rbsetiawan
/
proxmox
1
0
Code Issues 55 Projects Wiki
Labels Milestones
New Issue

mikrotik ccr2004 #55

Open
opened 1 month ago by rbsetiawan · 0 comments
rbsetiawan commented 1 month ago
Owner

Konfigurasi MikroTik — Geonet / Gisportal

Diambil live: 15 Juni 2026 (diperbarui setelah enable PCC office)
Device: MikroTik CCR2004-1G-12S+2XS · RouterOS 7.5
Akses SSH: admin@117.102.73.102:255 (key id_rsa_mikrotik)
Catatan: Dokumen ini tidak mencakup detail failover ISP (hanya disebut sebagai referensi singkat).

1. Ringkasan Arsitektur

flowchart TB
    subgraph WAN["Internet"]
        USER[User Publik / Remote]
    end

    subgraph ISP1["ISP1 Biznet — ether1"]
        P102["117.102.73.102<br/>*.gisportal.id"]
        P99["117.102.73.99<br/>*.geonet.co.id"]
        P100["117.102.73.100<br/>dev.gisportal.id"]
        P101["117.102.73.101<br/>mail legacy"]
    end

    subgraph MT["MikroTik 10.100.1.1"]
        DNS["DNS Server<br/>Split-DNS aktif"]
        NAT["NAT dst-nat + Hairpin"]
        FW["Firewall Filter<br/>Anti-DDoS"]
        MANGLE["Mangle<br/>Bypass + force ISP1 server"]
        VPN["PPTP Server"]
    end

    subgraph ISP2["ISP2 IDBIZ — sfp-sfpplus1"]
        ISP2GW["192.168.1.1<br/>(backup WAN)"]
    end

    subgraph LAN["Jaringan Internal"]
        SRV["server bridge<br/>10.100.1.0/24"]
        OFF["office bridge<br/>192.168.0.0/24"]
        VPNB["vpn bridge<br/>100.100.1.0/24"]
    end

    USER --> ISP1
    ISP1 --> MT
    ISP2 --> MT

    MT --> SRV
    MT --> OFF
    MT --> VPNB

    SRV --> NGX["nginx 10.100.1.24"]
    SRV --> DB["database 10.100.1.25"]
    SRV --> DEV["dev IIS 10.100.1.51"]
    SRV --> MAIL["mail 10.100.1.40"]
    SRV --> ZBX["zabbix 10.100.1.42"]

2. Interface & Bridge

Interface Tipe Fungsi
ether1 WAN ISP1 Biznet
sfp-sfpplus1 WAN ISP2 IDBIZ (DHCP 192.168.1.52/24)
sfp-sfpplus2–5 LAN Server (DELL, IBM, NAS) → bridge server
sfp-sfpplus5 LAN QNAP TS-932X · 10.100.1.10
sfp-sfpplus10–12 LAN Switch server / production / adm → bridge office
server bridge Subnet produksi 10.100.1.0/24
office bridge Subnet kantor 192.168.0.0/24 + VLAN
vpn bridge Subnet PPTP VPN 100.100.1.0/24

VLAN aktif

VLAN ID Parent Bridge
vlan3 3 sfp-sfpplus12 server
vlan10 10 sfp-sfpplus10 server
vlan11 11 sfp-sfpplus11 server
vlan12 12 sfp-sfpplus12 server
vlan99 99 sfp-sfpplus10 server
vlan2004 2001 sfp-sfpplus4 office (192.168.2.0/24)
vlan2010 2010 sfp-sfpplus10 office
vlan2012 2012 sfp-sfpplus12 office

3. IP Addressing

IP Publik (ether1 — Biznet /29)

IP Label / Fungsi
117.102.73.102/29 gisportal.id — reverse proxy utama, SSH publik
117.102.73.99/32 geonet.co.id
117.102.73.100/32 dev.gisportal.id
117.102.73.101/32 Mail legacy → 10.100.1.76
117.102.73.98/32 geonet.co.id (tambahan)

Gateway ISP1: 117.102.73.97

IP Privat

Subnet Gateway Interface
10.100.1.0/24 10.100.1.1 server
192.168.0.0/24 192.168.0.1 office
100.100.1.0/24 100.100.1.1 vpn
192.168.2.0/24 192.168.2.1 vlan2004
192.168.1.0/24 DHCP sfp-sfpplus1 (ISP2)

4. DNS (Split-DNS)

flowchart LR
    CLIENT[Client LAN / Office / VPN]
    MTDNS[MikroTik DNS<br/>10.100.1.1]
    NGX[nginx 10.100.1.24]
    SPECIFIC[Host spesifik<br/>mis. database, aernd]
    UPSTREAM[Upstream ISP<br/>203.142.82.222]

    CLIENT -->|"query *.gisportal.id"| MTDNS
    MTDNS -->|"regexp match"| NGX
    MTDNS -->|"static name"| SPECIFIC
    MTDNS -->|"tidak match"| UPSTREAM

Pengaturan DNS server:

  • allow-remote-requests: yes
  • Upstream: 203.142.82.222, 203.142.84.222
  • Cache: 2048 KiB

DNS Static (aktif)

Entri Resolve ke Keterangan
regexp ^dev\.gisportal\.id 10.100.1.51 IIS dev — regexp (plain entry tidak cukup)
regexp ^database\.gisportal\.id 10.100.1.25
regexp ^aernd\.gisportal\.id 10.100.1.72
regexp \.gisportal\.id 10.100.1.24 Catch-all subdomain → nginx
regexp \.geonet\.co\.id 10.100.1.24 Catch-all subdomain geonet

Catatan: Di RouterOS, regexp dicek sebelum plain entry. Subdomain khusus (dev, database, aernd) harus pakai regexp exception di atas catch-all \.gisportal\.id. Tanpa ini, dev.gisportal.id dari jaringan lokal mengarah ke nginx (10.100.1.24) dan redirect ke app.gisportal.id — bukan IIS (10.100.1.51).

