DESAIN HYBRID MIKROTIK — FAILOVER + PCC + NETWATCH + CHECK-GATEWAY
==================================================================
Tanggal desain  : 2026-06-13
Router          : MikroTik CCR2004-1G-12S+2XS, RouterOS 7.5, 10.100.1.1
Baseline aktif  : Failover Fase 1 (server/mikrotik-failover-phase1-backup.txt)
Prasyarat       : Fase 1 failover AKTIF & terverifikasi
Restore point   : server/mikrotik-failover-phase1-backup.txt (jika Fase 2 gagal)

Status: RENCANA — BELUM DIEKSEKUSI

Tujuan gabungan:
  1. Pembagian beban internet user (PCC ~50/50) saat ISP1 DAN ISP2 sehat
  2. Failover otomatis saat salah satu ISP down (tanpa blackhole 50%)
  3. Server 10.100.1.0/24 tetap ISP1; dst-nat publik tetap ether1


1. PERBANDINGAN TIGA DESAIN
---------------------------

| Aspek                    | Failover saja      | PCC saja (lama)   | Hybrid (ini)        |
|--------------------------|--------------------|-------------------|---------------------|
| File acuan               | mikrotik-failover  | mikrotik-dual-wan | mikrotik-hybrid     |
| Bagi beban 2 ISP         | Tidak              | Ya                | Ya (kondisional)    |
| Failover ISP down        | Ya                 | Tidak             | Ya                  |
| Satu download = 2 ISP    | Tidak              | Tidak             | Tidak               |
| Health check             | check-gateway      | Tidak             | check-gateway + Netwatch |
| Risiko blackhole 50%     | Tidak              | Tinggi            | Rendah (PCC off saat ISP down) |
| Kompleksitas             | Rendah             | Sedang            | Tinggi              |


2. TIGA MODE OPERASI (STATE MACHINE)
------------------------------------

```mermaid
stateDiagram-v2
  [*] --> CheckHealth: Boot / monitor

  CheckHealth --> BothUp: ISP1 GW OK dan ISP2 GW OK
  CheckHealth --> ISP1Down: ISP1 GW gagal
  CheckHealth --> ISP2Down: ISP2 GW gagal
  CheckHealth --> BothDown: Keduanya gagal

  state BothUp {
    [*] --> PCC_On
    PCC_On: PCC 50/50 office+VPN
    PCC_On: Route KE ISP 1/2 + check-gateway
  }

  state ISP1Down {
    [*] --> Failover_ISP2
    Failover_ISP2: PCC OFF semua
    Failover_ISP2: 100% traffic user via ISP2
  }

  state ISP2Down {
    [*] --> ISP1_Only
    ISP1_Only: PCC ISP2 OFF
    ISP1_Only: 100% traffic user via ISP1
  }

  state BothDown {
    [*] --> NoInternet
    NoInternet: Internet user mati total
  }

  BothUp --> ISP1Down: Netwatch ISP1 down
  BothUp --> ISP2Down: Netwatch ISP2 down
  ISP1Down --> BothUp: ISP1 recovery + ISP2 OK
  ISP2Down --> BothUp: ISP2 recovery + ISP1 OK
```


3. TOPOLOGI & ALUR TRAFFIC
--------------------------

### 3.1 Mode BOTH UP — load balance aktif

```mermaid
flowchart TB
  subgraph users [Sumber traffic]
    OFF[office 192.168.0.x]
    VPN[vpn 100.100.1.x]
    SRV[server 10.100.1.0/24]
  end

  subgraph mangle [Mangle prerouting — urutan penting]
    R0[0 server force ISP1]
    R1[1 office→server bypass accept]
    R2[2 office PCC 2/0 → ISP1]
    R3[3 office PCC 2/1 → ISP2]
    R4[4 vpn PCC 2/0 → ISP1]
    R5[5 vpn PCC 2/1 → ISP2]
    R6[6 route mark KE ISP 1]
    R7[7 route mark KE ISP 2]
  end

  subgraph tables [Routing tables]
    T1[KE ISP 1<br/>0.0.0.0/0 → 117.102.73.97<br/>check-gateway=ping]
    T2[KE ISP 2<br/>0.0.0.0/0 → 192.168.1.1<br/>check-gateway=ping]
  end

  OFF --> R1
  OFF --> R2
  OFF --> R3
  VPN --> R4
  VPN --> R5
  SRV --> R0

  R0 --> T1
  R2 --> R6 --> T1
  R3 --> R7 --> T2
  R4 --> R6 --> T1
  R5 --> R7 --> T2
  R1 --> SRV

  T1 --> NAT1[NAT ether1]
  T2 --> NAT2[NAT sfp-sfpplus1]
```

