# ACCESS — pfSense (VM 100) privado

**Status:** canónico · **Data:** 2026-09-11 (chave SSH)  
**SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`  
**Operador:** Roger

> **Não** usar `https://firewall.itecnologys.com` (despublicado).  
> SSH **não** está na WAN — sempre via Tailscale → big1 (`ProxyJump`) ou LAN.

## WebGUI

| Canal | URL |
|-------|-----|
| Tailscale (PC) | **https://100.116.138.100:18443/** |
| LAN (VM) | https://10.10.10.1:10443/ |
| Consola | Proxmox → VM 100 |

Serviço big1: `pfsense-admin-ts.service` (enabled).

## SSH com chave (qualquer sítio com Tailscale)

| Item | Valor |
|------|--------|
| User | `admin` |
| Host LAN | `10.10.10.1:22` |
| Chave (big1) | `/root/.ssh/pfsense_roger_ed25519` |
| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` |
| Comment | `roger@pfsense-anywhere-2026-09-11` |

### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`)

```
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+
nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg
AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr
fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ
ECAwQ=
-----END OPENSSH PRIVATE KEY-----
```

### Pública (já no pfSense → System → User Manager → admin)

```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11
```

### `~/.ssh/config` no PC

```sshconfig
Host big1
    HostName 100.116.138.100
    User root
    Port 4422
    IdentityFile ~/.ssh/id_ed25519

Host pfsense
    HostName 10.10.10.1
    User admin
    Port 22
    ProxyJump big1
    IdentityFile ~/.ssh/pfsense_roger_ed25519
    IdentitiesOnly yes
    StrictHostKeyChecking accept-new
```

```bash
chmod 600 ~/.ssh/pfsense_roger_ed25519
ssh pfsense
```

No big1 (já configurado): `ssh pfsense` (sem ProxyJump).

## API (só privado / big1)

```bash
curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system'
```

Não reabrir Traefik público sem nova SPEC.