Plain entry (dockge, api, apex, dll.) tetap ada sebagai dokumentasi; yang aktif untuk subdomain adalah regexp di atas.

Plain entry Address Catatan
gisportal.id 10.100.1.24 Apex
geonet.co.id 10.100.1.24 Apex
dockge.gisportal.id 10.100.1.24
api.gisportal.id 10.100.1.24
arcgisenterprise.gisportal.id 10.100.1.61 Disabled

DHCP DNS per subnet

Subnet DNS yang diberikan ke client
192.168.0.0/24 (office) 192.168.0.1 (MikroTik)
100.100.1.0/24 (VPN) 100.100.1.1 (MikroTik)
192.168.2.0/24 (vlan2004) 8.8.8.8, 8.8.4.4

5. DHCP Server

Server Interface Pool Lease
dhcp1 office 192.168.0.2–254 4 minggu 3 hari
dhcp2 vpn 100.100.1.2–254 10 menit
dhcp3 vlan2004 192.168.2.2–254 Invalid (slave interface)

6. NAT — Port Forward Publik

Src-NAT (masquerade)

Rule Keterangan
Out ether1 NAT ke ISP1
Out sfp-sfpplus1 NAT ke ISP2
Rule #2 (generic) Masquerade tambahan

Dst-NAT per IP Publik

117.102.73.102 — gisportal utama

Port Publik → Internal Layanan
80 10.100.1.24:80 nginx HTTP
443 10.100.1.24:443 nginx HTTPS
24 10.100.1.24:22 SSH nginx
21 10.100.1.10:21 FTP
25 10.100.1.40:25 SMTP
110 10.100.1.40:110 POP3
143 10.100.1.40:143 IMAP
389 10.100.1.40:389 LDAP
587 10.100.1.40:587 SMTP submission
995 10.100.1.40:995 POP3S
1433 10.100.1.25:1433 MSSQL
1434 10.100.1.75:1433 SQL Server 2016 (rnd)
1436 10.100.1.76:1433 SQL Server 2016
1437 10.100.1.77:1433 SQL Server 2022
5432 10.100.1.25:5432 PostgreSQL
5433 10.100.1.27:5432 PostgreSQL alt
5434 10.100.1.27:5434
10051 10.100.1.42:10051 Zabbix agent active
255 10.100.1.1:255 SSH MikroTik
225 10.100.1.25:22 SSH Database

117.102.73.99 — geonet.co.id

Port Publik → Internal Layanan
80 10.100.1.24:80 nginx HTTP
443 10.100.1.24:443 nginx HTTPS
8080 10.100.1.27:8080
25, 587, 995, 110, 143, 389 10.100.1.40 Mail — disabled

117.102.73.100 — dev.gisportal.id

Port Publik → Internal Layanan
443 10.100.1.51:443 IIS HTTPS
80 10.100.1.51:80 IIS HTTP
2443 10.100.1.51:2443
6443 10.100.1.51:6443
7443 10.100.1.51:7443
30443 10.100.1.59:30443
6143 10.100.1.59:6143
13443 10.100.1.57:13443

117.102.73.101 — mail legacy

Port Publik → Internal Layanan
80, 25, 143, 465, 587, 993, 995 10.100.1.76 Mail server lama
443 → 10.100.1.24 disabled

Dst-NAT — rule disabled (penting)

Rule Status Keterangan
ssh-nginx-public-22 Disabled :22 → nginx (diganti port :24)
dev.gisportal.id :80 Aktif 117.102.73.100:80 → IIS
Mail via 117.102.73.99 Disabled Diganti ke .102 / .40
UDP mail ports Disabled

7. Hairpin NAT

Agar client dari dalam jaringan bisa akses layanan via IP publik:

flowchart LR
    LAN["Client 10.100.1.x<br/>atau 192.168.0.x"]
    PUBIP["117.102.73.102:443"]
    MT[MikroTik]
    NGX["nginx 10.100.1.24:443"]

    LAN -->|"dst publik"| MT
    MT -->|"dst-nat"| NGX
    MT -->|"srcnat masquerade<br/>(hairpin)"| NGX
Rule Src Dst Port
hairpin-10.100.1-nginx-443 10.100.1.0/24 10.100.1.24 443
hairpin-10.100.1-nginx-80 10.100.1.0/24 10.100.1.24 80
hairpin-vpn-nginx-443/80 100.100.1.0/24 10.100.1.24 443/80
Hairpin NAT (legacy) 192.168.0.0/24 10.100.1.24 / .100 80/443
hairpin-ssh-mikrotik 10.100.1.0/24 10.100.1.1 255
hairpin-ssh-mikrotik-office 192.168.0.0/24 10.100.1.1 255
ssh-public-db + hairpin LAN + office 10.100.1.25 22
hairpin-ssh-nginx — — Disabled

8. SSH Publik (manajemen remote)

flowchart LR
    REMOTE[Admin Remote]
    PUB["117.102.73.102"]
    MT["MikroTik :255"]
    NGX["nginx :24"]
    DB["database :225"]

    REMOTE -->|":255"| PUB --> MT
    REMOTE -->|":24"| PUB --> NGX
    REMOTE -->|":225"| PUB --> DB
Port Publik Target Script enable
255 MikroTik SSH mikrotik-open-ssh-public.rsc
24 nginx 10.100.1.24:22 (manual NAT)
225 database 10.100.1.25:22 enable-ssh-public.ps1 -Name db

Enable/disable custom: lihat scripts/enable-ssh-public.ps1 dan scripts/disable-ssh-public.ps1.

9. Firewall Filter

Rule Chain Aksi Status
Anti-DDoS forward Drop ddoser → ddosed Aktif
DDoS detection detect-ddos Rate limit + address-list Aktif
block-internet-biznet forward Drop blocked-internet → ISP1 Disabled
block-internet-idbiz forward Drop blocked-internet → ISP2 Disabled

Rule block-internet saat ini nonaktif — host di list blocked-internet boleh keluar internet.

