# Access map — WG Paid / MGTS

Generated: 2026-07-06T15:37:48+00:00

## Purpose

This document records the current administrative access path for the WG Paid / pve-wg-paid project.

The important architecture decision:

```text
VM121 wg-access-dev has its own direct admin WireGuard access to MGTS 10.71.100.0/24.
VM130/router-ops is an operator/control node only.
VM130 is not a transit router for VM121.
```

## Main networks

```text
MGTS management LAN:       10.71.100.0/24
MGTS VM100 OpenWRT core:   10.71.100.1
MGTS VM101 OpenWRT edge:   10.71.100.2
MGTS Proxmox pve-wg-paid:  10.71.100.222

Admin WG remote network:   10.250.100.0/24
VM121 direct admin peer:   10.250.100.121/32

Paid WG client network:    10.253.0.0/16
MGTS VM100 wg_paid addr:   10.253.1.1/16
MGTS VM100 wg_paid port:   UDP 51830
```

## Confirmed access paths

### router-ops -> pve-mgts

```text
source host: router-ops.local
source user: root
ssh alias:   pve-mgts
ssh user:    root
ssh target:  pve-mgts
```

SSH identity fingerprints seen from router-ops:

```text
- /root/.ssh/id_rsa: file not found on router-ops
- /root/.ssh/id_ecdsa: file not found on router-ops
- /root/.ssh/id_ecdsa_sk: file not found on router-ops
- /root/.ssh/id_ed25519: file not found on router-ops
- /root/.ssh/id_ed25519_sk: file not found on router-ops
- /root/.ssh/id_xmss: file not found on router-ops
- /root/.ssh/id_dsa: file not found on router-ops
```

### router-ops -> VM121

```text
ssh alias:   vm121
ssh user:    root
ssh target:  vm121
```

SSH identity fingerprints seen from router-ops:

```text
- /root/.ssh/id_rsa: file not found on router-ops
- /root/.ssh/id_ecdsa: file not found on router-ops
- /root/.ssh/id_ecdsa_sk: file not found on router-ops
- /root/.ssh/id_ed25519: file not found on router-ops
- /root/.ssh/id_ed25519_sk: file not found on router-ops
- /root/.ssh/id_xmss: file not found on router-ops
- /root/.ssh/id_dsa: file not found on router-ops
```

### VM121 -> MGTS over wg-mgts

VM121 has direct route to MGTS management LAN through its own WireGuard interface.

```text
VM121 wg interface:        wg-mgts
VM121 wg address:          10.250.100.121/32
MGTS wg_remote server:     10.250.100.1
Reachable MGTS targets:    10.71.100.1, 10.71.100.2, 10.71.100.222
```

Collected VM121 wg-mgts facts:

```text
ssh: Could not resolve hostname vm121: Name or service not known
```

### pve-mgts -> VM100 / VM101

From MGTS Proxmox:

```text
ssh root@10.71.100.1
ssh root@10.71.100.2
```

Collected pve-mgts facts and SSH key fingerprints:

```text
ssh: Could not resolve hostname pve-mgts: Name or service not known
```

## Confirmed smoke tests

### STEP_003

```text
VM121 -> 10.71.100.1    OK
VM121 -> 10.71.100.2    OK
VM121 -> 10.71.100.222  OK

Route source:
10.250.100.121 via wg-mgts
```

### STEP_004A

```text
MGTS VM101 internet: OK
MGTS VM100 internet via VM101: OK
External IP during test: 94.45.208.160
```

### STEP_004B

```text
Temporary wg_paid client from VM121: 10.253.254.121/32

Handshake to MGTS VM100 wg_paid: OK
Ping 10.253.1.1: OK
Ping 1.1.1.1 through wg_paid: OK
Ping 8.8.8.8 through wg_paid: OK
External IP through wg_paid during test: 94.45.208.160

Temporary peer/client cleaned up after test.
```

## Operational notes

```text
Do not route VM121 through VM130.
VM130/router-ops remains an operator/control node only.
VM121 must keep direct wg-mgts access to MGTS 10.71.100.0/24.
Private keys are not stored in this document.
Only public keys/fingerprints are recorded.
```