{
"event": "PreToolUse",
"tool_name": "Bash",
"tool_input": {
"command": "ssh root@prod.karlkratz.com \"cat > \/etc\/nftables.d\/firewall.nft << 'NFTEOF'\n#!\/usr\/sbin\/nft -f\n# Firewall-Config prod.karlkratz.com\n# Migriert: 2026-02-15 von iptables\/ufw\/ipset auf natives nftables\n# Safety: at-job restored iptables nach 5 Min falls SSH ausfaellt\n\nflush ruleset\n\ntable inet firewall {\n\n set blacklist {\n type ipv4_addr\n comment \\\"SSH-Blacklist + manuelle Blocks\\\"\n }\n\n set geo_whitelist {\n type ipv4_addr\n flags interval\n auto-merge\n comment \\\"Country-Whitelist (DE\/AT\/CH\/EU)\\\"\n }\n\n set geoblock {\n type ipv4_addr\n flags interval\n comment \\\"Geo-Block (Asien\/Afrika\/Suedamerika\/RU)\\\"\n }\n\n chain input {\n type filter hook input priority -5; policy drop;\n\n # Loopback\n iifname \\\"lo\\\" accept\n\n # Established\/Related\n ct state established,related accept\n ct state invalid drop\n\n # Trusted IPs (voller Zugriff)\n ip saddr { 145.224.73.102, 91.99.63.201, 148.251.182.181, 91.107.225.81 } accept\n\n # Geo: Whitelist vor Blacklist\n ip saddr @geo_whitelist accept\n ip saddr @geoblock drop\n\n # Blacklist\n ip saddr @blacklist drop\n\n # Oeffentliche Dienste\n tcp dport { 22, 25, 80, 443, 465, 587, 993, 995 } accept\n udp dport 443 accept\n\n # ICMP\n icmp type { echo-request, destination-unreachable, time-exceeded, parameter-problem } accept\n\n # WebRTC\/TURN\n tcp dport 3478 accept\n udp dport { 3478, 49152-65535 } accept\n\n # Ollama (nur bestimmte IPs)\n ip saddr { 127.0.0.1, 91.99.63.201, 148.251.182.181 } tcp dport 11434 accept\n\n # SSH Hetzner-Monitoring\n ip saddr 88.198.50.199 tcp dport 22 accept\n }\n\n chain forward {\n type filter hook forward priority 0; policy drop;\n }\n\n chain output {\n type filter hook output priority 0; policy accept;\n }\n}\nNFTEOF\necho 'Config geschrieben'\n\" 2>&1",
"timeout": 15000,
"description": "Write new nftables firewall config"
}
}
{
"tool_response": {
"stdout": "Config geschrieben",
"stderr": "",
"interrupted": false,
"isImage": false,
"noOutputExpected": false
}
}