CFPP Windows RC1 candidate - Windows 10 x64 / Server 2016, 2019 and 2025 x64

Runtime scope: IPv4 TCP, Cloudflare trusted-source validation, Proxy Protocol
v1 removal, original local destination and native backend visitor IP.
UDP, QUIC, PPv2 and IPv6 are not processed by this gateway.
The high-defense provider must map ports and send PPv1 on its Cloudflare path.
Unknown ordinary outbound flows are captured/reinjected; capacity is not a
performance guarantee. Initial production connection ceiling is 4096.

Delivery status: prior alpha2 native Win10 end-to-end acceptance passed with
firewall enabled, exact binary data and both half-closes. RC1 adds native TCP
tuple collision avoidance and persistent service installation. RC1 native
acceptance, real high-defense paths, long idle and reboot must be verified
on the customer host. Server 2016/2019/2025 native acceptance remains pending.
Server 2025 (build 26100, including cumulative-update revisions) is now
accepted by the platform check. This is an installer compatibility patch;
the EXE, DLL and signed driver are unchanged. No Server 2025 driver-load,
traffic, service-start or reboot acceptance has been performed here.

Suggested order:
1. Test-Package.ps1 - integrity/signature/platform checks, no capture.
2. Test-EndToEnd.ps1 -LocalIP <ordinary IP> -TemporaryFirewallRule
3. Start-LivePathTest.ps1 -PackagePath <this folder> -OriginIP <ordinary IP>
   -ClientIP <external raw TCP client IP> -Port 49988 -DurationSeconds 600
4. Only after acceptance, Install-Gateway.ps1 -PackagePath <this folder>
   -OriginIP <ordinary IP> -AllTcp (or an explicit -Ports list).
5. Restart the host at a suitable time, then Test-InstalledGateway.ps1.

Install-Gateway copies runtime files, trusted prefixes, licenses, config and
the post-reboot verifier into protected C:\ProgramData\CFPP-Windows.
The CFPPGateway service is configured to start automatically after boot.
The Desktop ZIP and extracted delivery folder may be removed only after
installation and installed-service verification succeed. Keep ProgramData
runtime EXE, DLL, SYS, config and CIDR files; the gateway runs continuously.
Reboot terminates current TCP sessions; clients must reconnect normally.
Do not restart an established proxied remote session expecting no interruption.

The installer preserves existing firewall profiles, customer firewall rules
and routes. Customer applications need their normal firewall permissions;
this gateway does not open all application ports or install customer software.
Logs are stored in the protected installation folder.
Remove-Gateway.ps1 only removes this installation and its own service; it
does not uninstall a shared WinDivert driver service.

The virtual listener uses loopback, so it does not collide with a customer's
public-IP port 39000. Source-port selection avoids a native TCP-table snapshot
and active reserved tuples, but concurrent native socket creation cannot be
made atomic with the user-space stack; do not claim zero collision risk.

Test scripts use only reserved lab peers or one unused temporary port.
Start-LivePathTest prints an ephemeral lab token and path evidence. Only
peer_ip within trusted CF IPv4 ranges plus proxy_protocol=true and a matching
native visitor IP establish the CF path; an ordinary direct connection alone
does not. Normal exit removes its own temporary rule and children. Force
killing PowerShell can leave its printed rule for manual cleanup.

The owner must choose distribution terms; original source had no license.

Server 2025 patch usage:
Extract this entire new ZIP into a NEW directory. Do not mix it with the
original RC1 scripts or reuse the original ZIP SHA256. Replace any example
OriginIP text with the actual configured ordinary IPv4 of this server.
Run Windows PowerShell 5.1 x64 as Administrator. From the package directory:
  powershell.exe -NoProfile -File .\Test-Package.ps1
  powershell.exe -NoProfile -File .\Test-EndToEnd.ps1 -LocalIP <actual-IP> -TemporaryFirewallRule
Then use the existing Install-Gateway.ps1 commands after acceptance.
If Windows reports a driver signature or security-policy error, retain the
full error for diagnosis; this patch does not disable security protections.
Reference: https://learn.microsoft.com/en-us/windows/release-health/windows-server-release-info
