diff --git a/agent/QUICK-FIX-VM.md b/agent/QUICK-FIX-VM.md
new file mode 100644
index 00000000..ace98853
--- /dev/null
+++ b/agent/QUICK-FIX-VM.md
@@ -0,0 +1,51 @@
+# Quick Fix: Agent Can't Connect from VM
+
+## Problem
+SSL certificate errors when connecting from VM to host.
+
+## Solution: Use HTTP on Local Network
+
+Since the VM and host are on a trusted local network (Hyper-V), use HTTP instead of HTTPS.
+
+### On VM - Set HTTP in Registry:
+
+```powershell
+# On VM (as Administrator):
+New-Item -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Force
+Set-ItemProperty -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Name 'BaseUrl' -Value 'http://172.31.96.1:5001'
+Set-ItemProperty -Path 'HKLM:\SOFTWARE\GE\ShopDB' -Name 'CollectorKey' -Value 'shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43'
+```
+
+### Test it works:
+
+```powershell
+# On VM:
+curl.exe http://172.31.96.1:5001
+# Should return HTML
+```
+
+### Then run the agent:
+
+```powershell
+cd C:\ProgramData\ShopDB\EndpointAgent
+.\shopdb-endpoint-agent.exe --once
+```
+
+## Why HTTP is OK Here
+
+- ✅ VM and host on same physical machine (Hyper-V)
+- ✅ Traffic never leaves the host
+- ✅ Hyper-V internal network is isolated
+- ✅ No external network exposure
+
+For production multi-machine deployment, use HTTPS with proper certificates.
+
+## Alternative: Fix HTTPS (More Complex)
+
+If you need HTTPS:
+
+1. Export the self-signed cert from host
+2. Import to VM's Trusted Root Certification Authorities
+3. Use HTTPS URL
+
+See main INSTALL-ON-VM.md for details.
diff --git a/open-firewall-for-vm.ps1 b/open-firewall-for-vm.ps1
new file mode 100644
index 00000000..d7f86023
--- /dev/null
+++ b/open-firewall-for-vm.ps1
@@ -0,0 +1,31 @@
+# Open Windows Firewall for ShopDB VM Access
+# Run this as Administrator on the Host PC
+
+Write-Host "Adding Windows Firewall rule for ShopDB API..." -ForegroundColor Cyan
+
+try {
+    New-NetFirewallRule `
+        -DisplayName "ShopDB API - Port 5001" `
+        -Direction Inbound `
+        -LocalPort 5001 `
+        -Protocol TCP `
+        -Action Allow `
+        -Profile Any `
+        -ErrorAction Stop
+
+    Write-Host "SUCCESS: Firewall rule added!" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "ShopDB is now accessible from VMs at:" -ForegroundColor Yellow
+    Write-Host "  https://172.31.96.1:5001" -ForegroundColor White
+    Write-Host "  https://172.30.0.1:5001" -ForegroundColor White
+    Write-Host ""
+    Write-Host "Test from VM with:" -ForegroundColor Yellow
+    Write-Host "  Test-NetConnection -ComputerName 172.31.96.1 -Port 5001" -ForegroundColor White
+    Write-Host ""
+} catch {
+    Write-Host "ERROR: Failed to add firewall rule" -ForegroundColor Red
+    Write-Host $_.Exception.Message -ForegroundColor Red
+    Write-Host ""
+    Write-Host "Make sure you're running PowerShell as Administrator!" -ForegroundColor Yellow
+    exit 1
+}
diff --git a/test-vm-connectivity.ps1 b/test-vm-connectivity.ps1
new file mode 100644
index 00000000..0c2397b9
--- /dev/null
+++ b/test-vm-connectivity.ps1
@@ -0,0 +1,96 @@
+# Test VM to Host Connectivity
+# Run this ON THE VM to diagnose connection issues
+
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "ShopDB VM Connectivity Test" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host ""
+
+$HostIP = "172.31.96.1"
+$Port = 5001
+
+# Test 1: Ping
+Write-Host "[1/5] Testing ping to host..." -ForegroundColor Yellow
+$ping = Test-Connection -ComputerName $HostIP -Count 2 -Quiet
+if ($ping) {
+    Write-Host "  OK: Host is reachable" -ForegroundColor Green
