ExecStart=/usr/sbin/knockd -D -i ens5

# Change the service type to match a foreground process architecture
Type=exec

# Keep sandbox exceptions active
CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN
RestrictAddressFamilies=AF_INET AF_INET6 AF_PACKET AF_NETLINK
PrivateNetwork=no
ProtectSystem=full

I think the key difference is the -D flag that prevents it from forking.
Please add this to the systemd service file.