New-NetFirewallRule -DisplayName "RDP from Tailscale" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 100.64.0.0/10 -Action Allow -Profile Any