### 3.2 Mode ISP1 DOWN — failover murni

```mermaid
flowchart LR
  U[User office/VPN] --> M[PCC DISABLED<br/>Netwatch script]
  M --> RT[Main table]
  RT -->|distance=2 ACTIVE| ISP2[ISP2 sfp-sfpplus1]
  ISP2 --> NAT[NAT masquerade]
  SRV[Server 10.100.1.x] -.->|force ISP1 — internet server mati| X[ISP1 down]
```

### 3.3 Mode ISP2 DOWN — ISP1 only

```mermaid
flowchart LR
  U[User office/VPN] --> M[PCC ISP2 rules DISABLED]
  M --> PCC1[PCC ISP1 only / atau semua ke ISP1]
  PCC1 --> T1[KE ISP 1]
  T1 --> ISP1[ether1]
```


4. KOMPONEN KONFIGURASI
-----------------------

### 4.1 Interface & DHCP ISP2

  /interface ethernet set sfp-sfpplus1 disabled=no
  /ip dhcp-client set [find interface=sfp-sfpplus1] \
      add-default-route=no use-peer-dns=no disabled=no

  DHCP tidak menambah default route otomatis — route dikontrol manual/script.


### 4.2 Routing tables & rules

  Tabel (sudah ada di router): KE ISP 1, KE ISP 2

  Route per tabel (dengan check-gateway):
    hybrid ISP1:
      dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table="KE ISP 1"
      check-gateway=ping distance=1

    hybrid ISP2:
      dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table="KE ISP 2"
      check-gateway=ping distance=1

  Route failover main table (cadangan saat PCC off):
    hybrid failover primary:
      dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table=main
      check-gateway=ping distance=1

    hybrid failover backup:
      dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main
      check-gateway=ping distance=2

  Routing rules:
    routing-mark=KE ISP 1 → lookup table KE ISP 1  comment=hybrid ISP1
    routing-mark=KE ISP 2 → lookup table KE ISP 2  comment=hybrid ISP2


### 4.3 Mangle — urutan rule (KRITIS)

| # | Comment                         | Chain       | Aksi              | Kondisi enable   |
|---|---------------------------------|-------------|-------------------|------------------|
| 0 | hybrid mgmt bypass laptop     | prerouting  | accept            | Selalu (192.168.0.33) |
| 1 | hybrid server force ISP1        | prerouting  | mark-routing ISP1 | Selalu           |
| 2 | hybrid office-to-server-bypass  | prerouting  | accept            | Selalu           |
| 3 | hybrid office PCC ISP1          | prerouting  | PCC 2/0           | Mode BothUp      |
| 4 | hybrid office PCC ISP2          | prerouting  | PCC 2/1           | Mode BothUp      |
| 5 | hybrid vpn PCC ISP1             | prerouting  | PCC 2/0           | Mode BothUp      |
| 6 | hybrid vpn PCC ISP2             | prerouting  | PCC 2/1           | Mode BothUp      |
| 7 | hybrid route ISP1               | prerouting  | mark-routing      | Mode BothUp      |
| 8 | hybrid route ISP2               | prerouting  | mark-routing      | Mode BothUp      |

  Rule #0 mgmt bypass: laptop admin 192.168.0.33 tidak kena PCC — SSH stabil saat apply.
  Rule #2 mencegah traffic office→10.100.1.0/24 ter-mark PCC.

  Saat ISP2 down: disable rule #3, #5, #7 (PCC/route ISP2).
  Saat ISP1 down: disable rule #2–#7 (semua PCC); failover via main table.
  Saat both up: enable rule #2–#7.


### 4.4 NAT

  Tetap seperti baseline:
    masquerade out-interface=ether1
    masquerade out-interface=sfp-sfpplus1
    masquerade catch-all (rule #2) — enabled

  Jangan disable catch-all NAT (berbeda dengan dual-wan.rsc lama).


