Agent Skills › ryantsai/KKTerm › firewall-port-troubleshooter

firewall-port-troubleshooter

GitHub

诊断防火墙、NAT、监听及端口可达性问题，涵盖SSH、RDP等协议连接失败或超时场景。通过分层排查网络路径与控制策略，提供安全修复建议，适用于KKTerm环境下的远程服务连通性故障分析。

assistant-skills/firewall-port-troubleshooter/SKILL.md ryantsai/KKTerm

Trigger Scenarios

端口连接超时或被拒绝本地正常但远程无法访问防火墙规则配置疑问

Install

npx skills add ryantsai/KKTerm --skill firewall-port-troubleshooter -g -y

More Options

Non-standard path

npx skills add https://github.com/ryantsai/KKTerm/tree/main/assistant-skills/firewall-port-troubleshooter -g -y

Use without installing

npx skills use ryantsai/KKTerm@firewall-port-troubleshooter

指定 Agent (Claude Code)

npx skills add ryantsai/KKTerm --skill firewall-port-troubleshooter -a claude-code -g -y

安装 repo 全部 skill

npx skills add ryantsai/KKTerm --all -g -y

预览 repo 内 skill

npx skills add ryantsai/KKTerm --list

SKILL.md

Frontmatter

{
    "name": "firewall-port-troubleshooter",
    "description": "Diagnose firewall, NAT, listener, and port reachability problems in KKTerm, including blocked SSH, RDP, VNC, HTTP(S), SFTP, custom ports, Windows Firewall, and remote service binding issues."
}

Firewall and Port Troubleshooter

Use this skill when a host is reachable but a service port fails, times out, refuses connections, or works from one network but not another.

Workflow

Identify the protocol and port, including defaults only when the user has not provided one: SSH/SFTP 22, RDP 3389, VNC 5900+, HTTP 80, HTTPS 443.
Distinguish timeout, connection refused, reset, TLS/application error, and authentication failure. They point to different layers.
Check both sides: client-to-target reachability and whether the target service is actually listening on the expected address and port.
Consider path controls: Windows Firewall, host firewall, router/NAT, VPN ACL, cloud security group, corporate proxy, and service allowlists.
Prefer targeted allow rules or service binding fixes. Do not recommend disabling a firewall globally except as a short, explicit, user-approved test in a controlled environment.
For NAT/port forwarding, verify public/private address, forward target, hairpin NAT expectations, and whether the service is bound to localhost only.
For "works locally but not remotely," inspect listen address, firewall profile, and network classification before changing application credentials.
Avoid port scans beyond the named target and small named port set unless the user explicitly authorizes broader discovery.

Command Guidance

Client test on Windows: Test-NetConnection <host> -Port <port>.
Client test on POSIX/SSH: nc -vz <host> <port> or timeout 5 bash -c '</dev/tcp/<host>/<port>' when netcat is unavailable.
Windows listener check: Get-NetTCPConnection -LocalPort <port> -State Listen and Get-Process -Id <pid> after mapping the owning process.
POSIX listener check: ss -ltnp | grep ':<port>'.
Windows Firewall read-only check: Get-NetFirewallRule -Enabled True filtered by DisplayName, Direction, Profile, or Program.

KKTerm Boundaries

SFTP uses the SSH Connection transport; do not diagnose it as a separate open port.
RDP and VNC are different protocols even when both are remote desktop Sessions.
A failed port check can explain a Session startup failure, but it does not mutate the stored Connection.