sudo nft list chain inet filter input

sudo nft add rule inet filter input tcp dport 8080 accept

sudo nft list chain inet filter forward

chain forward {
  type filter hook forward priority 0; policy drop;
  # Bestehende Verbindungen immer durchlassen
  ct state established,related accept

  # VLAN10 (Server) ↔ VLAN20 (Büro): bidirektional erlaubt
  iifname "ens37.10" oifname "ens37.20" accept
  iifname "ens37.20" oifname "ens37.10" accept

  # VLAN10 + VLAN20 → Internet erlaubt
  iifname "ens37.10" oifname "ens33" accept
  iifname "ens37.20" oifname "ens33" accept

  # VLAN30 (Gäste) → NUR Internet, keine anderen VLANs
  iifname "ens37.30" oifname "ens33" accept

  # VLAN40 (Management) → alles erlaubt
  iifname "ens37.40" accept
  iifname "ens38"    accept

  # WireGuard → alle VLANs
  iifname "wg0" accept
}

sudo nft list table ip nat

table ip nat {
  chain postrouting {
    type nat hook postrouting priority 100;
    # NAT für alle VLANs → Internet (ens33 = WAN)
    oifname "ens33" masquerade
  }
}

sudo conntrack -L | grep ESTABLISHED | head -20

sudo systemctl status nftables
sudo systemctl restart nftables
sudo systemctl enable nftables

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    # Loopback immer erlauben
    iifname "lo" accept
    # Bestehende Verbindungen erlauben
    ct state established,related accept
    # ICMP (Ping) erlauben
    ip protocol icmp accept
    # SSH von ueberall erlauben (Port 22)
    tcp dport 22 accept
    # Web-Interface (Zabbix + allgemein)
    tcp dport 80 accept
    tcp dport 443 accept
    tcp dport 10051 accept
    # DHCP erlauben
    udp dport 67 accept
    # DNS erlauben
    tcp dport 53 accept
    udp dport 53 accept
    # WireGuard VPN Port
    udp dport 51820 accept
    # Netdata nur aus Management-VLAN
    iifname "ens37.40" tcp dport 19999 accept
    iifname "ens38"    tcp dport 19999 accept
  }
  chain forward {
    type filter hook forward priority 0; policy drop;
    ct state established,related accept
    iifname "ens37.10" oifname "ens37.20" accept
    iifname "ens37.20" oifname "ens37.10" accept
    iifname "ens37.10" oifname "ens33" accept
    iifname "ens37.20" oifname "ens33" accept
    iifname "ens37.30" oifname "ens33" accept
    iifname "ens37.40" accept
    iifname "ens38"    accept
    iifname "wg0"      accept
  }
  chain output {
    type filter hook output priority 0; policy accept;
  }
}
table ip nat {
  chain postrouting {
    type nat hook postrouting priority 100;
    oifname "ens33" masquerade
  }
}

sudo nft -f /etc/nftables.conf

network:
  version: 2
  ethernets:
    ens33:
      dhcp4: true       # WAN - bekommt IP via DHCP
      dhcp6: false
    ens37:
      dhcp4: false      # VLAN Trunk - kein eigenes IP
      dhcp6: false
    ens38:
      dhcp4: false      # LAN Interface
      dhcp6: false
      addresses:
        - 192.168.50.1/24

  vlans:
    ens37.10:
      id: 10
      link: ens37
      addresses:
        - 192.168.10.1/24   # VLAN 10 - Server

    ens37.20:
      id: 20
      link: ens37
      addresses:
        - 192.168.20.1/24   # VLAN 20 - Büro

    ens37.30:
      id: 30
      link: ens37
      addresses:
        - 192.168.30.1/24   # VLAN 30 - Gäste

    ens37.40:
      id: 40
      link: ens37
      addresses:
        - 192.168.40.2/24   # VLAN 40 - Management

sudo netplan apply

sudo netplan try

sudo netplan generate

ip a
ip link show

ip a | grep ens37
cat /proc/net/vlan/config

[Interface]
Address     = 10.0.0.1/24
ListenPort  = 51820
PrivateKey  = <!-- Hier Private Key -->

PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens33 -j MASQUERADE

# Client: mario@ubuntu24
[Peer]
PublicKey  = <!-- Hier mario Public Key -->
AllowedIPs = 10.0.0.2/32

sudo systemctl status wg-quick@wg0
sudo systemctl restart wg-quick@wg0
sudo systemctl enable wg-quick@wg0

[Interface]
Address    = 10.0.0.2/24
PrivateKey = <!-- Hier mario Private Key -->
DNS        = 10.0.0.1

[Peer]
PublicKey  = <!-- Hier silvestru Public Key -->
AllowedIPs = 10.0.0.0/24
Endpoint   = 192.168.100.22:6890
PersistentKeepalive = 25

# Auf dem neuen Client:
wg genkey | tee privatekey | wg pubkey > publickey
cat privatekey
cat publickey

# Auf silvestru den neuen Peer hinzufügen:
sudo wg set wg0 peer <CLIENT_PUBKEY> allowed-ips 10.0.0.3/32

sudo wg show
sudo wg show wg0
sudo wg show wg0 transfer

sudo wg-quick up wg0
sudo wg-quick down wg0

wg genkey | tee privatekey | wg pubkey > publickey
cat privatekey
cat publickey

# Vom Client zum Server pingen:
ping 10.0.0.1

# Vom Server zum Client pingen:
ping 10.0.0.2

Interface : ens37.10@ens37
VLAN ID   : 10
IP        : 192.168.10.1/24
Hosts     : 192.168.10.2 - 192.168.10.254
Zugriff   : ens37.20 (bidirektional), Internet

Interface : ens37.20@ens37
VLAN ID   : 20
IP        : 192.168.20.1/24
Hosts     : 192.168.20.2 - 192.168.20.254
Zugriff   : ens37.10 (bidirektional), Internet

Interface : ens37.30@ens37
VLAN ID   : 30
IP        : 192.168.30.1/24
Hosts     : 192.168.30.2 - 192.168.30.254
Zugriff   : NUR Internet (andere VLANs geblockt)

Interface : ens37.40@ens37
VLAN ID   : 40
IP        : 192.168.40.2/24
Hosts     : 192.168.40.1 - 192.168.40.254
Zugriff   : ALLE VLANs + Internet (full access)

ip link show type vlan
cat /proc/net/vlan/config

ip a show ens37.10
ip a show ens37.20
ip a show ens37.30
ip a show ens37.40

sudo tcpdump -i ens37.10 -n
sudo tcpdump -i ens37.20 -n

ip route show
ip route show table all

# Globale Einstellungen
default-lease-time 600;
max-lease-time 7200;
authoritative;

# DNS-Server fuer alle VLANs
option domain-name-servers 1.1.1.1, 8.8.8.8;

# VLAN 10 - Server (192.168.10.0/24)
subnet 192.168.10.0 netmask 255.255.255.0 {
  range 192.168.10.100 192.168.10.200;
  option routers 192.168.10.1;
  option domain-name "server.local";
}

# VLAN 20 - Buero (192.168.20.0/24)
subnet 192.168.20.0 netmask 255.255.255.0 {
  range 192.168.20.100 192.168.20.200;
  option routers 192.168.20.1;
  option domain-name "buero.local";
}

# VLAN 30 - Gaeste/IoT (192.168.30.0/24)
subnet 192.168.30.0 netmask 255.255.255.0 {
  range 192.168.30.100 192.168.30.200;
  option routers 192.168.30.1;
  option domain-name "gaeste.local";
}

# VLAN 40 - Management (192.168.40.0/24)
subnet 192.168.40.0 netmask 255.255.255.0 {
  range 192.168.40.100 192.168.40.200;
  option routers 192.168.40.1;
  option domain-name "mgmt.local";
}

# ens38 - Management direkt (192.168.50.0/24)
subnet 192.168.50.0 netmask 255.255.255.0 {
  range 192.168.50.100 192.168.50.200;
  option routers 192.168.50.1;
  option domain-name "mgmt2.local";
}

sudo systemctl status isc-dhcp-server
sudo systemctl restart isc-dhcp-server

cat /var/lib/dhcp/dhcpd.leases

sudo tail -f /var/lib/dhcp/dhcpd.leases

sudo journalctl -u isc-dhcp-server -f
sudo journalctl -u isc-dhcp-server --since "1 hour ago"

sudo dhcpd -t -cf /etc/dhcp/dhcpd.conf

server:
    # Interfaces auf denen Unbound lauscht
    interface: 127.0.0.1
    interface: 192.168.10.1
    interface: 192.168.20.1
    interface: 192.168.30.1
    interface: 192.168.40.2
    interface: 192.168.50.1

