Fix fresh domain controller bootstrap

scripts/Deploy-AuthBroker.ps1

@@ -36,6 +36,9 @@ param(
     [int]$NtlmTimeoutSeconds = 20,
     [ValidateRange(2, 90)]
     [int]$ProfileTimeoutSeconds = 90,
+    [ValidateNotNullOrEmpty()]
+    [string[]]$FirewallRemoteAddress = @('LocalSubnet'),
+    [ipaddress]$FirewallLocalAddress,
     [switch]$CreateMissingOus,
     [switch]$DisableCertificateRevocationCheckForLab
 )
@@ -215,9 +218,32 @@ if ($PSCmdlet.ShouldProcess($installPath, 'Install the SGU Authentication Broker
         throw 'Could not enable recovery for non-crash SGUAuthBroker failures.'
     }
 
-    if (-not (Get-NetFirewallRule -DisplayName 'SGU Authentication Broker (mTLS)' -ErrorAction SilentlyContinue)) {
-        New-NetFirewallRule -DisplayName 'SGU Authentication Broker (mTLS)' `
-            -Direction Inbound -Action Allow -Protocol TCP -LocalPort 8443 -Profile Domain | Out-Null
+    $firewallRule = Get-NetFirewallRule `
+        -DisplayName 'SGU Authentication Broker (mTLS)' `
+        -ErrorAction SilentlyContinue
+    if (-not $firewallRule) {
+        $firewallParameters = @{
+            DisplayName = 'SGU Authentication Broker (mTLS)'
+            Direction = 'Inbound'
+            Action = 'Allow'
+            Protocol = 'TCP'
+            LocalPort = 8443
+            Profile = 'Any'
+            RemoteAddress = $FirewallRemoteAddress
+        }
+        if ($FirewallLocalAddress) {
+            $firewallParameters.LocalAddress = $FirewallLocalAddress.IPAddressToString
+        }
+        $firewallRule = New-NetFirewallRule @firewallParameters
+    }
+    else {
+        $firewallRule | Set-NetFirewallRule -Enabled True -Profile Any
+        $addressParameters = @{ RemoteAddress = $FirewallRemoteAddress }
+        if ($FirewallLocalAddress) {
+            $addressParameters.LocalAddress = $FirewallLocalAddress.IPAddressToString
+        }
+        $firewallRule | Get-NetFirewallAddressFilter |
+            Set-NetFirewallAddressFilter @addressParameters | Out-Null
     }
 
     Start-Service -Name $serviceName