ligbox/obsidian-vault
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update pfSense ACCESS/SPEC-053 with WAN admin lock details.

Browse source 
Document Tailscale-only SSH/WebGUI after removing EasyRule :22 and blocking wanip 22/10443.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Roger 2026-09-11 17:22:23 +02:00
parent cf2c0fba23
commit 2ca126b00c
3 changed files with 47 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

60
Infra-Network/ACCESS-PFSENSE.md
View file

@ -1,33 +1,40 @@
# ACCESS — pfSense (VM 100) privado # ACCESS — pfSense (VM 100) privado
**Status:** canónico · **Data:** 2026-09-11 (chave SSH) **Status:** canónico · **Atualizado:** 2026-09-11
**SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md` **SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`
**Operador:** Roger **Operador:** Roger
> **Não** usar `https://firewall.itecnologys.com` (despublicado). > **Não** usar `https://firewall.itecnologys.com` (despublicado).
> SSH **não** está na WAN — sempre via Tailscale → big1 (`ProxyJump`) ou LAN. > **Não** usar IP WAN `95.216.14.146` nas portas **22** / **10443** (bloqueadas na WAN).
## WebGUI ---
## Como aceder de qualquer sítio do mundo
1. Instalar/ligar **Tailscale** no telemóvel ou PC
2. Usar os URLs / SSH abaixo (passa pelo big1)
### WebGUI (interface gráfica)
| Canal | URL | | Canal | URL |
|-------|-----| |-------|-----|
| Tailscale (PC) | **https://100.116.138.100:18443/** | | **Tailscale (canónico)** | **https://100.116.138.100:18443/** |
| LAN (VM) | https://10.10.10.1:10443/ | | LAN (VM na rede) | https://10.10.10.1:10443/ |
| Consola | Proxmox → VM 100 | | Consola | Proxmox → VM **100** → Console |
Serviço big1: `pfsense-admin-ts.service` (enabled). Serviço big1: `pfsense-admin-ts.service` (enabled)
`100.116.138.100:18443` → `10.10.10.1:10443`
## SSH com chave (qualquer sítio com Tailscale) ### SSH (consola / terminal)
| Item | Valor | | Item | Valor |
|------|--------| |------|--------|
| User | `admin` | | User | `admin` |
| Host LAN | `10.10.10.1:22` | | Host LAN | `10.10.10.1:22` |
| Chave (big1) | `/root/.ssh/pfsense_roger_ed25519` | | Chave no big1 | `/root/.ssh/pfsense_roger_ed25519` |
| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` | | Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` |
| Comment | `roger@pfsense-anywhere-2026-09-11` |
### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`) #### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`)
``` ```
-----BEGIN OPENSSH PRIVATE KEY----- -----BEGIN OPENSSH PRIVATE KEY-----
@ -40,13 +47,7 @@ ECAwQ=
-----END OPENSSH PRIVATE KEY----- -----END OPENSSH PRIVATE KEY-----
``` ```
### Pública (já no pfSense → System → User Manager → admin) #### `~/.ssh/config` no PC / telemóvel (Termius, etc.)
```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11
```
### `~/.ssh/config` no PC
```sshconfig ```sshconfig
Host big1 Host big1
@ -70,7 +71,23 @@ chmod 600 ~/.ssh/pfsense_roger_ed25519
ssh pfsense ssh pfsense
``` ```
No big1 (já configurado): `ssh pfsense` (sem ProxyJump). No big1: `ssh pfsense` (já configurado).
---
## O que foi fechado na WAN (2026-09-11)
| Destino | Estado |
|---------|--------|
| WAN `95.216.14.146:22` (SSH do pfSense) | **BLOCK** |
| WAN `95.216.14.146:10443` (WebGUI) | **BLOCK** |
| EasyRule antiga `pass any → :22` | **Removida** |
| SSH VMs via NAT `2501–2515` | Mantido (outra coisa) |
| Odoo HAProxy `:80/:443` | Mantido (serviço) |
Backup config: `/root/config-backup-before-wan-admin-lock-*.xml` no pfSense.
---
## API (só privado / big1) ## API (só privado / big1)
@ -79,3 +96,8 @@ curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system'
``` ```
Não reabrir Traefik público sem nova SPEC. Não reabrir Traefik público sem nova SPEC.
## Relacionado
- `ACCESS-BIG1.md` — Proxmox WebUI / SSH do host (mesmo modelo Tailscale)
- `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`

5
Infra-Network/README.md
View file

@ -9,3 +9,8 @@ SPECs de rede (big / BIG1 / routers). Repo Forgejo: a criar `ligbox/infra-networ
| R8000 credentials | SPEC_R8000_CREDENTIALS.md | | R8000 credentials | SPEC_R8000_CREDENTIALS.md |
| SPEC-VM500 Rent Charge | SPEC-VM500-RENTCHARGE.md | | SPEC-VM500 Rent Charge | SPEC-VM500-RENTCHARGE.md |
| Cursor Tapo Tuya MCP (2026-09-08) | CURSOR_TAPO_TUYA_MCP.md | | Cursor Tapo Tuya MCP (2026-09-08) | CURSOR_TAPO_TUYA_MCP.md |
## Admin privado (Tailscale)
- [[ACCESS-PFSENSE]] · [[SPEC-053-PFSENSE-PRIVATE-ADMIN]]
- [[ACCESS-BIG1]] · [[SPEC-054-PROXMOX-PRIVATE-ADMIN]]

1
Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md
View file

@ -157,6 +157,7 @@ Alterações NAT/firewall: **só com OK explícito do Roger**.
3. Criado e enabled: `pfsense-admin-ts.service` no big1. 3. Criado e enabled: `pfsense-admin-ts.service` no big1.
4. Validação: público `firewall.itecnologys.com` → 404; TS `:18443` → 200 Login; `rently.myvexx.com` OK. 4. Validação: público `firewall.itecnologys.com` → 404; TS `:18443` → 200 Login; `rently.myvexx.com` OK.
5. Chave SSH `pfsense_roger_ed25519` gerada no big1 e instalada em `admin` via API (`authorizedkeys`); login `ssh pfsense` validado (BatchMode OK). 5. Chave SSH `pfsense_roger_ed25519` gerada no big1 e instalada em `admin` via API (`authorizedkeys`); login `ssh pfsense` validado (BatchMode OK).
6. **WAN admin lock (2026-09-11):** removida EasyRule `pass any→:22`; regras **block** WAN→`wanip:22` e WAN→`wanip:10443`. Validado: WAN bloqueado; Tailscale `:18443` + LAN SSH/GUI OK. Backup: `/root/config-backup-before-wan-admin-lock-*.xml` no pfSense.
--- ---