[Console]::OutputEncoding = [Text.Encoding]::UTF8
$ErrorActionPreference = 'Stop'

$ruleName = 'SSH TCP 22 (Allow Inbound)'

# Idempotent: remove any existing rule with the same display name, then recreate.
Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue | Remove-NetFirewallRule

New-NetFirewallRule `
    -DisplayName $ruleName `
    -Description 'Allow inbound SSH on TCP 22 for all firewall profiles (Domain, Private, Public)' `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 22 `
    -Action Allow `
    -Profile Any `
    -Enabled True | Out-Null

Write-Host "[*] Re-enabling firewall profiles (Domain, Private, Public)"
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

Write-Host ""
Write-Host "=== Rule ==="
Get-NetFirewallRule -DisplayName $ruleName |
    Select-Object DisplayName,Enabled,Direction,Action,Profile |
    Format-List

Write-Host "=== Port filter ==="
Get-NetFirewallRule -DisplayName $ruleName | Get-NetFirewallPortFilter |
    Format-List Protocol,LocalPort

Write-Host "=== Profile state ==="
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction |
    Format-Table -AutoSize

Write-Host "[OK] SSH 22 is now permanently allowed across all profiles."