From 2ca126b00cee3f92e4dac2d56a6116e2aed619a4 Mon Sep 17 00:00:00 2001 From: Roger Date: Fri, 11 Sep 2026 17:22:23 +0200 Subject: [PATCH] Update pfSense ACCESS/SPEC-053 with WAN admin lock details. Document Tailscale-only SSH/WebGUI after removing EasyRule :22 and blocking wanip 22/10443. Co-authored-by: Cursor --- Infra-Network/ACCESS-PFSENSE.md | 60 +++++++++++++------ Infra-Network/README.md | 5 ++ .../SPEC-053-PFSENSE-PRIVATE-ADMIN.md | 1 + 3 files changed, 47 insertions(+), 19 deletions(-) diff --git a/Infra-Network/ACCESS-PFSENSE.md b/Infra-Network/ACCESS-PFSENSE.md index 0f7b5ad..1bb326d 100644 --- a/Infra-Network/ACCESS-PFSENSE.md +++ b/Infra-Network/ACCESS-PFSENSE.md @@ -1,33 +1,40 @@ # ACCESS — pfSense (VM 100) privado -**Status:** canónico · **Data:** 2026-09-11 (chave SSH) +**Status:** canónico · **Atualizado:** 2026-09-11 **SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md` **Operador:** Roger > **Não** usar `https://firewall.itecnologys.com` (despublicado). -> SSH **não** está na WAN — sempre via Tailscale → big1 (`ProxyJump`) ou LAN. +> **Não** usar IP WAN `95.216.14.146` nas portas **22** / **10443** (bloqueadas na WAN). -## WebGUI +--- + +## Como aceder de qualquer sítio do mundo + +1. Instalar/ligar **Tailscale** no telemóvel ou PC +2. Usar os URLs / SSH abaixo (passa pelo big1) + +### WebGUI (interface gráfica) | Canal | URL | |-------|-----| -| Tailscale (PC) | **https://100.116.138.100:18443/** | -| LAN (VM) | https://10.10.10.1:10443/ | -| Consola | Proxmox → VM 100 | +| **Tailscale (canónico)** | **https://100.116.138.100:18443/** | +| LAN (VM na rede) | https://10.10.10.1:10443/ | +| Consola | Proxmox → VM **100** → Console | -Serviço big1: `pfsense-admin-ts.service` (enabled). +Serviço big1: `pfsense-admin-ts.service` (enabled) +`100.116.138.100:18443` → `10.10.10.1:10443` -## SSH com chave (qualquer sítio com Tailscale) +### SSH (consola / terminal) | Item | Valor | |------|--------| | User | `admin` | | Host LAN | `10.10.10.1:22` | -| Chave (big1) | `/root/.ssh/pfsense_roger_ed25519` | +| Chave no big1 | `/root/.ssh/pfsense_roger_ed25519` | | Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` | -| Comment | `roger@pfsense-anywhere-2026-09-11` | -### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`) +#### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`) ``` -----BEGIN OPENSSH PRIVATE KEY----- @@ -40,13 +47,7 @@ ECAwQ= -----END OPENSSH PRIVATE KEY----- ``` -### Pública (já no pfSense → System → User Manager → admin) - -``` -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11 -``` - -### `~/.ssh/config` no PC +#### `~/.ssh/config` no PC / telemóvel (Termius, etc.) ```sshconfig Host big1 @@ -70,7 +71,23 @@ chmod 600 ~/.ssh/pfsense_roger_ed25519 ssh pfsense ``` -No big1 (já configurado): `ssh pfsense` (sem ProxyJump). +No big1: `ssh pfsense` (já configurado). + +--- + +## O que foi fechado na WAN (2026-09-11) + +| Destino | Estado | +|---------|--------| +| WAN `95.216.14.146:22` (SSH do pfSense) | **BLOCK** | +| WAN `95.216.14.146:10443` (WebGUI) | **BLOCK** | +| EasyRule antiga `pass any → :22` | **Removida** | +| SSH VMs via NAT `2501–2515` | Mantido (outra coisa) | +| Odoo HAProxy `:80/:443` | Mantido (serviço) | + +Backup config: `/root/config-backup-before-wan-admin-lock-*.xml` no pfSense. + +--- ## API (só privado / big1) @@ -79,3 +96,8 @@ curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system' ``` Não reabrir Traefik público sem nova SPEC. + +## Relacionado + +- `ACCESS-BIG1.md` — Proxmox WebUI / SSH do host (mesmo modelo Tailscale) +- `SPEC-053-PFSENSE-PRIVATE-ADMIN.md` diff --git a/Infra-Network/README.md b/Infra-Network/README.md index 6dba174..1e2ef3c 100644 --- a/Infra-Network/README.md +++ b/Infra-Network/README.md @@ -9,3 +9,8 @@ SPECs de rede (big / BIG1 / routers). Repo Forgejo: a criar `ligbox/infra-networ | R8000 credentials | SPEC_R8000_CREDENTIALS.md | | SPEC-VM500 Rent Charge | SPEC-VM500-RENTCHARGE.md | | Cursor Tapo Tuya MCP (2026-09-08) | CURSOR_TAPO_TUYA_MCP.md | + +## Admin privado (Tailscale) +- [[ACCESS-PFSENSE]] · [[SPEC-053-PFSENSE-PRIVATE-ADMIN]] +- [[ACCESS-BIG1]] · [[SPEC-054-PROXMOX-PRIVATE-ADMIN]] + diff --git a/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md b/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md index cb16a29..aa121da 100644 --- a/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md +++ b/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md @@ -157,6 +157,7 @@ Alterações NAT/firewall: **só com OK explícito do Roger**. 3. Criado e enabled: `pfsense-admin-ts.service` no big1. 4. Validação: público `firewall.itecnologys.com` → 404; TS `:18443` → 200 Login; `rently.myvexx.com` OK. 5. Chave SSH `pfsense_roger_ed25519` gerada no big1 e instalada em `admin` via API (`authorizedkeys`); login `ssh pfsense` validado (BatchMode OK). +6. **WAN admin lock (2026-09-11):** removida EasyRule `pass any→:22`; regras **block** WAN→`wanip:22` e WAN→`wanip:10443`. Validado: WAN bloqueado; Tailscale `:18443` + LAN SSH/GUI OK. Backup: `/root/config-backup-before-wan-admin-lock-*.xml` no pfSense. ---