########################## SYSTEM
sudo timedatectl set-timezone Europe/Zagreb


sudo systemctl status NetworkManager.service
sudo systemctl daemon-reload


########################## SAMBA & NMBD


	Uređivanje konfiguracije
sudo nano /etc/samba/smb.conf

############# SMBD service

	Uređivanje servisa Samba
sudo systemctl edit smbd
[Service]
ExecStart=
ExecStart=/usr/sbin/smbd --foreground --no-process-group
Type=simple
Restart=on-failure
RestartSec=5


sudo systemctl daemon-reload
sudo systemctl restart smbd.service


	## Explanation of Each Directive

	ExecStart=
	Clears the original ExecStart from the main unit file.
	ExecStart=/usr/sbin/smbd --foreground --no-process-group
	Runs smbd in the foreground so systemd can track it properly.
	Type=simple
	Tells systemd the service runs in the foreground (not forking).
	Restart=on-failure
	Automatically restarts Samba if it crashes.
	RestartSec=5
	Waits 5 seconds before restarting.


	(Systemd wants the main process to stay attached. 
	Without --foreground, Samba detaches and systemd 
	assumes failure.)
	--foreground keeps smbd running in the foreground instead of daemonizing.
	--no-process-group prevents systemd from killing related processes when stopping the service.
	This matches systemd’s expectation: the main process stays active, so the service is considered healthy.


############# NMBD service

sudo systemctl edit nmbd

[Service]
ExecStart=
ExecStart=/usr/sbin/nmbd --foreground --no-process-group
Type=simple
Restart=on-failure
RestartSec=5

sudo systemctl daemon-reload
sudo systemctl restart nmbd.service

	ExecStart cleared and replaced: 
	  Ensures systemd runs nmbd in the foreground.
	Type=simple: Matches the non-forking behavior.
	Restart options: Adds resilience if the service crashes.

########################## NO-IP service

primjer
sudo apt install /home/unifi/Documents/noip-duc_3.3.0/binaries/noip-duc_3.3.0_amd64.deb

sudo nano /etc/systemd/system/noip-duc.service

sudo touch /var/log/noip-duc.log
                                                                       
  GNU nano 7.2          /etc/systemd/system/noip-duc.service  
                  
[Unit]
Description=No-IP Dynamic Update Client
After=network.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/noip-duc --hostnames unifi-wg.ddns.net --username zdeslav_s >
User=unifi
Group=unifi
StandardOutput=append:/var/log/noip-duc.log
StandardError=append:/var/log/noip-duc.log
# Keep it running indefinitely
Restart=always
RestartSec=5
# Type=simple

[Install]
WantedBy=multi-user.target

#################################### #END OF FILE

sudo systemctl daemon-reload
sudo systemctl restart noip-duc


#### Pretraga
journalctl -u noip-duc.service | grep error
journalctl -u noip-duc.service --since "20:00" --until "21:00"
journalctl -u noip-duc.service -f
journalctl -u noip-duc.service



############ WIREGUARD

sudo nano /etc/wireguard/wg0.conf

Override wg-quick@wg0 servis da čeka mrežu
Pokreni:
sudo systemctl edit wg-quick@wg0 Show more lines

# Pali/Gasi
sudo wg-quick down wg0
sudo wg-quick up wg0

# Restart service
sudo systemctl restart wg-quick@wg0.service
sudo systemctl disable wg-quick@wg0.service
sudo systemctl enable wg-quick@wg0.service
sudo systemctl status wg-quick@wg0.service

Zatim spremi i izađi (u nano: Ctrl+O, Enter, pa Ctrl+X).
Zatim:
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl enable wg-quick@wg0
sudo systemctl reload wg-quick@wg0

		################# Setup Conf WG0 ####

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
MTU = 1420
PrivateKey = 8CF9le7Iqevfrj6PMfNJ50AirtZaT/IsPApREmv/kms=

#PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
#PostUp = iptables -A FORWARD -o wg0 -j ACCEPT
#PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# UFW forwarding rules (bez iptables)
#PostUp = ufw route allow in on wg0 out on eno1
#PostUp = ufw route allow in on eno1 out on wg0
#PostDown = ufw route delete allow in on wg0 out on eno1
#PostDown = ufw route delete allow in on eno1 out on wg0

# Honor 200
[Peer]
PublicKey = ASUWU1gNIx2qWgecCuK9AciDJJl2/85BiHWmeNQLWCc=
AllowedIPs = 10.8.0.0/24
PersistentKeepalive = 25

     	################# End of File #######


sudo nano /etc/wireguard/wg0.conf

# Batch Private key
sudo wg genkey | tee server_private.key | wg pubkey > server_public.key
sudo wg genkey | tee client_private.key | wg pubkey > client_public.key

# Provjeri PostUp i IP forwarding na WireGuard serveru
sudo sysctl -w net.ipv4.ip_forward=1
I trajno u /etc/sysctl.conf dodaj:
sudo nano /etc/sysctl.conf
net.ipv4.ip_forward=1
# Primjeni trajno promjene
sudo sysctl -p

# Reci ufw da dozvoli forwarding
Editiraj 
sudo nano /etc/ufw/sysctl.conf 
i isto provjeri da je:
net/ipv4/ip_forward=1


# Zatim najvažniji korak – dopusti forwarding u samom ufw.
Editiraj 
sudo nano /etc/ufw/before.rules
 i dodaj NAT 
i forwarding blok na sam početak datoteke 
(odmah ispod prvih komentara):

sudo nano /etc/ufw/before.rules
# NAT i forwarding za WireGuard
*nat
:POSTROUTING ACCEPT [0:0]
#*nat za promet iz wg0 prema LAN-u
-A POSTROUTING -s 10.8.0.0/24 -o eno1 -j MASQUERADE
COMMIT

Dopusti promet između interfejsa u UFW pravilima

Editiraj /etc/ufw/before.rules i odmah ispod 
sekcije 
*filter dodaj:
# Forwarding s wg0 prema LAN-u
-A ufw-before-forward -i wg0 -o eno1 -j ACCEPT
-A ufw-before-forward -i eno1 -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT



############################### UFW

ZA greške u montiranju i mreži UFW
sudo dmesg

# Direkt Start/Stop/Reset 
sudo ufw reset

sudo ufw reload
sudo ufw disable
sudo ufw enable

# Provjera
sudo iptables -L -v -n

# Brisanje svega
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X

# Postavljanje nanovo
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT

################ before.rules
sudo nano /etc/ufw/before.rules


# NAT i routing za WireGuard
*nat
:POSTROUTING ACCEPT [0:0]

# Masquerade VPN prema LAN-u
-A POSTROUTING -s 10.8.0.0/24 -o eno1 -j MASQUERADE
COMMIT

*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# Forward pravila za VPN ↔ LAN
-A ufw-before-forward -i wg0 -o eno1 -s 10.8.0.0/24 -d 192.168.5.0/24 -j ACCEPT
-A ufw-before-forward -i eno1 -o wg0 -s 192.168.5.0/24 -d 10.8.0.0/24 -j ACCEPT

......
...
..


#
Incoming traffic: denyed
Outgoing traffic: allowed
Forwarded traffic: allowed

# sudo nano /etc/default/ufw and set 
DEFAULT_FORWARD_POLICY to ACCEPT:

sudo nano /etc/ufw/sysctl.conf
net/ipv4/ip_forward=1
net/ipv6/conf/default/forwarding=1
net/ipv6/conf/all/forwarding=1
# sudo ufw reload
# sudo sysctl -p /etc/ufw/sysctl.conf


# Option 1: Using iptables-persistent (recommended)
If you don’t have it yet:
sudo apt update && sudo apt install iptables-persistent

# Snimanje
sudo netfilter-persistent save

# You can save current rules to a file:
sudo iptables-save | sudo tee /etc/iptables/rules.v4

#If you’ve been using UFW (the uncomplicated firewall), 
you might want to reset that too:
sudo ufw reset
sudo ufw disable

