@echo off
REM Chay 1 lan duy nhat - can Run as Administrator.
REM Cho phep port 5000 inbound. Tailscale interface dung netmask 100.64.0.0/10.
title Setup Firewall Rule (Run as Admin)
echo Kiem tra quyen admin...
net session >nul 2>&1
if errorlevel 1 (
    echo [!] Can chay voi quyen Administrator.
    echo Click chuot phai file nay - Run as administrator.
    pause
    exit /b 1
)

echo Them rule: cho phep port 5000 inbound chi tu Tailscale CGNAT range 100.64.0.0/10
netsh advfirewall firewall delete rule name="AttendanceAPI_Tailscale" >nul 2>&1
netsh advfirewall firewall add rule ^
    name="AttendanceAPI_Tailscale" ^
    dir=in ^
    action=allow ^
    protocol=TCP ^
    localport=5000 ^
    remoteip=100.64.0.0/10 ^
    profile=any ^
    description="Cho phep Excel Power Query qua Tailscale truy cap API cham cong"

if errorlevel 0 (
    echo.
    echo [+] Da them rule firewall.
    echo     Chi cho phep tu Tailscale (100.64.0.0/10), khong public LAN/Internet.
    netsh advfirewall firewall show rule name="AttendanceAPI_Tailscale"
)
pause