### 4.5 Netwatch — monitor gateway

  Monitor ISP1:
    host=117.102.73.97 interval=10s timeout=3s
    comment=hybrid monitor ISP1

  Monitor ISP2:
    host=192.168.1.1 interval=10s timeout=3s
    comment=hybrid monitor ISP2

  Script terhubung ke Netwatch memanggil fungsi mode:
    hybrid-set-mode-both-up
    hybrid-set-mode-isp1-down
    hybrid-set-mode-isp2-down

### 4.5b Management bypass — laptop admin

  Rule paling atas (tidak pernah di-disable oleh script mode):
    /ip firewall mangle add chain=prerouting action=accept \
      src-address=192.168.0.33 comment="hybrid mgmt bypass laptop" place-before=0

  SSH saat apply/maintenance: admin@192.168.0.1 port 255
  Checklist: server/mikrotik-hybrid-apply-checklist.txt


### 4.6 Logika script mode (konsep RouterOS)

  hybrid-set-mode-both-up:
    enable mangle [find comment~"hybrid office PCC"]
    enable mangle [find comment~"hybrid vpn PCC"]
    enable mangle [find comment~"hybrid route ISP"]
    log: "HYBRID: mode BOTH-UP — PCC enabled"

  hybrid-set-mode-isp1-down:
    disable mangle [find comment~"hybrid office PCC"]
    disable mangle [find comment~"hybrid vpn PCC"]
    disable mangle [find comment~"hybrid route ISP"]
    log: "HYBRID: mode ISP1-DOWN — failover ISP2, PCC off"
    (traffic user mengikuti main table → backup route ISP2)

  hybrid-set-mode-isp2-down:
    disable mangle [find comment~"hybrid office PCC ISP2"]
    disable mangle [find comment~"hybrid vpn PCC ISP2"]
    disable mangle [find comment~"hybrid route ISP2"]
    enable mangle [find comment~"hybrid office PCC ISP1"]
    enable mangle [find comment~"hybrid vpn PCC ISP1"]
    enable mangle [find comment~"hybrid route ISP1"]
    log: "HYBRID: mode ISP2-DOWN — ISP1 only"

  Scheduler cadangan (setiap 1 menit): hybrid-sync-mode
    Deteksi GW pakai :len [/ping ...] — bukan packet-loss=0 (bug Fase 2 pertama).


5. APA YANG DI-HYBRID — APA YANG TIDAK
--------------------------------------

LOAD BALANCE (PCC, saat both up):
  [x] Internet user kantor 192.168.0.x (~50/50 per koneksi)
  [x] Internet user VPN 100.100.1.x (~50/50 per koneksi)

FAILOVER (saat salah satu ISP down):
  [x] User kantor & VPN → ISP yang masih hidup (100%)
  [x] Office ↔ server 10.100.1.x (bypass rule, tidak terpengaruh PCC)

TIDAK DI-HYBRID:
  [ ] Satu koneksi/download = gabungan kecepatan ISP1+ISP2
  [ ] dst-nat inbound 117.102.73.x (tetap ether1; mati jika ISP1 down)
  [ ] Server 10.100.1.x internet keluar (tetap ISP1; mati jika ISP1 down)
  [ ] Hairpin NAT berbasis ether1 saat ISP1 down


6. MENGAPA PERLU TIGA LAPIS (PCC + check-gateway + Netwatch)
------------------------------------------------------------

| Lapisan          | Fungsi                                              |
|------------------|-----------------------------------------------------|
| PCC              | Bagi koneksi user ke ISP1/ISP2 saat keduanya sehat  |
| check-gateway    | Route per tabel ISP inactive jika GW tidak pingable |
| Netwatch         | Disable PCC saat ISP down — cegah mark ke tabel mati |

  check-gateway saja TIDAK cukup: koneksi sudah ter-mark PCC ISP2 tetap
  diarahkan ke tabel KE ISP 2 meski route inactive → blackhole.

  Netwatch saja TIDAK cukup: perlu check-gateway agar route failover
  main table akurat.

  PCC saja TIDAK cukup: sudah terbukti merusak internet kantor (Jun 2026).


7. PRA-SYARAT EKSEKUSI
----------------------

  Wajib selesai SEBELUM hybrid:
  [ ] Failover dasar (mikrotik-failover-design) sudah dites — ISP2 backup OK
  [ ] sfp-sfpplus1 link UP, DHCP bound (mis. 192.168.1.52/24)
  [ ] Ping 117.102.73.97 dan 192.168.1.1 dari Mikrotik OK
  [ ] Internet via masing-masing ISP terbukti (tes terpisah)
  [ ] Export backup: /export file=pre-hybrid-backup
  [ ] Restore Fase 1 siap: restore-failover-phase1-mikrotik.ps1
  [ ] Backup Fase 1: server/mikrotik-failover-phase1-backup.txt
  [ ] Buka 2 sesi SSH ke 192.168.0.1:255 (cadangan)
  [ ] Aktifkan Safe Mode Winbox/SSH (disarankan)
  [ ] IP laptop admin di hybrid.rsc: 192.168.0.33
  [ ] Checklist lengkap: server/mikrotik-hybrid-apply-checklist.txt

  Jangan lompat langsung ke hybrid dari baseline single-ISP.


