diag-network-port-unreach

Network Port Unreachable Full-Chain Diagnostics

用途

当用户报告某个端口/服务不可达、连接超时或被拒绝时触发。

输入

• 目标 host:port
• 可选：源机器、协议（TCP/UDP）

输出

• 端口连通性诊断报告 + 修复建议

诊断步骤

Step 1: DNS 解析

# 确认目标地址能解析
dig +short {hostname}
nslookup {hostname}
getent hosts {hostname}
# 如果是 IP 则跳过 DNS

Step 2: TCP 连通性测试

# 基础连通
nc -zv {host} {port} -w 5
# 或
timeout 5 bash -c "echo > /dev/tcp/{host}/{port}" 2>&1

# 多端口批量测试
for p in {port_list}; do nc -zv {host} $p -w 3 2>&1; done

# 路由追踪
traceroute -T -p {port} {host}

Step 3: 目标端服务监听

# 服务是否在监听
ss -tlnp | grep :{port}
# 或
netstat -tlnp | grep :{port}

# 绑定地址（127.0.0.1 vs 0.0.0.0）
ss -tlnp | grep :{port} | awk '{print $4}'

Step 4: 防火墙规则

# iptables
iptables -L INPUT -n --line-numbers | grep {port}
iptables -L FORWARD -n --line-numbers | grep {port}

# firewalld
firewall-cmd --list-all
firewall-cmd --query-port={port}/tcp

# nftables
nft list ruleset | grep {port}

# ufw
ufw status numbered | grep {port}

Step 5: 路由与 NAT

# 路由表
ip route get {target_ip}
ip route show table all | grep {subnet}

# NAT 规则（端口转发场景）
iptables -t nat -L PREROUTING -n --line-numbers
iptables -t nat -L DNAT -n --line-numbers

# Windows portproxy（如果涉及 Windows 转发）
netsh interface portproxy show all

输出模板

Port Connectivity Diagnosis Report
════════════════════════════════════════
Target:    {host}:{port}
Protocol:  {tcp/udp}
Source:    {source_host}
Time:      {timestamp}

DNS Resolution
  {hostname} → {resolved_ip} (or N/A for IP)

TCP Connect Test
  {host}:{port} → {open/closed/timeout/refused}

Service Listening (target side)
  Port {port}: {listening/not_listening}
  Bind Address: {bind_addr} (127.0.0.1 = local only!)
  Process: {process_name} (PID: {pid})

Firewall Rules
  iptables INPUT:  {rule_or_none}
  firewalld:       {port_status}
  nftables:        {rule_or_none}

Routing
  Path: {source} → {next_hop} → ... → {destination}
  NAT:  {nat_rules_or_none}

Root Cause: {root_cause}

Recommendations
  1. {fix_1}
  2. {fix_2}