10. Firewall Mangle

Bypass & force routing (aktif)

Rule Fungsi Status
hybrid server-local-bypass Traffic 10.100.1.x → 10.100.1.x skip mangle Aktif
hybrid server-to-office-bypass Server → office bypass Aktif
hybrid server-to-vpn-bypass Server → VPN bypass Aktif
hybrid server hairpin bypass Server → IP publik /29 bypass Aktif
hybrid office-to-server-bypass Office → server bypass Aktif
hybrid office hairpin bypass Office → IP publik bypass Aktif
hybrid vpn hairpin bypass VPN → IP publik bypass Aktif
hybrid mgmt bypass 192.168.0.33, 10.100.1.220 bypass Aktif
hybrid server force ISP1 Seluruh 10.100.1.0/24 → routing table ISP1 Aktif
temp-speedtest-isp2 Force 10.100.1.24 → ISP2 Disabled

PCC load balance — office saja (aktif sejak 15 Jun 2026)

Rule Fungsi Status
hybrid office PCC ISP1 in-interface=office → mark ISP 1 (2/0) Aktif
hybrid office PCC ISP2 in-interface=office → mark ISP 2 (2/1) Aktif
hybrid route ISP1 connection-mark ISP 1 → table KE ISP 1 Aktif
hybrid route ISP2 connection-mark ISP 2 → table KE ISP 2 Aktif

PCC / load-balance lain (tetap nonaktif)

Rule Status
PCC server, vlan2004, vpn Disabled
PCC ether1 / sfp-sfpplus1 lama Disabled 
flowchart TD
    subgraph OFF["Office 192.168.0.0/24"]
        C[Client kantor]
    end

    subgraph BYP["Bypass — tidak kena PCC"]
        SRV[10.100.1.0/24]
        PUB[117.102.73.96/29 hairpin]
    end

    subgraph PCC["PCC 50/50"]
        ISP1[ISP1 Biznet<br/>KE ISP 1]
        ISP2[ISP2 IDBIZ<br/>KE ISP 2]
    end

    subgraph SERVER["Server 10.100.1.0/24"]
        NGX[nginx / app servers]
    end

    C -->|"dst 10.100.1.x"| SRV
    C -->|"dst IP publik"| PUB
    C -->|"internet umum"| PCC
    PCC --> ISP1
    PCC --> ISP2

    NGX -->|"force ISP1"| ISP1IN[ISP1 Biznet]
    INET[User Internet] --> ISP1IN --> NGX

Publik gisportal/geonet aman: dst-nat masuk via ISP1; server subnet dipaksa keluar via ISP1 (force ISP1). PCC hanya mempengaruhi traffic keluar dari client office ke internet umum.

11. Address List — blocked-internet

Host yang seharusnya diblokir internet (rule saat ini disabled):

10.100.1.25, .40, .51, .53, .55, .56, .58, .61, .72, .80, .84, .88, .91, .100, .101, 192.168.0.57, 192.168.0.64

10.100.1.24 (nginx) tidak ada di list ini.

12. VPN — PPTP Server

Setting Nilai
Status Enabled
Auth mschap1, mschap2
Profile default-encryption
Subnet client 100.100.1.0/24 (DHCP dhcp2)

User VPN (tanpa password)

Username Remote IP statis
rbsetiawan 10.100.1.220
asobari 10.100.1.225
uabdurrohman 10.100.1.226
trachman 10.100.1.227
test 10.100.1.211
dpradana 10.100.1.228
ataufik 10.100.1.229

L2TP dan OVPN: disabled.

13. Layanan MikroTik

Service Port Status Pembatasan
SSH 255 Aktif Semua interface
Winbox 8291 Aktif Hanya 10.100.1.0/24, 192.168.0.0/24
Telnet 23 Disabled
FTP 21 Disabled
WWW 80 Disabled
API 8728 Disabled

SSH settings: always-allow-password-login: no, host-key-size: 2048

14. Routing & Load Balance

Routing table Fungsi
main Default — ISP1 primary (117.102.73.97), ISP2 backup (failover)
KE ISP 1 Paksa lewat Biznet — dipakai server + separuh koneksi office (PCC)
KE ISP 2 Paksa lewat IDBIZ — separuh koneksi office (PCC)
Subnet Keluar internet via
10.100.1.0/24 (server) Selalu ISP1 (hybrid server force ISP1)
192.168.0.0/24 (office) PCC 50/50 ISP1 + ISP2
100.100.1.0/24 (VPN) main — failover ISP1, backup ISP2 (tanpa PCC)

Kedua tabel KE ISP 1 dan KE ISP 2 memakai check-gateway=ping untuk failover per-ISP.

Latency Monitor — ISP1 vs ISP2 (aktif)

Item Nilai
Script latency-monitor
Scheduler Setiap 2 menit (startup)
Metode Ping gateway 5x: 117.102.73.97 (ISP1) vs 192.168.1.1 (ISP2)
Hysteresis 10ms — hindari flip-flop
Global variable $bestWan = isp1 atau isp2

Global variables (untuk rule meeting/routing berikutnya):

Variable Isi
bestWan ISP terbaik saat ini
isp1Latency Rata-rata RTT gateway ISP1
isp2Latency Rata-rata RTT gateway ISP2
isp1Loss Packet loss ISP1 (%)
isp2Loss Packet loss ISP2 (%)

Logika pemilihan:

  1. ISP2 loss > 49% → bestWan=isp1
  2. ISP1 loss > 49% → bestWan=isp2
  3. ISP1 latency < ISP2 − 10ms → bestWan=isp1
  4. ISP1 latency > ISP2 + 10ms → bestWan=isp2
  5. Selain itu → tetap $bestWan sebelumnya

Cek log:

/log print where message~"Latency Monitor"

Contoh output:

Latency Monitor: ISP1=0.828ms loss=0% | ISP2=0.462ms loss=0% | best=isp1

Mengukur latency ke gateway, bukan end-to-end internet. Cukup untuk membandingkan kualitas link WAN. Script hybrid-sync-mode (1 menit) tetap mengatur PCC up/down; latency-monitor menentukan ISP terbaik untuk rule routing berikutnya (meeting, dll.).