# Most users want to deny all incoming traffic and allow outgoing:
Reset and Set Defaults (clean start)
sudo ufw default deny incoming
sudo ufw default allow outgoing

If you plan to use Samba both locally and via WireGuard, 
you should allow both subnets
# Local LAN access
sudo ufw allow from 192.168.5.0/24 to any port 445 proto tcp
sudo ufw allow from 192.168.5.0/24 to any port 139 proto tcp
sudo ufw allow from 192.168.5.0/24 to any port 137 proto udp
sudo ufw allow from 192.168.5.0/24 to any port 138 proto udp

# WireGuard subnet access
sudo ufw allow from 10.8.0.0/24 to any port 445 proto tcp
sudo ufw allow from 10.8.0.0/24 to any port 139 proto tcp
sudo ufw allow from 10.8.0.0/24 to any port 137 proto udp
sudo ufw allow from 10.8.0.0/24 to any port 138 proto udp


# UFW stores its rules persistently in configuration files, 
so they’re automatically reloaded on reboot
/etc/ufw/user.rules – IPv4 rules
/etc/ufw/user6.rules – IPv6 rules
/etc/ufw/ufw.conf – UFW main config
/lib/ufw/user.rules – system default rules (don’t edit directly)

# Za čitanje
sudo ufw status verbose > ~/ufw-status.txt
sudo ufw status numbered

# Back Up (Export) UFW Rules Manually
sudo cp /etc/ufw/user.rules ~/backup_user.rules
sudo cp /etc/ufw/user6.rules ~/backup_user6.rules

#  Later, you can restore them
sudo cp ~/backup_user.rules /etc/ufw/user.rules
sudo cp ~/backup_user6.rules /etc/ufw/user6.rules

sudo ufw reload

# UFW stores its rules persistently in configuration files, so they’re automatically reloaded on reboot. The main files are:

/etc/ufw/user.rules – IPv4 rules
/etc/ufw/user6.rules – IPv6 rules
/etc/ufw/ufw.conf – UFW main config

# systemske ne diraj
/lib/ufw/user.rules – system default rules (don’t edit directly)

# FTP & sFTP rules

 In /etc/proftpd/proftpd.conf
Unmark: PassivePorts 65000 66000 (choose a span of passive ports)
 In ufw open the span of ports
sudo ufw allow 65000:66000/tcp

20/tcp                     ALLOW OUT   Anywhere  # FTP Data
21/tcp                     ALLOW OUT   Anywhere  # FTP Command
22                         ALLOW OUT   Anywhere  # SSH, SFTP
990                        ALLOW OUT   Anywhere  # FTPS
989                        ALLOW OUT   Anywhere  # FTPS



########################### IP TABLES
sudo iptables-save > ~/iptables-backup.txt
sudo ip6tables-save > ~/ip6tables-backup.txt
sudo nft list ruleset > ~/nftables-backup.nft



########################### XRDP

In case anyone else runs into this problem, the solution is:

	Namjestiti ispod u:
sudo nano /etc/xrdp/sesman.ini
	[Sessions]
;; KillDisconnected - kill disconnected sessions
; Type: boolean
; Default: false
; if 1, true, or yes, every session will be killed within DisconnectedTimeLimit
; seconds after the user disconnects
# KillDisconnected=false        / original
KillDisconnected=true

;; DisconnectedTimeLimit (seconds) - wait before kill disconnected sessions
; Type: integer
; Default: 0
; if KillDisconnected is set to false, this value is ignored
# DisconnectedTimeLimit=0        original
DisconnectedTimeLimit=360

;; IdleTimeLimit (seconds) - wait before disconnect idle sessions
; Type: integer
; Default: 0
; Set to 0 to disable idle disconnection.
# IdleTimeLimit=0       / original
IdleTimeLimit=360



-----------------------------
	Edit /etc/xrdp/startwm.sh
sudo nano /etc/xrdp/startwm.sh

	Delete these lines
test -x /etc/X11/Xsession && exec /etc/X11/Xsession
exec /bin/sh /etc/X11/Xsession
	Instead type the following at same place:
exec startxfce4

