With knockd you can execute arbitrary commands upon a port knocking sequence. So any application that is configurable via terminal is eligible. Here's a tutorial of knockd+iptables (1). Alternativly there's (2) that achieves the same effect in a different way.

You can use it wherever, as part of security in depth. It's essentially a pre-shared secret.

It'll have it's largest effect on publicly facing interfaces. It does not replace having a proper ssh setup (disabling root, disabling password login, etc).