Agent Skills › ryantsai/KKTerm › firewall-port-troubleshooter

firewall-port-troubleshooter

GitHub

诊断KKTerm中防火墙、NAT及端口连通性问题，涵盖SSH/RDP等协议故障。提供跨平台检测命令与排查流程，指导定位监听状态、路径控制及绑定问题，避免全局禁防火或盲目扫描。

assistant-skills/firewall-port-troubleshooter/SKILL.md ryantsai/KKTerm

Trigger Scenarios

服务端口连接超时或被拒绝本地可达但远程无法连接 Windows防火墙或云安全组策略排查 NAT端口转发配置验证

Install

npx skills add ryantsai/KKTerm --skill firewall-port-troubleshooter -g -y

More Options

Non-standard path

npx skills add https://github.com/ryantsai/KKTerm/tree/main/assistant-skills/firewall-port-troubleshooter -g -y

Use without installing

npx skills use ryantsai/KKTerm@firewall-port-troubleshooter

指定 Agent (Claude Code)

npx skills add ryantsai/KKTerm --skill firewall-port-troubleshooter -a claude-code -g -y

安装 repo 全部 skill

npx skills add ryantsai/KKTerm --all -g -y

预览 repo 内 skill

npx skills add ryantsai/KKTerm --list

SKILL.md

Frontmatter

{
    "name": "firewall-port-troubleshooter",
    "description": "Diagnose firewall, NAT, listener, and port reachability problems in KKTerm, including blocked SSH, RDP, VNC, HTTP(S), SFTP, custom ports, Windows Firewall, and remote service binding issues."
}

Firewall and Port Troubleshooter

Use this skill when a host is reachable but a service port fails, times out, refuses connections, or works from one network but not another.

Workflow

Identify the protocol and port, including defaults only when the user has not provided one: SSH/SFTP 22, RDP 3389, VNC 5900+, HTTP 80, HTTPS 443.
Distinguish timeout, connection refused, reset, TLS/application error, and authentication failure. They point to different layers.
Check both sides: client-to-target reachability and whether the target service is actually listening on the expected address and port.
Consider path controls: Windows Firewall, host firewall, router/NAT, VPN ACL, cloud security group, corporate proxy, and service allowlists.
Prefer targeted allow rules or service binding fixes. Do not recommend disabling a firewall globally except as a short, explicit, user-approved test in a controlled environment.
For NAT/port forwarding, verify public/private address, forward target, hairpin NAT expectations, and whether the service is bound to localhost only.
For "works locally but not remotely," inspect listen address, firewall profile, and network classification before changing application credentials.
Avoid port scans beyond the named target and small named port set unless the user explicitly authorizes broader discovery.

Command Guidance

Client test on Windows: Test-NetConnection <host> -Port <port>.
Client test on POSIX/SSH: nc -vz <host> <port> or timeout 5 bash -c '</dev/tcp/<host>/<port>' when netcat is unavailable.
Windows listener check: Get-NetTCPConnection -LocalPort <port> -State Listen and Get-Process -Id <pid> after mapping the owning process.
POSIX listener check: ss -ltnp | grep ':<port>'.
Windows Firewall read-only check: Get-NetFirewallRule -Enabled True filtered by DisplayName, Direction, Profile, or Program.

KKTerm Boundaries

SFTP uses the SSH Connection transport; do not diagnose it as a separate open port.
RDP and VNC are different protocols even when both are remote desktop Sessions.
A failed port check can explain a Session startup failure, but it does not mutate the stored Connection.