Restart xrdp
sudo /etc/init.d/xrdp restart

########################### Pi-HOLE

sudo pihole disable
sudo pihole reloaddns
sudo pihole arpflush
sudo pihole enable

sudo nano /etc/dnsmasq.d/02-custom-settings.conf
unijeti za dns max querryes umjesto 150 default 
dns-forward-max=300

# Sekundarni i tercijalni DNS server
sudo nano /etc/dnsmasq.d/99-second-DNS.conf
UNIJETI
dhcp-option=option:dns-server,192.168.5.5,1.1.1.1,8.8.8.8

sudo pihole reload/restart



########################### Multiple nameservers DNS

Recommended fix for reliable local DNS resolution

Remove the search . entry:

sudo nano /etc/resolv.conf

Then keep only:

nameserver 192.168.5.5
search lan

Optionally, keep Pi-hole as the only DNS server on LAN clients.
Let Pi-hole forward external queries to 1.1.1.1 / 8.8.8.8 internally.
Verify short names:
nslookup unifi
nslookup hp-box



################################# MOUNT network share

edit: 
sudo nano /etc/nsswitch.conf
# umetnuti
hosts:          files mdns4_minimal [NOTFOUND=return] wins dns  # stavi wins prije dns / linija 12
sudo systemctl restart NetworkManager.service

edit:
sudo nano /etc/fstab
# umetnuti...
//hppro-3520.local/aitemp/ /mnt/aitemp cifs _netdev,vers=3.0,uid=1000,gid=1000,rw,noexec,file_mode=0777,dir_mode=0777,nofail,username=Zdeslav,password=simensS55 0 0

sudo systemctl daemon-reload
sudo mount -a
findmnt -t cifs   # pregled montiranja






Create a mount point and a credentials file:
sudo mkdir -p /mnt/mountpoint 
sudo nano ~/.smbcredentials 
Add your username and password to the file: username=<user> and password=<pass>. 
sudo chmod 600 ~/.smbcredentials. 
Create the .mount file:
Use systemd-escape to get the correct name for your mount point. For example, /mnt/mountpoint becomes mnt-mountpoint.
Create a file named mnt-mountpoint.mount in /etc/systemd/system/ and add the following content, adjusting for your share details:


        [Unit]
        Description=Mount My Network Share
        Requires=network-online.target
        After=network-online.target

        [Mount]
        What=//server/share
        Where=/mnt/mountpoint
        Type=cifs
        Options=credentials=/home/youruser/.smbcredentials,uid=<your_uid>,gid=<your_gid>

        [Install]
        WantedBy=multi-user.target

Enable and start the service:
sudo systemctl daemon-reload
sudo systemctl enable mnt-mountpoint.mount
sudo systemctl start mnt-mountpoint.mount

https://www.google.com/search?q=remount+share+on+ubuntu

ZA greške u montiranju i mreži UFW
sudo dmesg
#######"




#######################  Brisanje aplikacija

sudo apt-get purge mysql-server mysql-client mysql-common mysql-server-core-* mysql-client-core-*
sudo apt autoremove
sudo apt autoclean

sudo apt-get purge apache2*
sudo apt-get urge phpmyadmin 
sudo apt-get purge mysql-server
sudo apt-get purge php5

sudo apt-get purge phpmyadmin 



####################### Dodati prava na pisanje za SNAPD aplikacije Notepadqq
snap connect notepadqq:removable-media



####################### Live monitoring

Monitoring u realnom vremenu (praktično)

Napravimo mali skript: wg-monitor.sh

#!/bin/bash
echo "=== WireGuard Status ==="
sudo wg
echo
echo "=== Interfejs IP ==="
ip addr show wg0
echo
echo "=== UFW Status ==="
sudo ufw status verbose
echo
echo "=== Routes ==="
ip route show


Spasi kao chmod +x wg-monitoring.sh

Pokreni: ./wg-monitoring.sh

Sve što ti treba za brzi check VPN + LAN + firewall odmah vidiš na jednom mjestu