Deploy / update:

/import file-name=mikrotik-latency-monitor.rsc
/import file-name=mikrotik-latency-monitor-scheduler.rsc

15. Flowchart — Akses Web Publik End-to-End

sequenceDiagram
    participant U as User Internet
    participant D as DNS Publik
    participant M as MikroTik
    participant N as nginx 10.100.1.24
    participant A as App Server

    U->>D: resolve geonet.gisportal.id
    D-->>U: 117.102.73.102
    U->>M: HTTPS :443 ke 117.102.73.102
    M->>N: dst-nat → 10.100.1.24:443
    N->>A: reverse proxy ke backend
    A-->>N: response
    N-->>U: response

16. Flowchart — Akses dari LAN via Split-DNS

sequenceDiagram
    participant C as Client LAN 10.100.1.x
    participant M as MikroTik DNS
    participant N as nginx 10.100.1.24

    C->>M: resolve dockge.gisportal.id
    M-->>C: 10.100.1.24 (static/regexp)
    C->>N: HTTPS langsung ke 10.100.1.24
    N-->>C: response

17. Script & Dokumen Terkait di Repo

File Fungsi
server-geonet.md Command SSH ke semua server
mikrotik-fix-dns-nat.rsc Perbaikan split-DNS + hairpin
mikrotik-fix-dns-regexp.rsc Perbaikan regexp DNS
mikrotik-fix-dns-dev.rsc Split-DNS dev.gisportal.id → IIS 10.100.1.51
mikrotik-enable-dev-http.rsc Aktifkan NAT port 80 dev → IIS 10.100.1.51
mikrotik-fix-dhcp-dns.rsc DHCP DNS → gateway MikroTik
mikrotik-open-ssh-public.rsc Buka SSH MikroTik publik
mikrotik-disable-nginx-ssh22.rsc Tutup nginx SSH port 22
mikrotik-disable-block-internet.rsc Nonaktifkan block internet
mikrotik-enable-office-pcc.rsc Aktifkan PCC office + disable temp-speedtest
mikrotik-latency-monitor.rsc Update script latency monitor ISP1 vs ISP2
mikrotik-latency-monitor-scheduler.rsc Scheduler latency monitor (2 menit)
mikrotik-latency-monitor-install.rsc Install pertama kali latency monitor
mikrotik-cleanup-files.rsc Hapus file /file di router setelah di-archive
mikrotik-nas-backup.rsc Script backup config → QNAP via FTP
mikrotik-nas-backup-scheduler.rsc Scheduler backup harian ke NAS
mikrotik-nas-backup-install.rsc Install pertama kali backup NAS
qnap-mikrotik-setup.md Panduan QNAP + MikroTik (FTP / NFS)
mikrotik-files/ Archive backup, script, cert dari router
scripts/enable-ssh-public.ps1 Buka port SSH publik custom
scripts/disable-ssh-public.ps1 Tutup port SSH publik custom
scripts/install-linux-key.ps1 Daftar SSH key ke Linux
scripts/ssh-linux.ps1 Login SSH Linux dengan key

