# ACCESS — pfSense (VM 100) privado

**Status:** canónico · **Atualizado:** 2026-09-11  
**SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`  
**Operador:** Roger

> **Não** usar IP WAN `95.216.14.146` nas portas **22** / **10443** (bloqueadas na WAN).  
> WebGUI pública só via **Cloudflare Access** (não expor admin directo na WAN).

---

## Como aceder de qualquer sítio do mundo

### WebGUI (interface gráfica)

| Canal | URL |
|-------|-----|
| **Browser (mundo) + CF Access** | **https://firewall.itecnologys.com/** — login `admin@itecnologys.com` |
| **Tailscale (break-glass)** | **https://100.116.138.100:18443/** |
| LAN (VM na rede) | https://10.10.10.1:10443/ |
| Consola | Proxmox → VM **100** → Console |

Tunnel: `cloudflared-pve-admin.service` · origin `https://10.10.10.1:10443` · **SPEC-056**  
Serviço Tailscale big1: `pfsense-admin-ts.service` · `100.116.138.100:18443` → `10.10.10.1:10443`

**API** (`/api/v2/`): usar LAN/Tailscale (`https://10.10.10.1:10443` ou `:18443`) — o hostname público exige Access (OTP), não serve para Basic Auth em scripts.

### SSH (consola / terminal)

| Item | Valor |
|------|--------|
| User | `admin` |
| Host LAN | `10.10.10.1:22` |
| Chave no big1 | `/root/.ssh/pfsense_roger_ed25519` |
| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` |

#### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`)

```
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+
nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg
AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr
fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ
ECAwQ=
-----END OPENSSH PRIVATE KEY-----
```

#### `~/.ssh/config` no PC / telemóvel (Termius, etc.)

```sshconfig
Host big1
    HostName 100.116.138.100
    User root
    Port 4422
    IdentityFile ~/.ssh/id_ed25519

Host pfsense
    HostName 10.10.10.1
    User admin
    Port 22
    ProxyJump big1
    IdentityFile ~/.ssh/pfsense_roger_ed25519
    IdentitiesOnly yes
    StrictHostKeyChecking accept-new
```

```bash
chmod 600 ~/.ssh/pfsense_roger_ed25519
ssh pfsense
```

No big1: `ssh pfsense` (já configurado).

---

## O que foi fechado na WAN (2026-09-11)

| Destino | Estado |
|---------|--------|
| WAN `95.216.14.146:22` (SSH do pfSense) | **BLOCK** |
| WAN `95.216.14.146:10443` (WebGUI) | **BLOCK** |
| EasyRule antiga `pass any → :22` | **Removida** |
| SSH VMs via NAT `2501–2515` | Mantido (outra coisa) |
| Odoo HAProxy `:80/:443` | Mantido (serviço) |

Backup config: `/root/config-backup-before-wan-admin-lock-*.xml` no pfSense.

---

## API (só privado / big1)

```bash
curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system'
```

Não reabrir Traefik público sem nova SPEC.

## Relacionado

- `ACCESS-BIG1.md` — Proxmox WebUI / SSH do host (mesmo modelo Tailscale)
- `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`