8. TAHAP EKSEKUSI (BERURUTAN)
-----------------------------

  Fase 0 — Backup baseline
    /export file=pre-hybrid-backup

  Fase 1 — Failover dasar (dokumen terpisah)
    Aktifkan ISP2, route main check-gateway distance 1+2
    Tes: cabut ISP1 → user internet via ISP2 → restore

  Fase 2 — Routing table + rules hybrid
    Tambah route KE ISP 1/2 dengan check-gateway
    Tambah routing rules hybrid ISP1/ISP2
    Belum enable PCC

  Fase 3 — Mangle bypass + server force
    Rule server force ISP1 + office-to-server-bypass
    Tes: office→10.100.1.x tetap OK

  Fase 4 — PCC (awal disabled ISP2 half)
    Enable PCC ISP1 only → tes internet office
    Enable PCC ISP2 + route marks → tes both ISP

  Fase 5 — Netwatch + script mode
    Pasang monitor GW + script enable/disable PCC
    Tes failover: ISP1 down → PCC off → ISP2 100%
    Tes failover: ISP2 down → PCC ISP2 off → ISP1 100%
    Tes recovery: kedua ISP up → PCC on lagi

  Fase 6 — Dokumentasi produksi
    Update existing-network-geonet.txt jika diterima sebagai standar baru


9. ROLLBACK
-----------

  Restore ke Failover Fase 1 (RECOMMENDED jika Hybrid gagal):
    .\scripts\restore-failover-phase1-mikrotik.ps1
    Acuan: server/mikrotik-failover-phase1-backup.txt

  Rollback ke single-ISP (hanya jika perlu hapus failover sepenuhnya):
    .\scripts\rollback-single-wan-mikrotik.ps1

  Manual restore Fase 1:
    /import file=restore-failover-phase1.rsc


10. RISIKO & MITIGASI
---------------------

| Risiko                         | Dampak                    | Mitigasi                        |
|--------------------------------|---------------------------|---------------------------------|
| Flapping ISP1/ISP2             | Internet putus-nyambung   | Netwatch timeout+interval; hysteresis scheduler |
| PCC on saat ISP2 down          | ~50% koneksi gagal        | Netwatch WAJIB disable PCC ISP2 |
| Office tidak bisa ke server    | Produksi terganggu        | Rule bypass place-before PCC    |
| dst-nat mati ISP1 down         | Layanan publik down       | Komunikasi ke stakeholder; monitor |
| Config terlalu kompleks        | Sulit troubleshoot        | Comment prefix "hybrid"; dokumentasi mode |
| Script RouterOS error          | Mode salah                | Scheduler koreksi + log         |


11. VERIFIKASI SETELAH IMPLEMENTASI
-----------------------------------

  # Mode & route
  /ip route print detail where comment~"hybrid"
  /routing rule print
  /ip firewall mangle print

  # Netwatch
  /tool netwatch print

  # Tes dari Mikrotik
  /ping 8.8.8.8 count=5
  /ping 192.168.0.1 count=2
  /ping 10.100.1.10 count=2

  # Tes dari laptop kantor (192.168.0.x)
  ping 8.8.8.8
  ping 10.100.1.1
  ping 10.100.1.10
  tracert 8.8.8.8  (lihat keluar ISP1 atau ISP2)

  # Tes failover manual
  - Simulasi ISP1 down → semua user via ISP2, PCC off
  - Simulasi ISP2 down → semua user via ISP1, PCC ISP2 off
  - Restore → PCC 50/50 kembali


12. FILE YANG AKAN DIBUAT SAAT EKSEKUSI (BELUM ADA)
---------------------------------------------------

  server/mikrotik-hybrid.rsc              — config + script (mgmt bypass + sync fix)
  server/mikrotik-hybrid-apply-checklist.txt — checklist apply aman
  scripts/apply-hybrid-mikrotik.ps1       — deploy (default SSH 192.168.0.1)

  Rollback tetap:
  scripts/rollback-single-wan-mikrotik.ps1
  server/mikrotik-rollback-single-wan.rsc


13. REFERENSI
-------------

  server/mikrotik-hybrid-design.txt       — dokumen ini
  server/existing-network-geonet.txt       — baseline produksi (single-ISP)
  server/mikrotik-failover-design.txt     — Fase 1 failover (prasyarat)
  server/mikrotik-dual-wan.rsc            — PCC lama TANPA Netwatch (JANGAN pakai langsung)
  server/mikrotik-audit.txt               — audit perimeter lengkap
  scripts/rollback-single-wan-mikrotik.ps1