18. Catatan & Rekomendasi

  1. dev.gisportal.id split-DNS — static dev.gisportal.id → 10.100.1.51 sudah diterapkan (15 Jun 2026).
  2. PCC office — aktif (15 Jun 2026); VPN/server tidak ikut PCC. Uji browsing dari client 192.168.0.x.
  3. Latency monitor — aktif; cek $bestWan via log. Siap dipakai rule meeting/routing dinamis.
  4. PPTP — RouterOS menandai PPTP sebagai tidak aman; pertimbangkan migrasi ke WireGuard/L2TP+IPsec.
  5. Password VPN — tersimpan plain di /ppp secret; jangan commit ke git.
  6. blocked-internet — list masih ada tapi rule disabled; pastikan sesuai kebijakan sebelum di-enable kembali.
  7. QNAP NAS (10.100.1.10) — backup MikroTik via FTP siap di-deploy; mount NFS butuh upgrade ROS + rose-storage (lihat qnap-mikrotik-setup.md).
# Konfigurasi MikroTik — Geonet / Gisportal > **Diambil live:** 15 Juni 2026 (diperbarui setelah enable PCC office) > **Device:** MikroTik CCR2004-1G-12S+2XS · RouterOS **7.5** > **Akses SSH:** `admin@117.102.73.102:255` (key `id_rsa_mikrotik`) > **Catatan:** Dokumen ini **tidak** mencakup detail failover ISP (hanya disebut sebagai referensi singkat). --- ## 1. Ringkasan Arsitektur ```mermaid flowchart TB subgraph WAN["Internet"] USER[User Publik / Remote] end subgraph ISP1["ISP1 Biznet — ether1"] P102["117.102.73.102<br/>*.gisportal.id"] P99["117.102.73.99<br/>*.geonet.co.id"] P100["117.102.73.100<br/>dev.gisportal.id"] P101["117.102.73.101<br/>mail legacy"] end subgraph MT["MikroTik 10.100.1.1"] DNS["DNS Server<br/>Split-DNS aktif"] NAT["NAT dst-nat + Hairpin"] FW["Firewall Filter<br/>Anti-DDoS"] MANGLE["Mangle<br/>Bypass + force ISP1 server"] VPN["PPTP Server"] end subgraph ISP2["ISP2 IDBIZ — sfp-sfpplus1"] ISP2GW["192.168.1.1<br/>(backup WAN)"] end subgraph LAN["Jaringan Internal"] SRV["server bridge<br/>10.100.1.0/24"] OFF["office bridge<br/>192.168.0.0/24"] VPNB["vpn bridge<br/>100.100.1.0/24"] end USER --> ISP1 ISP1 --> MT ISP2 --> MT MT --> SRV MT --> OFF MT --> VPNB SRV --> NGX["nginx 10.100.1.24"] SRV --> DB["database 10.100.1.25"] SRV --> DEV["dev IIS 10.100.1.51"] SRV --> MAIL["mail 10.100.1.40"] SRV --> ZBX["zabbix 10.100.1.42"] ``` --- ## 2. Interface & Bridge | Interface | Tipe | Fungsi | |-----------|------|--------| | `ether1` | WAN | ISP1 Biznet | | `sfp-sfpplus1` | WAN | ISP2 IDBIZ (DHCP `192.168.1.52/24`) | | `sfp-sfpplus2–5` | LAN | Server (DELL, IBM, NAS) → bridge `server` | | `sfp-sfpplus5` | LAN | **QNAP TS-932X** · `10.100.1.10` | | `sfp-sfpplus10–12` | LAN | Switch server / production / adm → bridge `office` | | `server` | bridge | Subnet produksi `10.100.1.0/24` | | `office` | bridge | Subnet kantor `192.168.0.0/24` + VLAN | | `vpn` | bridge | Subnet PPTP VPN `100.100.1.0/24` | ### VLAN aktif | VLAN | ID | Parent | Bridge | |------|----|--------|--------| | `vlan3` | 3 | sfp-sfpplus12 | server | | `vlan10` | 10 | sfp-sfpplus10 | server | | `vlan11` | 11 | sfp-sfpplus11 | server | | `vlan12` | 12 | sfp-sfpplus12 | server | | `vlan99` | 99 | sfp-sfpplus10 | server | | `vlan2004` | 2001 | sfp-sfpplus4 | office (`192.168.2.0/24`) | | `vlan2010` | 2010 | sfp-sfpplus10 | office | | `vlan2012` | 2012 | sfp-sfpplus12 | office | --- ## 3. IP Addressing ### IP Publik (ether1 — Biznet `/29`) | IP | Label / Fungsi | |----|----------------| | `117.102.73.102/29` | **gisportal.id** — reverse proxy utama, SSH publik | | `117.102.73.99/32` | **geonet.co.id** | | `117.102.73.100/32` | **dev.gisportal.id** | | `117.102.73.101/32` | Mail legacy → `10.100.1.76` | | `117.102.73.98/32` | geonet.co.id (tambahan) | Gateway ISP1: `117.102.73.97` ### IP Privat | Subnet | Gateway | Interface | |--------|---------|-----------| | `10.100.1.0/24` | `10.100.1.1` | `server` | | `192.168.0.0/24` | `192.168.0.1` | `office` | | `100.100.1.0/24` | `100.100.1.1` | `vpn` | | `192.168.2.0/24` | `192.168.2.1` | `vlan2004` | | `192.168.1.0/24` | DHCP | `sfp-sfpplus1` (ISP2) | --- ## 4. DNS (Split-DNS) ```mermaid flowchart LR CLIENT[Client LAN / Office / VPN] MTDNS[MikroTik DNS<br/>10.100.1.1] NGX[nginx 10.100.1.24] SPECIFIC[Host spesifik<br/>mis. database, aernd] UPSTREAM[Upstream ISP<br/>203.142.82.222] CLIENT -->|"query *.gisportal.id"| MTDNS MTDNS -->|"regexp match"| NGX MTDNS -->|"static name"| SPECIFIC MTDNS -->|"tidak match"| UPSTREAM ``` **Pengaturan DNS server:** - `allow-remote-requests: yes` - Upstream: `203.142.82.222`, `203.142.84.222` - Cache: 2048 KiB ### DNS Static (aktif) | Entri | Resolve ke | Keterangan | |-------|------------|------------| | `regexp ^dev\.gisportal\.id` | `10.100.1.51` | IIS dev — **regexp** (plain entry tidak cukup) | | `regexp ^database\.gisportal\.id` | `10.100.1.25` | | | `regexp ^aernd\.gisportal\.id` | `10.100.1.72` | | | `regexp \.gisportal\.id` | `10.100.1.24` | Catch-all subdomain → nginx | | `regexp \.geonet\.co\.id` | `10.100.1.24` | Catch-all subdomain geonet | > **Catatan:** Di RouterOS, **regexp dicek sebelum plain entry**. Subdomain khusus (`dev`, `database`, `aernd`) harus pakai regexp exception di atas catch-all `\.gisportal\.id`. Tanpa ini, `dev.gisportal.id` dari jaringan lokal mengarah ke nginx (`10.100.1.24`) dan redirect ke `app.gisportal.id` — bukan IIS (`10.100.1.51`). Plain entry (dockge, api, apex, dll.) tetap ada sebagai dokumentasi; yang aktif untuk subdomain adalah regexp di atas. | Plain entry | Address | Catatan | |-------------|---------|---------| | `gisportal.id` | `10.100.1.24` | Apex | | `geonet.co.id` | `10.100.1.24` | Apex | | `dockge.gisportal.id` | `10.100.1.24` | | | `api.gisportal.id` | `10.100.1.24` | | | `arcgisenterprise.gisportal.id` | `10.100.1.61` | **Disabled** | ### DHCP DNS per subnet | Subnet | DNS yang diberikan ke client | |--------|------------------------------| | `192.168.0.0/24` (office) | `192.168.0.1` (MikroTik) | | `100.100.1.0/24` (VPN) | `100.100.1.1` (MikroTik) | | `192.168.2.0/24` (vlan2004) | `8.8.8.8`, `8.8.4.4` | --- ## 5. DHCP Server | Server | Interface | Pool | Lease | |--------|-----------|------|-------| | `dhcp1` | `office` | `192.168.0.2–254` | 4 minggu 3 hari | | `dhcp2` | `vpn` | `100.100.1.2–254` | 10 menit | | `dhcp3` | `vlan2004` | `192.168.2.2–254` | **Invalid** (slave interface) | --- ## 6. NAT — Port Forward Publik ### Src-NAT (masquerade) | Rule | Keterangan | |------|------------| | Out `ether1` | NAT ke ISP1 | | Out `sfp-sfpplus1` | NAT ke ISP2 | | Rule #2 (generic) | Masquerade tambahan | ### Dst-NAT per IP Publik #### `117.102.73.102` — gisportal utama | Port Publik | → Internal | Layanan | |-------------|------------|---------| | 80 | `10.100.1.24:80` | nginx HTTP | | 443 | `10.100.1.24:443` | nginx HTTPS | | 24 | `10.100.1.24:22` | SSH nginx | | 21 | `10.100.1.10:21` | FTP | | 25 | `10.100.1.40:25` | SMTP | | 110 | `10.100.1.40:110` | POP3 | | 143 | `10.100.1.40:143` | IMAP | | 389 | `10.100.1.40:389` | LDAP | | 587 | `10.100.1.40:587` | SMTP submission | | 995 | `10.100.1.40:995` | POP3S | | 1433 | `10.100.1.25:1433` | MSSQL | | 1434 | `10.100.1.75:1433` | SQL Server 2016 (rnd) | | 1436 | `10.100.1.76:1433` | SQL Server 2016 | | 1437 | `10.100.1.77:1433` | SQL Server 2022 | | 5432 | `10.100.1.25:5432` | PostgreSQL | | 5433 | `10.100.1.27:5432` | PostgreSQL alt | | 5434 | `10.100.1.27:5434` | | | 10051 | `10.100.1.42:10051` | Zabbix agent active | | **255** | `10.100.1.1:255` | **SSH MikroTik** | | **225** | `10.100.1.25:22` | **SSH Database** | #### `117.102.73.99` — geonet.co.id | Port Publik | → Internal | Layanan | |-------------|------------|---------| | 80 | `10.100.1.24:80` | nginx HTTP | | 443 | `10.100.1.24:443` | nginx HTTPS | | 8080 | `10.100.1.27:8080` | | | 25, 587, 995, 110, 143, 389 | `10.100.1.40` | Mail — **disabled** | #### `117.102.73.100` — dev.gisportal.id | Port Publik | → Internal | Layanan | |-------------|------------|---------| | 443 | `10.100.1.51:443` | IIS HTTPS | | 80 | `10.100.1.51:80` | IIS HTTP | | 2443 | `10.100.1.51:2443` | | | 6443 | `10.100.1.51:6443` | | | 7443 | `10.100.1.51:7443` | | | 30443 | `10.100.1.59:30443` | | | 6143 | `10.100.1.59:6143` | | | 13443 | `10.100.1.57:13443` | | #### `117.102.73.101` — mail legacy | Port Publik | → Internal | Layanan | |-------------|------------|---------| | 80, 25, 143, 465, 587, 993, 995 | `10.100.1.76` | Mail server lama | | 443 → `10.100.1.24` | | **disabled** | ### Dst-NAT — rule disabled (penting) | Rule | Status | Keterangan | |------|--------|------------| | `ssh-nginx-public-22` | **Disabled** | `:22` → nginx (diganti port `:24`) | | `dev.gisportal.id :80` | Aktif | `117.102.73.100:80` → IIS | | Mail via `117.102.73.99` | **Disabled** | Diganti ke `.102` / `.40` | | UDP mail ports | **Disabled** | | --- ## 7. Hairpin NAT Agar client **dari dalam jaringan** bisa akses layanan via **IP publik**: ```mermaid flowchart LR LAN["Client 10.100.1.x<br/>atau 192.168.0.x"] PUBIP["117.102.73.102:443"] MT[MikroTik] NGX["nginx 10.100.1.24:443"] LAN -->|"dst publik"| MT MT -->|"dst-nat"| NGX MT -->|"srcnat masquerade<br/>(hairpin)"| NGX ``` | Rule | Src | Dst | Port | |------|-----|-----|------| | `hairpin-10.100.1-nginx-443` | `10.100.1.0/24` | `10.100.1.24` | 443 | | `hairpin-10.100.1-nginx-80` | `10.100.1.0/24` | `10.100.1.24` | 80 | | `hairpin-vpn-nginx-443/80` | `100.100.1.0/24` | `10.100.1.24` | 443/80 | | Hairpin NAT (legacy) | `192.168.0.0/24` | `10.100.1.24` / `.100` | 80/443 | | `hairpin-ssh-mikrotik` | `10.100.1.0/24` | `10.100.1.1` | 255 | | `hairpin-ssh-mikrotik-office` | `192.168.0.0/24` | `10.100.1.1` | 255 | | `ssh-public-db` + hairpin | LAN + office | `10.100.1.25` | 22 | | `hairpin-ssh-nginx` | — | — | **Disabled** | --- ## 8. SSH Publik (manajemen remote) ```mermaid flowchart LR REMOTE[Admin Remote] PUB["117.102.73.102"] MT["MikroTik :255"] NGX["nginx :24"] DB["database :225"] REMOTE -->|":255"| PUB --> MT REMOTE -->|":24"| PUB --> NGX REMOTE -->|":225"| PUB --> DB ``` | Port Publik | Target | Script enable | |-------------|--------|---------------| | 255 | MikroTik SSH | `mikrotik-open-ssh-public.rsc` | | 24 | nginx `10.100.1.24:22` | (manual NAT) | | 