Roger
d75b4d9319
firewall.itecnologys.com uses Access OTP; Tailscale :18443 remains break-glass. Co-authored-by: Cursor <cursoragent@cursor.com>
103 lines
3 KiB
Markdown
103 lines
3 KiB
Markdown
# ACCESS — pfSense (VM 100) privado
|
||
|
||
**Status:** canónico · **Atualizado:** 2026-09-11
|
||
**SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`
|
||
**Operador:** Roger
|
||
|
||
> **Não** usar IP WAN `95.216.14.146` nas portas **22** / **10443** (bloqueadas na WAN).
|
||
> WebGUI pública só via **Cloudflare Access** (não expor admin directo na WAN).
|
||
|
||
---
|
||
|
||
## Como aceder de qualquer sítio do mundo
|
||
|
||
### WebGUI (interface gráfica)
|
||
|
||
| Canal | URL |
|
||
|-------|-----|
|
||
| **Browser (mundo) + CF Access** | **https://firewall.itecnologys.com/** — login `admin@itecnologys.com` |
|
||
| **Tailscale (break-glass)** | **https://100.116.138.100:18443/** |
|
||
| LAN (VM na rede) | https://10.10.10.1:10443/ |
|
||
| Consola | Proxmox → VM **100** → Console |
|
||
|
||
Tunnel: `cloudflared-pve-admin.service` · origin `https://10.10.10.1:10443` · **SPEC-056**
|
||
Serviço Tailscale big1: `pfsense-admin-ts.service` · `100.116.138.100:18443` → `10.10.10.1:10443`
|
||
|
||
**API** (`/api/v2/`): usar LAN/Tailscale (`https://10.10.10.1:10443` ou `:18443`) — o hostname público exige Access (OTP), não serve para Basic Auth em scripts.
|
||
|
||
### SSH (consola / terminal)
|
||
|
||
| Item | Valor |
|
||
|------|--------|
|
||
| User | `admin` |
|
||
| Host LAN | `10.10.10.1:22` |
|
||
| Chave no big1 | `/root/.ssh/pfsense_roger_ed25519` |
|
||
| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` |
|
||
|
||
#### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`)
|
||
|
||
```
|
||
-----BEGIN OPENSSH PRIVATE KEY-----
|
||
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
||
QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+
|
||
nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg
|
||
AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr
|
||
fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ
|
||
ECAwQ=
|
||
-----END OPENSSH PRIVATE KEY-----
|
||
```
|
||
|
||
#### `~/.ssh/config` no PC / telemóvel (Termius, etc.)
|
||
|
||
```sshconfig
|
||
Host big1
|
||
HostName 100.116.138.100
|
||
User root
|
||
Port 4422
|
||
IdentityFile ~/.ssh/id_ed25519
|
||
|
||
Host pfsense
|
||
HostName 10.10.10.1
|
||
User admin
|
||
Port 22
|
||
ProxyJump big1
|
||
IdentityFile ~/.ssh/pfsense_roger_ed25519
|
||
IdentitiesOnly yes
|
||
StrictHostKeyChecking accept-new
|
||
```
|
||
|
||
```bash
|
||
chmod 600 ~/.ssh/pfsense_roger_ed25519
|
||
ssh pfsense
|
||
```
|
||
|
||
No big1: `ssh pfsense` (já configurado).
|
||
|
||
---
|
||
|
||
## O que foi fechado na WAN (2026-09-11)
|
||
|
||
| Destino | Estado |
|
||
|---------|--------|
|
||
| WAN `95.216.14.146:22` (SSH do pfSense) | **BLOCK** |
|
||
| WAN `95.216.14.146:10443` (WebGUI) | **BLOCK** |
|
||
| EasyRule antiga `pass any → :22` | **Removida** |
|
||
| SSH VMs via NAT `2501–2515` | Mantido (outra coisa) |
|
||
| Odoo HAProxy `:80/:443` | Mantido (serviço) |
|
||
|
||
Backup config: `/root/config-backup-before-wan-admin-lock-*.xml` no pfSense.
|
||
|
||
---
|
||
|
||
## API (só privado / big1)
|
||
|
||
```bash
|
||
curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system'
|
||
```
|
||
|
||
Não reabrir Traefik público sem nova SPEC.
|
||
|
||
## Relacionado
|
||
|
||
- `ACCESS-BIG1.md` — Proxmox WebUI / SSH do host (mesmo modelo Tailscale)
|
||
- `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`
|