+} else {
+    Write-Host "  FAIL: Cannot ping host" -ForegroundColor Red
+}
+
+# Test 2: TCP Port
+Write-Host "[2/5] Testing TCP port $Port..." -ForegroundColor Yellow
+$tcp = Test-NetConnection -ComputerName $HostIP -Port $Port -WarningAction SilentlyContinue
+if ($tcp.TcpTestSucceeded) {
+    Write-Host "  OK: Port $Port is open" -ForegroundColor Green
+} else {
+    Write-Host "  FAIL: Port $Port is closed or blocked" -ForegroundColor Red
+    Write-Host "  Check: Windows Firewall on host PC" -ForegroundColor Yellow
+}
+
+# Test 3: HTTP (plain)
+Write-Host "[3/5] Testing HTTP (without SSL)..." -ForegroundColor Yellow
+try {
+    $http = Invoke-WebRequest -Uri "http://${HostIP}:${Port}/" -UseBasicParsing -TimeoutSec 5 -ErrorAction Stop
+    Write-Host "  OK: HTTP works (got $($http.StatusCode))" -ForegroundColor Green
+} catch {
+    Write-Host "  INFO: HTTP not available (expected - server uses HTTPS)" -ForegroundColor Yellow
+}
+
+# Test 4: HTTPS (self-signed cert)
+Write-Host "[4/5] Testing HTTPS (ignoring cert errors)..." -ForegroundColor Yellow
+try {
+    # Disable cert validation temporarily
+    [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
+    $https = Invoke-WebRequest -Uri "https://${HostIP}:${Port}/" -UseBasicParsing -TimeoutSec 10 -ErrorAction Stop
+    Write-Host "  OK: HTTPS works! (got $($https.StatusCode))" -ForegroundColor Green
+    Write-Host "  Content: $($https.Content.Substring(0, 50))..." -ForegroundColor Gray
+} catch {
+    Write-Host "  FAIL: HTTPS connection failed" -ForegroundColor Red
+    Write-Host "  Error: $($_.Exception.Message)" -ForegroundColor Red
+} finally {
+    [System.Net.ServicePointManager]::ServerCertificateValidationCallback = $null
+}
+
+# Test 5: curl (if available)
+Write-Host "[5/5] Testing with curl..." -ForegroundColor Yellow
+$curlPath = Get-Command curl.exe -ErrorAction SilentlyContinue
+if ($curlPath) {
+    $curlResult = & curl.exe -k -s -o $null -w "%{http_code}" "https://${HostIP}:${Port}/" 2>&1
+    if ($curlResult -match "^\d{3}$") {
+        Write-Host "  OK: curl got HTTP $curlResult" -ForegroundColor Green
+    } else {
+        Write-Host "  FAIL: curl error: $curlResult" -ForegroundColor Red
+    }
+} else {
+    Write-Host "  SKIP: curl not found" -ForegroundColor Gray
+}
+
+Write-Host ""
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "Summary" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "Host IP:   $HostIP" -ForegroundColor White
+Write-Host "Port:      $Port" -ForegroundColor White
+Write-Host ""
+
+if ($tcp.TcpTestSucceeded) {
+    Write-Host "Status: Network connectivity OK" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "If agent still fails:" -ForegroundColor Yellow
+    Write-Host "1. Check registry key: HKLM:\SOFTWARE\GE\ShopDB\BaseUrl" -ForegroundColor White
+    Write-Host "2. Should be: https://${HostIP}:${Port}" -ForegroundColor White
+    Write-Host "3. Check collector key matches" -ForegroundColor White
+    Write-Host ""
+    Write-Host "To ignore SSL cert errors in agent:" -ForegroundColor Yellow
+    Write-Host "Use HTTP instead: http://${HostIP}:${Port}" -ForegroundColor White
+} else {
+    Write-Host "Status: Connection BLOCKED" -ForegroundColor Red
+    Write-Host ""
+    Write-Host "Fix on HOST PC:" -ForegroundColor Yellow
+    Write-Host "1. Run: .\open-firewall-for-vm.ps1 (as Administrator)" -ForegroundColor White
+    Write-Host "2. Or add firewall rule manually" -ForegroundColor White
+    Write-Host "3. Check Docker is running: docker ps" -ForegroundColor White
+}
+Write-Host ""