AUDIT INFRASTRUKTUR — MIKROTIK ROUTER
======================================
Tanggal audit : 2026-06-13
Sumber        : server/host.txt, config-check.rsc
Metode        : SSH langsung (key-based)

IP/SSH   : 10.100.1.1  |  .\scripts\ssh-mikrotik.ps1
           |  ssh -i ~/.ssh/id_rsa_mikrotik -o IdentitiesOnly=yes -m hmac-sha1 admin@10.100.1.1 -p 255
Hostname : MikroTik
Model    : CCR2004-1G-12S+2XS (ARM64, serial HDD08647CP6)
OS       : RouterOS 7.5 (stable), build Aug/30/2022
Uptime   : ~1 minggu 14 jam (saat audit)
Resource : RAM 3811 MiB free / 4032 MiB | CPU load ~2% | Disk 8.6 MiB free / 129 MiB

Peran host: gateway internet, firewall perimeter, NAT publik, DHCP office/VPN,
segmentasi VLAN server/office, VPN remote (SSTP/PPTP), RADIUS ke AD.


A. INTERFACE & SEGMENTASI JARINGAN
-----------------------------------

A1. WAN
| Interface | Peran              | Status   |
|-----------|--------------------|----------|
| ether1    | WAN ke ISP utama   | Running  |
| sfp-sfpplus1 | ISP kedua (DHCP) | Disabled |

A2. Bridge utama
| Bridge  | Fungsi                         | IP gateway    |
|---------|--------------------------------|---------------|
| server  | Jaringan server/datacenter     | 10.100.1.1/24 |
| office  | Jaringan user kantor + switch  | 192.168.0.1/24 (juga di sfp-sfpplus10) |
| vpn     | Pool VPN remote dial-in        | 100.100.1.1/32 |

A3. Port fisik → bridge
| Port           | Keterangan          | Bridge | Status      |
|----------------|---------------------|--------|-------------|
| sfp-sfpplus2   | DELL-main-network   | server | Running     |
| sfp-sfpplus3   | DELL                | server | Running     |
| sfp-sfpplus4   | IBM                 | server | Inactive    |
| sfp-sfpplus5   | NAS                 | server | Running     |
| sfp-sfpplus6   | —                   | server | Inactive    |
| sfp-sfpplus10  | switch server       | office | Running     |
| sfp-sfpplus11  | switch production   | office | Running     |
| sfp-sfpplus12  | switch adm          | office | Disabled    |

A4. VLAN
| VLAN     | VLAN-ID | Parent port    | Bridge | Keterangan        |
|----------|---------|----------------|--------|-------------------|
| vlan3    | 3       | sfp-sfpplus12  | server | Admin segment     |
| vlan10   | 10      | sfp-sfpplus10  | server | Server VLAN       |
| vlan11   | 11      | sfp-sfpplus11  | server | Production VLAN   |
| vlan12   | 12      | sfp-sfpplus12  | server | Admin VLAN        |
| vlan99   | 99      | sfp-sfpplus10  | server | —                 |
| vlan2010 | 2010    | sfp-sfpplus10  | office | Office VLAN       |
| vlan2012 | 2012    | sfp-sfpplus12  | office | Office admin VLAN |
| vlan2004 | 2001    | sfp-sfpplus4   | office | IBM (inactive)    |

Catatan interface:
  - sfp-sfpplus12 + vlan3/12/2012 sering link flap (100+ link-downs).
  - vlan2004 & sfp-sfpplus4 inactive — network IBM tidak aktif.
  - sfp-sfpplus1 (ISP 2) disabled; load-balance disiapkan tapi tidak aktif.