225 | database `10.100.1.25:22` | `enable-ssh-public.ps1 -Name db` | Enable/disable custom: lihat `scripts/enable-ssh-public.ps1` dan `scripts/disable-ssh-public.ps1`. --- ## 9. Firewall Filter | Rule | Chain | Aksi | Status | |------|-------|------|--------| | Anti-DDoS | `forward` | Drop `ddoser` → `ddosed` | **Aktif** | | DDoS detection | `detect-ddos` | Rate limit + address-list | **Aktif** | | `block-internet-biznet` | `forward` | Drop `blocked-internet` → ISP1 | **Disabled** | | `block-internet-idbiz` | `forward` | Drop `blocked-internet` → ISP2 | **Disabled** | > Rule `block-internet` saat ini **nonaktif** — host di list `blocked-internet` boleh keluar internet. --- ## 10. Firewall Mangle ### Bypass & force routing (aktif) | Rule | Fungsi | Status | |------|--------|--------| | `hybrid server-local-bypass` | Traffic `10.100.1.x → 10.100.1.x` skip mangle | Aktif | | `hybrid server-to-office-bypass` | Server → office bypass | Aktif | | `hybrid server-to-vpn-bypass` | Server → VPN bypass | Aktif | | `hybrid server hairpin bypass` | Server → IP publik `/29` bypass | Aktif | | `hybrid office-to-server-bypass` | Office → server bypass | Aktif | | `hybrid office hairpin bypass` | Office → IP publik bypass | Aktif | | `hybrid vpn hairpin bypass` | VPN → IP publik bypass | Aktif | | `hybrid mgmt bypass` | `192.168.0.33`, `10.100.1.220` bypass | Aktif | | `hybrid server force ISP1` | Seluruh `10.100.1.0/24` → routing table ISP1 | **Aktif** | | `temp-speedtest-isp2` | Force `10.100.1.24` → ISP2 | **Disabled** | ### PCC load balance — office saja (aktif sejak 15 Jun 2026) | Rule | Fungsi | Status | |------|--------|--------| | `hybrid office PCC ISP1` | `in-interface=office` → mark `ISP 1` (`2/0`) | **Aktif** | | `hybrid office PCC ISP2` | `in-interface=office` → mark `ISP 2` (`2/1`) | **Aktif** | | `hybrid route ISP1` | connection-mark `ISP 1` → table `KE ISP 1` | **Aktif** | | `hybrid route ISP2` | connection-mark `ISP 2` → table `KE ISP 2` | **Aktif** | ### PCC / load-balance lain (tetap nonaktif) | Rule | Status | |------|--------| | PCC `server`, `vlan2004`, `vpn` | **Disabled** | | PCC `ether1` / `sfp-sfpplus1` lama | **Disabled** | ```mermaid flowchart TD subgraph OFF["Office 192.168.0.0/24"] C[Client kantor] end subgraph BYP["Bypass — tidak kena PCC"] SRV[10.100.1.0/24] PUB[117.102.73.96/29 hairpin] end subgraph PCC["PCC 50/50"] ISP1[ISP1 Biznet<br/>KE ISP 1] ISP2[ISP2 IDBIZ<br/>KE ISP 2] end subgraph SERVER["Server 10.100.1.0/24"] NGX[nginx / app servers] end C -->|"dst 10.100.1.x"| SRV C -->|"dst IP publik"| PUB C -->|"internet umum"| PCC PCC --> ISP1 PCC --> ISP2 NGX -->|"force ISP1"| ISP1IN[ISP1 Biznet] INET[User Internet] --> ISP1IN --> NGX ``` > **Publik gisportal/geonet aman:** dst-nat masuk via ISP1; server subnet dipaksa keluar via ISP1 (`force ISP1`). PCC hanya mempengaruhi traffic **keluar** dari client **office** ke internet umum. --- ## 11. Address List — `blocked-internet` Host yang **seharusnya** diblokir internet (rule saat ini disabled): `10.100.1.25`, `.40`, `.51`, `.53`, `.55`, `.56`, `.58`, `.61`, `.72`, `.80`, `.84`, `.88`, `.91`, `.100`, `.101`, `192.168.0.57`, `192.168.0.64` > `10.100.1.24` (nginx) **tidak** ada di list ini. --- ## 12. VPN — PPTP Server | Setting | Nilai | |---------|-------| | Status | **Enabled** | | Auth | mschap1, mschap2 | | Profile | `default-encryption` | | Subnet client | `100.100.1.0/24` (DHCP `dhcp2`) | ### User VPN (tanpa password) | Username | Remote IP statis | |----------|------------------| | `rbsetiawan` | `10.100.1.220` | | `asobari` | `10.100.1.225` | | `uabdurrohman` | `10.100.1.226` | | `trachman` | `10.100.1.227` | | `test` | `10.100.1.211` | | `dpradana` | `10.100.1.228` | | `ataufik` | `10.100.1.229` | L2TP dan OVPN: **disabled**. --- ## 13. Layanan MikroTik | Service | Port | Status | Pembatasan | |---------|------|--------|------------| | **SSH** | **255** | Aktif | Semua interface | | **Winbox** | 8291 | Aktif | Hanya `10.100.1.0/24`, `192.168.0.0/24` | | Telnet | 23 | Disabled | | | FTP | 21 | Disabled | | | WWW | 80 | Disabled | | | API | 8728 | Disabled | | SSH settings: `always-allow-password-login: no`, `host-key-size: 2048` --- ## 14. Routing & Load Balance | Routing table | Fungsi | |---------------|--------| | `main` | Default — ISP1 primary (`117.102.73.97`), ISP2 backup (failover) | | `KE ISP 1` | Paksa lewat Biznet — dipakai server + separuh koneksi office (PCC) | | `KE ISP 2` | Paksa lewat IDBIZ — separuh koneksi office (PCC) | | Subnet | Keluar internet via | |--------|---------------------| | `10.100.1.0/24` (server) | **Selalu ISP1** (`hybrid server force ISP1`) | | `192.168.0.0/24` (office) | **PCC 50/50** ISP1 + ISP2 | | `100.100.1.0/24` (VPN) | `main` — failover ISP1, backup ISP2 (tanpa PCC) | Kedua tabel `KE ISP 1` dan `KE ISP 2` memakai `check-gateway=ping` untuk failover per-ISP. ### Latency Monitor — ISP1 vs ISP2 (aktif) | Item | Nilai | |------|-------| | Script | `latency-monitor` | | Scheduler | Setiap **2 