Comment 9 for bug 837954

I solved it creating this script in /etc/NetworkManager/dispatcher.d/02knockd.sh (owned by root:root and with u=rwx,og=rx permissions):

#!/bin/bash

set -o nounset

declare iface="${1:-}"
declare event="${2:-}"

case "$event" in
  up|vpn-up)
    if ! pidof knockd >/dev/null; then
     service knockd start 2>&1
    fi
    ;;
  down|vpn-down|hostname|dhcp4-change|dhcp6-change) ;;
  *)
          echo "$0: called with unknown action \`$2'" 1>&2
    exit 1
    ;;
esac