Comment by ranger_danger

Besides the ProxyCommand approach, another way would be to define 'ssh' as a shell alias/function that does the port knocking first and then passes any parameters to the normal /usr/bin/ssh.

Or you could make your own 'ssh' shell script somewhere else on the filesystem that handles it for you.