    # Zugriffskontrolle pro Subnetz
    access-control: 127.0.0.0/8 allow
    access-control: 192.168.10.0/24 allow
    access-control: 192.168.20.0/24 allow
    access-control: 192.168.30.0/24 allow
    access-control: 192.168.40.0/24 allow
    access-control: 192.168.50.0/24 allow

    # Protokolle
    do-ip4: yes
    do-ip6: no
    do-udp: yes
    do-tcp: yes

    # Cache Einstellungen
    cache-min-ttl: 300
    cache-max-ttl: 86400
    prefetch: yes
    prefetch-key: yes

    # Sicherheit
    hide-identity: yes
    hide-version: yes

    # Logging
    use-syslog: yes
    verbosity: 1

    # Upstream DNS (Forwarder)
    forward-zone:
        name: "."
        forward-addr: 1.1.1.1
        forward-addr: 8.8.8.8

remote-control:
    control-enable: yes
    control-interface: /run/unbound.ctl

sudo systemctl status unbound
sudo systemctl restart unbound

dig @192.168.10.1 google.com
dig @127.0.0.1 google.com
nslookup google.com 192.168.10.1

sudo unbound-control flush_zone .
sudo unbound-control reload

sudo unbound-control stats
sudo unbound-control stats_noreset

sudo unbound-checkconf

sudo journalctl -u unbound -f
sudo journalctl -u unbound --since "1 hour ago"

LogFile=/var/log/zabbix/zabbix_server.log
LogFileSize=0
PidFile=/run/zabbix/zabbix_server.pid
SocketDir=/run/zabbix

# Datenbank
DBHost=localhost
DBName=zabbix
DBUser=zabbix
DBPassword=<!-- Hier dein DB Passwort -->

# Sonstiges
Timeout=4
FpingLocation=/usr/bin/fping
Fping6Location=/usr/bin/fping6
LogSlowQueries=3000
StatsAllowedIP=127.0.0.1
EnableGlobalScripts=0
Include=/etc/zabbix/zabbix_server.d/*.conf

sudo cat /etc/zabbix/zabbix_agent2.conf | grep -v "^#" | grep -v "^$"

sudo systemctl status zabbix-server
sudo systemctl status zabbix-agent2
sudo systemctl restart zabbix-server

sudo tail -f /var/log/zabbix/zabbix_server.log
sudo tail -f /var/log/zabbix/zabbix_agent2.log

mysql -u zabbix -p zabbix -e "SELECT COUNT(*) FROM history;"

http://192.168.100.22/zabbix
# Standard Login: Admin / zabbix

zabbix_server --version
zabbix_agent2 --version

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

<VirtualHost *:80>
    ServerName silvestru-liviu.de
    ServerAlias www.silvestru-liviu.de
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

<VirtualHost *:443>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/silvestru-liviu.de/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/silvestru-liviu.de/privkey.pem

    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

sudo systemctl status apache2
sudo systemctl restart apache2
sudo apache2ctl configtest

sudo apache2ctl -S
sudo a2ensite meine-seite.conf
sudo a2dissite meine-seite.conf

sudo a2enmod ssl
sudo a2enmod headers
sudo a2enmod rewrite

sudo certbot renew --dry-run
sudo certbot renew

sudo tail -f /var/log/apache2/error.log
sudo tail -f /var/log/apache2/access.log

[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 3
backend  = systemd

[sshd]
enabled  = true
port     = 22
logpath  = /var/log/auth.log
maxretry = 3
bantime  = 7200      # SSH: 2h Ban

[zabbix-web]
enabled  = true
port     = 80,443
logpath  = /var/log/apache2/access.log
maxretry = 5
bantime  = 3600

