Agent Skills › ryantsai/KKTerm › firewall-port-troubleshooter

firewall-port-troubleshooter

GitHub

诊断KKTerm中防火墙、NAT及端口连通性问题。支持识别超时或拒绝连接，检查客户端与目标端监听状态，排查Windows防火墙及安全组限制，验证NAT映射与服务绑定，指导安全测试而不推荐全局关闭防火墙。

assistant-skills/firewall-port-troubleshooter/SKILL.md ryantsai/KKTerm

Trigger Scenarios

SSH/RDP/VNC等端口连接失败或超时服务本地正常但远程无法访问需要诊断防火墙规则或NAT配置问题

Install

npx skills add ryantsai/KKTerm --skill firewall-port-troubleshooter -g -y

More Options

Non-standard path

npx skills add https://github.com/ryantsai/KKTerm/tree/main/assistant-skills/firewall-port-troubleshooter -g -y

Use without installing

npx skills use ryantsai/KKTerm@firewall-port-troubleshooter

指定 Agent (Claude Code)

npx skills add ryantsai/KKTerm --skill firewall-port-troubleshooter -a claude-code -g -y

安装 repo 全部 skill

npx skills add ryantsai/KKTerm --all -g -y

预览 repo 内 skill

npx skills add ryantsai/KKTerm --list

SKILL.md

Frontmatter

{
    "name": "firewall-port-troubleshooter",
    "description": "Diagnose firewall, NAT, listener, and port reachability problems in KKTerm, including blocked SSH, RDP, VNC, HTTP(S), SFTP, custom ports, Windows Firewall, and remote service binding issues."
}

Firewall and Port Troubleshooter

Use this skill when a host is reachable but a service port fails, times out, refuses connections, or works from one network but not another.

Workflow

Identify the protocol and port, including defaults only when the user has not provided one: SSH/SFTP 22, RDP 3389, VNC 5900+, HTTP 80, HTTPS 443.
Distinguish timeout, connection refused, reset, TLS/application error, and authentication failure. They point to different layers.
Check both sides: client-to-target reachability and whether the target service is actually listening on the expected address and port.
Consider path controls: Windows Firewall, host firewall, router/NAT, VPN ACL, cloud security group, corporate proxy, and service allowlists.
Prefer targeted allow rules or service binding fixes. Do not recommend disabling a firewall globally except as a short, explicit, user-approved test in a controlled environment.
For NAT/port forwarding, verify public/private address, forward target, hairpin NAT expectations, and whether the service is bound to localhost only.
For "works locally but not remotely," inspect listen address, firewall profile, and network classification before changing application credentials.
Avoid port scans beyond the named target and small named port set unless the user explicitly authorizes broader discovery.

Command Guidance

Client test on Windows: Test-NetConnection <host> -Port <port>.
Client test on POSIX/SSH: nc -vz <host> <port> or timeout 5 bash -c '</dev/tcp/<host>/<port>' when netcat is unavailable.
Windows listener check: Get-NetTCPConnection -LocalPort <port> -State Listen and Get-Process -Id <pid> after mapping the owning process.
POSIX listener check: ss -ltnp | grep ':<port>'.
Windows Firewall read-only check: Get-NetFirewallRule -Enabled True filtered by DisplayName, Direction, Profile, or Program.

KKTerm Boundaries

SFTP uses the SSH Connection transport; do not diagnose it as a separate open port.
RDP and VNC are different protocols even when both are remote desktop Sessions.
A failed port check can explain a Session startup failure, but it does not mutate the stored Connection.