B. IP ADDRESS
-------------

B1. IP publik (semua di ether1, blok ISP 117.102.73.96/29, gateway .97)
| IP                 | Keterangan       | Fungsi utama                          |
|--------------------|------------------|---------------------------------------|
| 117.102.73.102/29  | gisportal.id     | IP utama — web, DB, mail, LDAP, Zabbix |
| 117.102.73.101/32  | Not Set          | Mail server (→ 10.100.1.76)           |
| 117.102.73.100/32  | dev.gisportal.id | Dev/K8s (.51, .57, .59)               |
| 117.102.73.98/32   | geonet.co.id     | Domain geonet                         |
| 117.102.73.99/32   | geonet.co.id     | HTTP/HTTPS → reverse proxy            |

B2. IP internal
| Network         | Interface     | Gateway     | Pengguna                    |
|-----------------|---------------|-------------|-----------------------------|
| 10.100.1.0/24   | server        | 10.100.1.1  | Server/infrastruktur        |
| 192.168.0.0/24  | office        | 192.168.0.1 | User kantor (DHCP)          |
| 100.100.1.0/24  | vpn           | 100.100.1.1 | User VPN remote (DHCP)      |
| 192.168.2.0/24  | vlan2004      | 192.168.2.1 | Network IBM (DHCP relay)    |

B3. Routing aktif
  Default route : 0.0.0.0/0 → 117.102.73.97 via ether1 (ISP utama)
  Backup route  : 0.0.0.0/0 → 192.168.1.1 via routing-table "KE ISP 2" (load-balance disabled)


C. INTERNET UNTUK USER
----------------------

C1. User kantor (192.168.0.x)
  Alur:
    PC → DHCP Mikrotik (dhcp1, pool 192.168.0.2–254, lease 4 minggu)
       → Gateway 192.168.0.1
       → DNS 203.142.82.222 / 203.142.84.222
       → NAT masquerade out-interface=ether1
       → Internet sebagai IP publik 117.102.73.x

  DHCP reservation (contoh): switch .8/.9, multimedia .4, WAVLINK .20, dll.

  Hairpin NAT: user kantor yang akses domain publik di-redirect ke server internal
    192.168.0.0/24 → 10.100.1.24:80/443 (tanpa keluar internet)

C2. User VPN remote (100.100.1.x)
  Alur:
    User → SSTP (port 443) / PPTP
         → Autentikasi RADIUS ke AD 10.100.1.40 (domain gisportal.id)
         → IP 100.100.1.x via DHCP (dhcp2, lease 10 menit)
         → NAT masquerade → internet

  SSTP : enabled (port 443, auth pap/chap/mschap)
  PPTP : enabled (tidak aman — disarankan nonaktifkan)

C3. User PPP dengan IP server (10.100.1.2xx)
  Akun PPP lokal (rbsetiawan, asobari, uabdurrohman, trachman, test, dpradana, ataufik)
  mendapat IP tetap di jaringan server (10.100.1.220–229).

  Alur:
    VPN dial-in → IP 10.100.1.2xx (langsung di LAN server)
                → Akses penuh ke 10.100.1.0/24
                → Internet via masquerade ether1

  [KEAMANAN] Password PPP disimpan plain-text di /ppp secret — pertimbangkan
  migrasi ke RADIUS-only atau hapus akun tidak terpakai.


D. NAT (PORT FORWARDING PUBLIK → INTERNAL)
------------------------------------------
Total aturan NAT : 55 (dst-nat aktif: 27, forward filter: 21)