[apache-auth]
enabled  = true
port     = 80,443
logpath  = /var/log/apache2/error.log
maxretry = 3
bantime  = 3600

sudo systemctl status fail2ban
sudo fail2ban-client status

sudo fail2ban-client status sshd
sudo fail2ban-client status zabbix-web
sudo fail2ban-client status apache-auth

sudo fail2ban-client status sshd | grep "Banned IP"
sudo iptables -L f2b-sshd -n

sudo fail2ban-client set sshd unbanip 192.168.1.100

sudo fail2ban-client set sshd banip 192.168.1.100

sudo tail -f /var/log/fail2ban.log

sudo systemctl status mysql
sudo systemctl restart mysql

# Als root
sudo mysql

# Als zabbix user
mysql -u zabbix -p zabbix

SHOW DATABASES;
USE zabbix;
SHOW TABLES;
SELECT COUNT(*) FROM history;

sudo mysqldump -u root zabbix > zabbix_backup.sql
sudo mysqldump --all-databases > all_backup.sql

sudo mysql zabbix < zabbix_backup.sql

sudo mysqladmin status
sudo mysqladmin processlist

# Auf dem Client generieren:
ssh-keygen -t ed25519 -C "john@server"

# Gespeichert in:
# ~/.ssh/id_ed25519       (Private Key)
# ~/.ssh/id_ed25519.pub   (Public Key)

ssh-copy-id -i ~/.ssh/id_ed25519.pub john@192.168.100.22

# Oder manuell:
cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys

cat ~/.ssh/authorized_keys

# ~/.ssh/config auf dem Client:
Host silvestru
    HostName 192.168.100.22
    User profi24
    IdentityFile ~/.ssh/id_ed25519

ssh profi24@192.168.100.22
ssh profi24@192.168.100.22 -i ~/.ssh/id_ed25519

sudo systemctl status ssh
sudo systemctl restart ssh

who
ss -tnp | grep :22
sudo netstat -tnp | grep :22

sudo journalctl -u ssh -f
sudo tail -f /var/log/auth.log | grep sshd

sudo sshd -t
sudo sshd -T | grep -E "pubkey|password|root"

sudo systemctl start <dienst>
sudo systemctl stop <dienst>
sudo systemctl restart <dienst>
sudo systemctl status <dienst>

sudo systemctl enable <dienst>
sudo systemctl disable <dienst>

systemctl list-units --type=service --state=running

systemctl --failed

sudo journalctl -f
sudo journalctl -u <dienst> -f
sudo journalctl --since "1 hour ago"

sudo systemctl reboot
sudo systemctl poweroff

crontab -e          # Eigene Crontab
sudo crontab -e     # Root Crontab
crontab -l          # Crontab anzeigen

cat /etc/crontab
ls /etc/cron.d/
ls /etc/cron.daily/
ls /etc/cron.weekly/

sudo grep CRON /var/log/syslog | tail -20
sudo journalctl -u cron -f

sudo systemctl status cron
sudo systemctl restart cron

Zentraler API Gateway mit API-Key Authentifizierung.
Stack: Flask · Docker · Nginx · Python
Port: 5000/TCP

Ubuntu Home Server mit Docker-Services.
Stack: Ubuntu · Docker · Nextcloud · PostgreSQL
Services: Portainer, pgAdmin, Heimdall

Diese Webseite — 100% self-hosted.
Stack: HTML · CSS · Nginx · Docker

18 Sicherheitsmaßnahmen · alle 65535 Ports gefiltert.
Stack: PowerShell · Nmap · Firewall · Security

Ansible Playbook: SSH, UFW, Fail2ban, sysctl, Auditd.
Stack: Ansible · SSH · UFW · Fail2ban · Linux
Datum: 25. März 2026

6 Azure Labs: VM, App Service, Blob, SQL, VNet, Functions.
Stack: Azure · Cloud · IaaS · PaaS · Serverless
Datum: 27. März 2026

docker ps | grep meine-website
docker logs meine-website

docker restart meine-website

nano /ctl/claude/nginx/html/index.html
# Änderungen sofort aktiv - kein Neustart nötig!

docker ps --format "table {{.Names}}	{{.Status}}	{{.Ports}}"

docker exec meine-website nginx -t
cat /xxxxx/xxxxx/nginx/conf/default.conf