ligbox/obsidian-vault
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
obsidian-vault/Infra-Network/SPEC-056-PFSENSE-CF-TUNNEL-ACCESS.md
Roger d75b4d9319 SPEC-056: pfSense WebGUI via Cloudflare Tunnel and Access. 
firewall.itecnologys.com uses Access OTP; Tailscale :18443 remains break-glass.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-11 18:44:06 +02:00

1.2 KiB
Raw Blame History

SPEC-056 — pfSense WebGUI via Cloudflare Tunnel + Access

Criado: 2026-09-11
Operador: Roger
Status: ✅ IMPLEMENTADO
Relacionado: SPEC-053 · SPEC-055 · ACCESS-PFSENSE.md

Objectivo

Mesmo modelo do Proxmox (SPEC-055): browser no mundo → Cloudflare Access (OTP email) → Tunnel → pfSense WebGUI, sem abrir :10443 na WAN.

Decisão

Item Valor
Hostname https://firewall.itecnologys.com/
Access app pfsense-big1-spec056
Allow admin@itecnologys.com
Tunnel big1-pve-admin (7e693c4a-9138-4b44-b7fe-68322b83226a)
Origin https://10.10.10.1:10443 (noTLSVerify)
DNS CNAME proxied → *.cfargotunnel.com (substitui A → WAN)
Break-glass Tailscale https://100.116.138.100:18443/

Validação (2026-09-11)

  • https://firewall.itecnologys.com/ → 302 Cloudflare Access
  • Tunnel healthy
  • Tailscale :18443 e LAN :10443 → 200
  • Proxmox hostname no mesmo túnel → intacto

Fora de âmbito

  • SSH pfSense continua só LAN + ProxyJump (SPEC-053)
  • API pública via este hostname: não (Access bloqueia scripts Basic Auth) — usar LAN/Tailscale