D1. IP 117.102.73.102 (gisportal.id) — port forward aktif
| Port  | → Internal       | Layanan              |
|-------|------------------|----------------------|
| 21    | 10.100.1.10:21   | FTP                  |
| 24    | 10.100.1.24:22   | SSH (disabled)       |
| 25    | 10.100.1.40:25   | SMTP                 |
| 80    | 10.100.1.24:80   | HTTP reverse proxy   |
| 110   | 10.100.1.40:110  | POP3                 |
| 143   | 10.100.1.40:143  | IMAP                 |
| 389   | 10.100.1.40:389  | LDAP                 |
| 443   | 10.100.1.24:443  | HTTPS reverse proxy  |
| 587   | 10.100.1.40:587  | SMTP submission      |
| 995   | 10.100.1.40:995  | POP3S                |
| 1433  | 10.100.1.25:1433 | SQL Server utama     |
| 1434  | 10.100.1.75:1433 | SQL Server RND 2016  |
| 1436  | 10.100.1.76:1433 | SQL Server RND 2016  |
| 1437  | 10.100.1.77:1433 | SQL Server RND 2022  |
| 5432  | 10.100.1.25:5432 | PostgreSQL           |
| 5433  | 10.100.1.27:5432 | PostgreSQL alt       |
| 5434  | 10.100.1.27:5434 | PostgreSQL alt       |
| 10051 | 10.100.1.42:10051| Zabbix active checks |

D2. IP 117.102.73.99 (geonet.co.id)
| Port  | → Internal       |
|-------|------------------|
| 80    | 10.100.1.24:80   |
| 443   | 10.100.1.24:443  |
| 8080  | 10.100.1.27:8080 | (disabled)         |

D3. IP 117.102.73.100 (dev.gisportal.id)
| Port   | → Internal         |
|--------|--------------------|
| 443    | 10.100.1.51:443    |
| 2443   | 10.100.1.51:2443   |
| 6443   | 10.100.1.51:6443   |
| 7443   | 10.100.1.51:7443   |
| 6143   | 10.100.1.59:6143   |
| 13443  | 10.100.1.57:13443  |
| 30443  | 10.100.1.59:30443  | (disabled)         |

D4. IP 117.102.73.101 (Not Set — mail)
| Port  | → Internal       |
|-------|------------------|
| 25    | 10.100.1.76:25   |
| 80    | 10.100.1.76:80   |
| 143   | 10.100.1.76:143  |
| 465   | 10.100.1.76:465  |
| 587   | 10.100.1.76:587  |
| 993   | 10.100.1.76:993  |
| 995   | 10.100.1.76:995  |

D5. Source NAT (keluar)
| Aturan                              | Fungsi                          |
|-------------------------------------|---------------------------------|
| masquerade out-interface=ether1     | Semua traffic keluar → IP publik |
| masquerade out-interface=sfp-sfpplus1 | ISP kedua (siap, belum aktif) |
| masquerade (tanpa out-interface)    | Catch-all — perlu review        |
| Hairpin NAT ×3                      | Loopback 192.168.0.x → 10.100.1.24/100 |


E. FIREWALL & KEAMANAN
----------------------

E1. Server diblokir akses langsung ke internet (out-interface=ether1)
| IP server    | Status rule |
|--------------|-------------|
| 10.100.1.100 | DROP aktif  |
| 10.100.1.88  | DROP aktif  |
| 10.100.1.84  | DROP aktif  |
| 10.100.1.91  | DROP aktif  |
| 10.100.1.61  | DROP aktif  |
| 10.100.1.72  | DROP aktif  |
| 10.100.1.80  | DROP aktif  |

E2. Server dengan rule DROP disabled (boleh keluar langsung saat ini)
  10.100.1.24 (reverse proxy), .25 (DB), .40 (AD), .51 (dev), .53/.55/.56/.58

E3. User kantor diisolasi
  192.168.0.57 — DROP forward (total)
  192.168.0.64 — DROP forward (total)

E4. DDoS detection
  Chain detect-ddos: rate-limit 32/s per src+dst, auto-block 10 menit

E5. Layanan management
| Layanan  | Port | Akses dibatasi ke                    |
|----------|------|--------------------------------------|
| SSH      | 255  | 10.100.1.0/24, 192.168.0.0/24        |
| Winbox   | —    | 10.100.1.0/24, 192.168.0.0/24        |
| Telnet   | —    | Disabled                             |
| FTP/WWW/API | — | Disabled                             |

E6. SSH key
  User admin: key RSA terdaftar (admin@DESKTOP-RRJ9G01-mikrotik)
  Login: .\scripts\ssh-mikrotik.ps1 (key-based, IdentitiesOnly=yes)