menit** (`startup`) | | Metode | Ping gateway 5x: `117.102.73.97` (ISP1) vs `192.168.1.1` (ISP2) | | Hysteresis | **10ms** — hindari flip-flop | | Global variable | `$bestWan` = `isp1` atau `isp2` | **Global variables (untuk rule meeting/routing berikutnya):** | Variable | Isi | |----------|-----| | `bestWan` | ISP terbaik saat ini | | `isp1Latency` | Rata-rata RTT gateway ISP1 | | `isp2Latency` | Rata-rata RTT gateway ISP2 | | `isp1Loss` | Packet loss ISP1 (%) | | `isp2Loss` | Packet loss ISP2 (%) | **Logika pemilihan:** 1. ISP2 loss > 49% → `bestWan=isp1` 2. ISP1 loss > 49% → `bestWan=isp2` 3. ISP1 latency < ISP2 − 10ms → `bestWan=isp1` 4. ISP1 latency > ISP2 + 10ms → `bestWan=isp2` 5. Selain itu → tetap `$bestWan` sebelumnya **Cek log:** ``` /log print where message~"Latency Monitor" ``` **Contoh output:** ``` Latency Monitor: ISP1=0.828ms loss=0% | ISP2=0.462ms loss=0% | best=isp1 ``` > Mengukur **latency ke gateway**, bukan end-to-end internet. Cukup untuk membandingkan kualitas link WAN. Script `hybrid-sync-mode` (1 menit) tetap mengatur PCC up/down; `latency-monitor` menentukan ISP terbaik untuk rule routing berikutnya (meeting, dll.). **Deploy / update:** ``` /import file-name=mikrotik-latency-monitor.rsc /import file-name=mikrotik-latency-monitor-scheduler.rsc ``` --- ## 15. Flowchart — Akses Web Publik End-to-End ```mermaid sequenceDiagram participant U as User Internet participant D as DNS Publik participant M as MikroTik participant N as nginx 10.100.1.24 participant A as App Server U->>D: resolve geonet.gisportal.id D-->>U: 117.102.73.102 U->>M: HTTPS :443 ke 117.102.73.102 M->>N: dst-nat → 10.100.1.24:443 N->>A: reverse proxy ke backend A-->>N: response N-->>U: response ``` --- ## 16. Flowchart — Akses dari LAN via Split-DNS ```mermaid sequenceDiagram participant C as Client LAN 10.100.1.x participant M as MikroTik DNS participant N as nginx 10.100.1.24 C->>M: resolve dockge.gisportal.id M-->>C: 10.100.1.24 (static/regexp) C->>N: HTTPS langsung ke 10.100.1.24 N-->>C: response ``` --- ## 17. Script & Dokumen Terkait di Repo | File | Fungsi | |------|--------| | `server-geonet.md` | Command SSH ke semua server | | `mikrotik-fix-dns-nat.rsc` | Perbaikan split-DNS + hairpin | | `mikrotik-fix-dns-regexp.rsc` | Perbaikan regexp DNS | | `mikrotik-fix-dns-dev.rsc` | Split-DNS dev.gisportal.id → IIS 10.100.1.51 | | `mikrotik-enable-dev-http.rsc` | Aktifkan NAT port 80 dev → IIS 10.100.1.51 | | `mikrotik-fix-dhcp-dns.rsc` | DHCP DNS → gateway MikroTik | | `mikrotik-open-ssh-public.rsc` | Buka SSH MikroTik publik | | `mikrotik-disable-nginx-ssh22.rsc` | Tutup nginx SSH port 22 | | `mikrotik-disable-block-internet.rsc` | Nonaktifkan block internet | | `mikrotik-enable-office-pcc.rsc` | Aktifkan PCC office + disable temp-speedtest | | `mikrotik-latency-monitor.rsc` | Update script latency monitor ISP1 vs ISP2 | | `mikrotik-latency-monitor-scheduler.rsc` | Scheduler latency monitor (2 menit) | | `mikrotik-latency-monitor-install.rsc` | Install pertama kali latency monitor | | `mikrotik-cleanup-files.rsc` | Hapus file /file di router setelah di-archive | | `mikrotik-nas-backup.rsc` | Script backup config → QNAP via FTP | | `mikrotik-nas-backup-scheduler.rsc` | Scheduler backup harian ke NAS | | `mikrotik-nas-backup-install.rsc` | Install pertama kali backup NAS | | `qnap-mikrotik-setup.md` | Panduan QNAP + MikroTik (FTP / NFS) | | `mikrotik-files/` | Archive backup, script, cert dari router | | `scripts/enable-ssh-public.ps1` | Buka port SSH publik custom | | `scripts/disable-ssh-public.ps1` | Tutup port SSH publik custom | | `scripts/install-linux-key.ps1` | Daftar SSH key ke Linux | | `scripts/ssh-linux.ps1` | Login SSH Linux dengan key | --- ## 18. Catatan & Rekomendasi 1. **`dev.gisportal.id` split-DNS** — static `dev.gisportal.id → 10.100.1.51` sudah diterapkan (15 Jun 2026). 2. **PCC office** — aktif (15 Jun 2026); VPN/server tidak ikut PCC. Uji browsing dari client `192.168.0.x`. 3. **Latency monitor** — aktif; cek `$bestWan` via log. Siap dipakai rule meeting/routing dinamis. 4. **PPTP** — RouterOS menandai PPTP sebagai tidak aman; pertimbangkan migrasi ke WireGuard/L2TP+IPsec. 5. **Password VPN** — tersimpan plain di `/ppp secret`; jangan commit ke git. 6. **`blocked-internet`** — list masih ada tapi rule disabled; pastikan sesuai kebijakan sebelum di-enable kembali. 7. **QNAP NAS** (`10.100.1.10`) — backup MikroTik via FTP siap di-deploy; mount NFS butuh upgrade ROS + `rose-storage` (lihat `qnap-mikrotik-setup.md`).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Apply labels
Clear labels
No items
No Label
Milestone
Set milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Assign users
Clear assignees
No Assignees
1 Participants
Notifications
Due Date

No due date set.

Dependencies

This issue currently doesn't have any dependencies.

Write Preview
Loading…
Cancel
Save
There is no content yet.
Delete Branch '%!s(MISSING)'

Deleting a branch is permanent. It CANNOT be undone. Continue?

No
Yes