Agent Skills › ryantsai/KKTerm › firewall-port-troubleshooter

firewall-port-troubleshooter

GitHub

诊断KKTerm中防火墙、NAT及端口连通性问题，涵盖SSH/RDP等协议超时或拒绝连接场景。提供跨平台命令指导，强调分层排查与最小权限原则，避免全局关闭防火墙，并明确SFTP与RDP/VNC的边界差异。

assistant-skills/firewall-port-troubleshooter/SKILL.md ryantsai/KKTerm

Trigger Scenarios

服务端口连接超时或拒绝特定网络下端口不可达 Windows防火墙配置排查 NAT端口转发故障

Install

npx skills add ryantsai/KKTerm --skill firewall-port-troubleshooter -g -y

More Options

Non-standard path

npx skills add https://github.com/ryantsai/KKTerm/tree/main/assistant-skills/firewall-port-troubleshooter -g -y

Use without installing

npx skills use ryantsai/KKTerm@firewall-port-troubleshooter

指定 Agent (Claude Code)

npx skills add ryantsai/KKTerm --skill firewall-port-troubleshooter -a claude-code -g -y

安装 repo 全部 skill

npx skills add ryantsai/KKTerm --all -g -y

预览 repo 内 skill

npx skills add ryantsai/KKTerm --list

SKILL.md

Frontmatter

{
    "name": "firewall-port-troubleshooter",
    "description": "Diagnose firewall, NAT, listener, and port reachability problems in KKTerm, including blocked SSH, RDP, VNC, HTTP(S), SFTP, custom ports, Windows Firewall, and remote service binding issues."
}

Firewall and Port Troubleshooter

Use this skill when a host is reachable but a service port fails, times out, refuses connections, or works from one network but not another.

Workflow

Identify the protocol and port, including defaults only when the user has not provided one: SSH/SFTP 22, RDP 3389, VNC 5900+, HTTP 80, HTTPS 443.
Distinguish timeout, connection refused, reset, TLS/application error, and authentication failure. They point to different layers.
Check both sides: client-to-target reachability and whether the target service is actually listening on the expected address and port.
Consider path controls: Windows Firewall, host firewall, router/NAT, VPN ACL, cloud security group, corporate proxy, and service allowlists.
Prefer targeted allow rules or service binding fixes. Do not recommend disabling a firewall globally except as a short, explicit, user-approved test in a controlled environment.
For NAT/port forwarding, verify public/private address, forward target, hairpin NAT expectations, and whether the service is bound to localhost only.
For "works locally but not remotely," inspect listen address, firewall profile, and network classification before changing application credentials.
Avoid port scans beyond the named target and small named port set unless the user explicitly authorizes broader discovery.

Command Guidance

Client test on Windows: Test-NetConnection <host> -Port <port>.
Client test on POSIX/SSH: nc -vz <host> <port> or timeout 5 bash -c '</dev/tcp/<host>/<port>' when netcat is unavailable.
Windows listener check: Get-NetTCPConnection -LocalPort <port> -State Listen and Get-Process -Id <pid> after mapping the owning process.
POSIX listener check: ss -ltnp | grep ':<port>'.
Windows Firewall read-only check: Get-NetFirewallRule -Enabled True filtered by DisplayName, Direction, Profile, or Program.

KKTerm Boundaries

SFTP uses the SSH Connection transport; do not diagnose it as a separate open port.
RDP and VNC are different protocols even when both are remote desktop Sessions.
A failed port check can explain a Session startup failure, but it does not mutate the stored Connection.