# Windows 11 Pro Fallback Configuration Guide
## Hyper-V NAT & Zero-Leak Broadcast Suppression

If you decide to keep Windows 11 Pro on the ThinkPad T490, this guide provides the necessary PowerShell commands, WinNAT routing tables, and discovery suppression policies to share Wi-Fi connectivity while preventing Windows from leaking discovery broadcasts across the friend's LAN.

> [!WARNING]
> Standard Windows **Internet Connection Sharing (ICS)** must NOT be used because it forces the `192.168.137.0/24` subnet, runs an uncontrolled rogue DHCP server, and emits discovery broadcasts. Instead, use **Hyper-V NAT (WinNAT)** with strict firewall rules.

---

## 1. Prerequisites & Hyper-V NAT Configuration

Open **PowerShell as Administrator**:

### 1.1 Enable Hyper-V Features
```powershell
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All -NoRestart
```

### 1.2 Configure Static IP on Physical Ethernet Adapter
```powershell
# Set static IP on the T490 Ethernet port
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress "172.16.100.1" -PrefixLength 24
```

### 1.3 Create the WinNAT Router
```powershell
# Create NAT engine for the transit subnet
New-NetNat -Name "HomelabGatewayNAT" -InternalIPInterfaceAddressPrefix "172.16.100.0/24"

# Add static route for the internal Proxmox VM subnet via Proxmox transit IP
New-NetRoute -DestinationPrefix "192.168.45.0/24" -InterfaceAlias "Ethernet" -NextHop "172.16.100.2" -RouteMetric 10
```

### 1.4 Enable Kernel IP Routing in the Windows Registry
```powershell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "IPEnableRouter" -Value 1 -Type DWord
Set-NetIPInterface -InterfaceAlias "Ethernet" -Forwarding Enabled
Set-NetIPInterface -InterfaceAlias "Wi-Fi" -Forwarding Enabled
```

---

## 2. Zero-Leak Discovery Protocol Suppression

Windows broadcasts multiple service discovery protocols by default. Execute the following commands in Administrator PowerShell to silence them:

### 2.1 Disable LLMNR (Link-Local Multicast Name Resolution)
```powershell
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -Value 0 -Type DWord
```

### 2.2 Disable NetBIOS over TCP/IP on All Network Adapters
```powershell
Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter "IPEnabled=TRUE" | ForEach-Object {
    $_.SetTcpipNetbios(2)
}
```

### 2.3 Disable SSDP, UPnP, and Function Discovery Services
```powershell
Stop-Service SSDPSRV, upnphost, fdPHost, FDResPub -Force
Set-Service SSDPSRV, upnphost, fdPHost, FDResPub -StartupType Disabled
```

### 2.4 Add Windows Defender Firewall Egress Drop Rules
```powershell
# Drop mDNS (5353), LLMNR (5355), and SSDP (1900) on Wi-Fi adapter
New-NetFirewallRule -DisplayName "ZeroLeak-Block-mDNS-Out" -Direction Outbound -InterfaceAlias "Wi-Fi" -LocalPort 5353 -Protocol UDP -Action Block
New-NetFirewallRule -DisplayName "ZeroLeak-Block-LLMNR-Out" -Direction Outbound -InterfaceAlias "Wi-Fi" -LocalPort 5355 -Protocol UDP -Action Block
New-NetFirewallRule -DisplayName "ZeroLeak-Block-SSDP-Out" -Direction Outbound -InterfaceAlias "Wi-Fi" -LocalPort 1900 -Protocol UDP -Action Block
New-NetFirewallRule -DisplayName "ZeroLeak-Block-NetBIOS-Out" -Direction Outbound -InterfaceAlias "Wi-Fi" -LocalPort 137,138 -Protocol UDP -Action Block
```

---

## 3. Power Management & Lid-Closed Settings

Prevent Windows from putting the network card to sleep or suspending when the laptop lid is closed:

```powershell
# Do nothing when lid is closed on AC power
powercfg /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0

# Disable sleep and hibernate timeouts on AC
powercfg /change standby-timeout-ac 0
powercfg /change hibernate-timeout-ac 0

# Apply the current power scheme
powercfg /setactive SCHEME_CURRENT
```

---

## 4. Install Tailscale for Windows

1. Download and install [Tailscale for Windows](https://tailscale.com/download/windows).
2. Log in to your Tailnet.
3. Your T490 Windows laptop will now be accessible remotely over Tailscale.