diff --git a/Infra-Network/ACCESS-PFSENSE.md b/Infra-Network/ACCESS-PFSENSE.md
index 1bb326d..17c724f 100644
--- a/Infra-Network/ACCESS-PFSENSE.md
+++ b/Infra-Network/ACCESS-PFSENSE.md
@@ -4,26 +4,26 @@
 **SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`  
 **Operador:** Roger
 
-> **Não** usar `https://firewall.itecnologys.com` (despublicado).  
-> **Não** usar IP WAN `95.216.14.146` nas portas **22** / **10443** (bloqueadas na WAN).
+> **Não** usar IP WAN `95.216.14.146` nas portas **22** / **10443** (bloqueadas na WAN).  
+> WebGUI pública só via **Cloudflare Access** (não expor admin directo na WAN).
 
 ---
 
 ## Como aceder de qualquer sítio do mundo
 
-1. Instalar/ligar **Tailscale** no telemóvel ou PC  
-2. Usar os URLs / SSH abaixo (passa pelo big1)
-
 ### WebGUI (interface gráfica)
 
 | Canal | URL |
 |-------|-----|
-| **Tailscale (canónico)** | **https://100.116.138.100:18443/** |
+| **Browser (mundo) + CF Access** | **https://firewall.itecnologys.com/** — login `admin@itecnologys.com` |
+| **Tailscale (break-glass)** | **https://100.116.138.100:18443/** |
 | LAN (VM na rede) | https://10.10.10.1:10443/ |
 | Consola | Proxmox → VM **100** → Console |
 
-Serviço big1: `pfsense-admin-ts.service` (enabled)  
-`100.116.138.100:18443` → `10.10.10.1:10443`
+Tunnel: `cloudflared-pve-admin.service` · origin `https://10.10.10.1:10443` · **SPEC-056**  
+Serviço Tailscale big1: `pfsense-admin-ts.service` · `100.116.138.100:18443` → `10.10.10.1:10443`
+
+**API** (`/api/v2/`): usar LAN/Tailscale (`https://10.10.10.1:10443` ou `:18443`) — o hostname público exige Access (OTP), não serve para Basic Auth em scripts.
 
 ### SSH (consola / terminal)
 
diff --git a/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md b/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md
index aa121da..23374fb 100644
--- a/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md
+++ b/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md
@@ -4,7 +4,10 @@
 **Operador:** Roger  
 **Status:** ✅ Implementado no **big1**  
 **Sistemas:** Proxmox **big1** · VM **100** pfSense · Traefik CT114 · Cloudflare zona `itecnologys.com` · Tailscale  
-**Relacionado:** Spec 045 (hardening big1) · `ACCESS-BIG1.md` · `role_network_security.txt`
+**Relacionado:** Spec 045 · SPEC-056 · `ACCESS-BIG1.md` · `role_network_security.txt`
+
+> **Update 2026-09-11 (SPEC-056):** `firewall.itecnologys.com` voltou como canal **browser** via CF Tunnel+Access (não é exposição directa WAN). Tailscale `:18443` permanece break-glass.
+
 
 ---
 
diff --git a/Infra-Network/SPEC-056-PFSENSE-CF-TUNNEL-ACCESS.md b/Infra-Network/SPEC-056-PFSENSE-CF-TUNNEL-ACCESS.md
new file mode 100644
index 0000000..18d3136
--- /dev/null
+++ b/Infra-Network/SPEC-056-PFSENSE-CF-TUNNEL-ACCESS.md
@@ -0,0 +1,42 @@
+# SPEC-056 — pfSense WebGUI via Cloudflare Tunnel + Access
+
+**Criado:** 2026-09-11  
+**Operador:** Roger  
+**Status:** ✅ IMPLEMENTADO  
+**Relacionado:** SPEC-053 · SPEC-055 · `ACCESS-PFSENSE.md`
+
+---
+
+## Objectivo
+
+Mesmo modelo do Proxmox (SPEC-055): browser no mundo → **Cloudflare Access** (OTP email) → Tunnel → pfSense WebGUI, **sem** abrir `:10443` na WAN.
+
+---
+
+## Decisão
+
+| Item | Valor |
+|------|--------|
+| Hostname | `https://firewall.itecnologys.com/` |
+| Access app | `pfsense-big1-spec056` |
+| Allow | `admin@itecnologys.com` |
+| Tunnel | `big1-pve-admin` (`7e693c4a-9138-4b44-b7fe-68322b83226a`) |
+| Origin | `https://10.10.10.1:10443` (`noTLSVerify`) |
+| DNS | CNAME proxied → `*.cfargotunnel.com` (substitui A → WAN) |
+| Break-glass | Tailscale `https://100.116.138.100:18443/` |
+
+---
+
+## Validação (2026-09-11)
+
+- `https://firewall.itecnologys.com/` → **302** Cloudflare Access
+- Tunnel **healthy**
+- Tailscale `:18443` e LAN `:10443` → **200**
+- Proxmox hostname no mesmo túnel → intacto
+
+---
+
+## Fora de âmbito
+
+- SSH pfSense continua só LAN + ProxyJump (SPEC-053)
+- API pública via este hostname: **não** (Access bloqueia scripts Basic Auth) — usar LAN/Tailscale