<#
.SYNOPSIS
    Read-only TCP reachability check for the main Veeam Backup & Replication 13
    ports, run from a machine of the backup infrastructure.

.DESCRIPTION
    Tests TCP connections with Test-NetConnection (-Port, -InformationLevel Quiet)
    and returns one row per target and port. Nothing is configured: no firewall
    rule is added or changed.

    The default checks are taken from the "Ports" page of the Veeam Backup &
    Replication 13 User Guide:
      - 443   console / web UI / REST client -> backup server
      - 6162  proxies, repositories, gateway and mount servers -> backup server
              (fallback range 2500-3300 is not scanned here)
      - 10443 web UI / Host Management -> backup server (Veeam Software Appliance only)
    Use -Check to supply your own list (for example after reading the ports
    matrix for your version and components).

.PARAMETER BackupServer
    Name or address of the backup server.

.PARAMETER Appliance
    Also test 10443 (Veeam Software Appliance deployments).

.PARAMETER Check
    Custom list of hashtables @{ ComputerName = '...'; Port = 0; Purpose = '...' }.
    When provided, the default checks are ignored.

.EXAMPLE
    .\Test-VBRPortReachability.ps1 -BackupServer vbr01.mgmt.local | Format-Table

.EXAMPLE
    .\Test-VBRPortReachability.ps1 -Check @(@{ ComputerName = 'repo01'; Port = 6162; Purpose = 'Data Mover' })

.NOTES
    Windows PowerShell 5.1 or PowerShell 7 on Windows (NetTCPIP module).
    A successful TCP test does not prove that the Veeam service behind the port
    is healthy; a failed one points to routing, DNS or firewall.
    Source: ANYSYS ICT, https://www.anysys.be/articles/
#>
[CmdletBinding(DefaultParameterSetName = 'Default')]
param(
    [Parameter(Mandatory, ParameterSetName = 'Default')]
    [string]$BackupServer,

    [Parameter(ParameterSetName = 'Default')]
    [switch]$Appliance,

    [Parameter(Mandatory, ParameterSetName = 'Custom')]
    [hashtable[]]$Check
)

$ErrorActionPreference = 'Stop'

if ($PSCmdlet.ParameterSetName -eq 'Default') {
    $Check = @(
        @{ ComputerName = $BackupServer; Port = 443; Purpose = 'Console / web UI / REST -> backup server' }
        @{ ComputerName = $BackupServer; Port = 6162; Purpose = 'Infrastructure components -> backup server (Data Mover)' }
    )
    if ($Appliance) {
        $Check += @{ ComputerName = $BackupServer; Port = 10443; Purpose = 'Web UI / Host Management (Veeam Software Appliance)' }
    }
}

foreach ($item in $Check) {
    $ok = Test-NetConnection -ComputerName $item.ComputerName -Port $item.Port -InformationLevel Quiet -WarningAction SilentlyContinue
    [pscustomobject]@{
        Source       = [System.Net.Dns]::GetHostName()
        ComputerName = $item.ComputerName
        Port         = $item.Port
        Purpose      = $item.Purpose
        TcpOpen      = [bool]$ok
        TestedAt     = Get-Date
    }
}