F. HUBUNGAN DENGAN HOST LAIN (dari repo server-connection)
----------------------------------------------------------
| Host internal   | IP           | Keterangan NAT/firewall                  |
|-----------------|--------------|------------------------------------------|
| Reverse_proxy   | 10.100.1.24  | dst-nat :80/:443 dari .102/.99           |
| Main_Database   | 10.100.1.25  | dst-nat :1433/:5432 dari .102            |
| AD-LDAP         | 10.100.1.40  | dst-nat mail/LDAP; RADIUS untuk VPN      |
| Zabbix          | 10.100.1.42  | dst-nat :10051 dari .102                 |
| Main_Webserver  | 10.100.1.41  | Tidak ada dst-nat langsung ke .41        |

Diagram:
  Internet/User
        |
        v
  [ Mikrotik 10.100.1.1 ]  ← audit ini
        |
        +---> 192.168.0.0/24 (user kantor, DHCP)
        +---> 100.100.1.0/24 (VPN remote, RADIUS→AD)
        +---> 10.100.1.0/24 (server LAN)
                |
                +---> .24 reverse proxy (pintu masuk HTTPS publik)
                +---> .25 database
                +---> .40 AD/LDAP/mail
                +---> .41 webserver
                +---> .42 Zabbix


G. ANALISA & REKOMENDASI
------------------------

Yang berjalan baik:
  1. Segmentasi jelas: server / office / VPN / VLAN.
  2. Multi-IP publik per layanan/domain.
  3. Hairpin NAT untuk user kantor akses domain internal.
  4. VPN terintegrasi RADIUS AD (domain gisportal.id).
  5. DDoS detection aktif.
  6. SSH key-based auth untuk admin (port 255, subnet terbatas).

Perlu perhatian:
  1. [KRITIS] Banyak port sensitif expose publik (1433, 5432, 25, 389, 143).
     Pastikan service-level auth kuat; pertimbangkan batasi source IP.
  2. [KRITIS] Password PPP plain-text di router — migrasi ke RADIUS-only.
  3. [KEAMANAN] PPTP masih enabled — nonaktifkan, gunakan SSTP saja.
  4. [STABILITAS] sfp-sfpplus12 + VLAN admin sering flap — cek kabel/SFP/switch.
  5. [STABILITAS] IBM vlan2004 inactive — DHCP relay invalid.
  6. [ROUTING] Load-balance ISP 2 disiapkan tapi semua rule disabled.
  7. [NAT] Rule masquerade tanpa out-interface — review dampaknya.
  8. [DISK] Free HDD hanya 8.6 MiB / 129 MiB — monitor, backup config rutin.
  9. [FIREWALL] Rule DROP server utama (.24/.25/.40) saat ini disabled —
     server infra bisa keluar internet langsung.


PERINTAH VERIFIKASI ULANG
-------------------------
# SSH ke Mikrotik
.\scripts\ssh-mikrotik.ps1
.\scripts\ssh-mikrotik.ps1 -Command "/system resource print"

# Interface & address
.\scripts\ssh-mikrotik.ps1 -Command "/interface print stats"
.\scripts\ssh-mikrotik.ps1 -Command "/ip address print"

# Routing & NAT
.\scripts\ssh-mikrotik.ps1 -Command "/ip route print where active=yes"
.\scripts\ssh-mikrotik.ps1 -Command "/ip firewall nat print where disabled=no"

# DHCP & VPN
.\scripts\ssh-mikrotik.ps1 -Command "/ip dhcp-server lease print"
.\scripts\ssh-mikrotik.ps1 -Command "/ppp active print"

# Firewall
.\scripts\ssh-mikrotik.ps1 -Command "/ip firewall filter print where chain=forward"

# Export config (backup)
.\scripts\ssh-mikrotik.ps1 -Command "/export file=backup-audit"
