1.3.0

Added

• Get-WirelessNetAdapter - single source of truth for "which physical
  adapters are Wi-Fi" on a Windows host (matches on the driver
  InterfaceDescription, not the host-varying connection name). Returns
  the matching Get-NetAdapter objects so callers can compare MACs,
  resolve a connection name to feed Reset-IcsSharing's WAN parameter,
  or check link state without each carrying its own copy of the match.
• Set-RouterSshRelay / Remove-RouterSshRelay - compose the netsh
  portproxy and its Windows Firewall companion as one inseparable pair
  (add and teardown), so a caller cannot lay/sweep one half and forget
  the other - the silent "banner exchange timeout" footgun. Set adds a
  -FirewallOnly mode for the pre-VM phase (firewall pre-laid before the
  router IP is known); both delegate to the existing
  Set-/Remove-RouterSshPortProxy(+Firewall) primitives.

1.2.0

Added

• Remove-RouterSshPortProxy - teardown counterpart to
  Set-RouterSshPortProxy. Removes every netsh portproxy rule forwarding
  to a given router IP (keyed on the connect target, so it sweeps relays
  under any listen address). netsh portproxy state persists across VM /
  switch teardown, so without this the rules accumulate per router IP
  across lifecycles and a stale entry can shadow the WSL relay
  auto-discovery for the next router.
• Remove-RouterSshPortProxyFirewall - teardown counterpart to
  Set-RouterSshPortProxyFirewall; removes the inbound allow rule by its
  port-keyed DisplayName so the firewall surface is torn down symmetrically
  with the portproxy.

1.1.0

Added

• Get-IcsDnsFailureDiagnostics - on a dead ICS DNS proxy, probes the
  two distinguishing host signals (SharedAccess service status + an
  upstream-side resolve via the host's own resolver) and returns the one
  fix that applies, instead of a checklist.
• Test-HostDnsReachable - resolves archive.ubuntu.com via the host's
  own configured resolver (no -Server), the upstream-side counterpart
  to Test-IcsDnsReachable. Distinguishes a wedged ICS proxy (host DNS
  works, proxy does not) from a dead host upstream (neither works), which
  need different fixes.

Changed

• Test-IcsDnsProxyReachable's terminal FAIL (proxy still unreachable
  after the one-shot Reset-IcsSharing) now folds
  Get-IcsDnsFailureDiagnostics output into the finding Detail, naming
  the next action (start service / fix host network / restart + reboot)
  rather than pointing the operator at a manual checklist. Signature and
  finding shape are unchanged, so callers need no update.

1.0.0

Changed

• Major version bump; no functional changes (version realignment).

0.6.0

Changed

• Set-RouterSshPortProxyFirewall scopes its inbound 2222 allow by
  source range (-RemoteAddress, default 172.16.0.0/12 - the range
  WSL2's NAT allocates from) instead of by -InterfaceAlias. An
  interface scope pins the rule to the WSL adapter's interface GUID,
  which WSL regenerates across wsl --shutdown / host reboots,
  stranding the rule so WSL's SSH to the router drops until a
  re-provision. Range scoping has no interface GUID to go stale, so the
  rule survives reboots of long-lived VMs with no re-provision, while
  still keeping the router's password-auth SSH off the physical LAN and
  the Internal-switch subnet (neither sits in 172.16/12). The rule is
  refreshed (delete + re-add) each run, which also migrates an older
  interface-pinned rule.

Added

• Set-RouterSshPortProxyFirewall -WslNatRange to narrow the allowed
  source range on hosts that also live on a 172.16/12 network.

Removed

• The 0.5.0 Hyper-V Firewall rule (New-NetFirewallHyperVRule).
  WSL-to-host traffic is outbound from the WSL VM
  (DefaultOutboundAction = Allow), so the Hyper-V Firewall never gated
  it - the host's Defender rule was always the control. A leftover
  VmProvisioner-WSL-RouterSshPortproxy-* Hyper-V rule from a host that
  installed 0.5.0 is inert and removable with Remove-NetFirewallHyperVRule.

0.5.0

Changed

• Set-RouterSshPortProxyFirewall now also adds a Hyper-V Firewall
  allow (New-NetFirewallHyperVRule) scoped to WSL's VM-creator id, not
  just the Defender rule. On Windows 11 WSL "Hyper-V firewall" mode,
  WSL-to-host traffic is filtered by the Hyper-V Firewall (default-Block)
  and the Defender rule has no effect, so the portproxy was reachable
  from the host but not WSL - failing the Ansible router pre-flight with
  a TCP timeout. Both rules are idempotent and no-op when their
  preconditions are absent.

0.4.1

Changed

• Set-RouterSshPortProxy now retries the netsh portproxy add via
  Common.PowerShell's Invoke-WithExitCodeRetry. The delete-then-add
  refresh runs unconditionally, so a transient add failure previously
  risked stranding the listen target with no rule; the bounded retry
  absorbs the transient case and still throws on a genuine failure.

Dependencies

• Added a RequiredModules dependency on Common.PowerShell (>= 8.1.0),
  which provides Invoke-WithExitCodeRetry.