JARINGAN GEONET — ACUAN STANDAR KONEKSI (BASELINE)
==================================================
Tanggal snapshot : 2026-06-13
Status           : AKTIF — Failover Fase 1 (ISP1 primary + ISP2 backup, check-gateway)
Router           : MikroTik CCR2004-1G-12S+2XS, RouterOS 7.5, hostname MikroTik
Sumber data      : Live SSH 10.100.1.1, apply-failover-mikrotik.ps1, tes ping 2026-06-13

Dokumen ini adalah BACKUP ACUAN untuk:
  1. Internet user kantor & VPN (failover ISP1→ISP2)
  2. Komunikasi user (office/VPN) ↔ server (10.100.1.0/24)
  3. Restore jika perubahan routing merusak koneksi

Detail audit lengkap (NAT publik, firewall, VPN): server/mikrotik-audit.txt
Desain failover: server/mikrotik-failover-design.txt
Script deploy failover: scripts/apply-failover-mikrotik.ps1
Rollback ke single-ISP: scripts/rollback-single-wan-mikrotik.ps1
Backup Fase 1 (restore setelah Hybrid gagal): server/mikrotik-failover-phase1-backup.txt


A. PRINSIP KONEKSI STANDAR
--------------------------

Internet keluar ISP1 utama (ether1); ISP2 standby failover otomatis.
  Route primary : 0.0.0.0/0 → 117.102.73.97 distance=1 check-gateway=ping  [failover ISP1 primary]
  Route backup  : 0.0.0.0/0 → 192.168.1.1   distance=2 check-gateway=ping  [failover ISP2 backup]
  ISP2 interface: sfp-sfpplus1 ENABLED, DHCP bound (192.168.1.52/24)
  Saat ISP1 GW down → traffic user otomatis ke ISP2; recovery otomatis ke ISP1

User kantor dan server saling routing lewat Mikrotik tanpa policy routing khusus:
  Office 192.168.0.0/24  ──►  Mikrotik  ──►  Server 10.100.1.0/24  (langsung, bridge)
  Server 10.100.1.0/24   ──►  Mikrotik  ──►  Office / Internet

NAT keluar internet:
  masquerade out-interface=ether1        (utama)
  masquerade out-interface=sfp-sfpplus1 (siap ISP2, tidak aktif)
  masquerade tanpa out-interface       (catch-all, rule #2 — AKTIF)

Hairpin NAT: user kantor akses domain publik diarahkan ke server internal
  192.168.0.0/24 → 10.100.1.24:80/443 dan 10.100.1.100:443


B. SEGMEN JARINGAN & GATEWAY
----------------------------

| Segment          | Network         | Gateway Mikrotik | Bridge/Interface      | DHCP        |
|------------------|-----------------|------------------|-----------------------|-------------|
| Server LAN       | 10.100.1.0/24   | 10.100.1.1       | server                | —           |
| Office kantor    | 192.168.0.0/24  | 192.168.0.1      | office / sfp-sfpplus10| dhcp1 (4w3d)|
| VPN remote       | 100.100.1.0/24  | 100.100.1.0      | vpn                   | dhcp2 (10m) |
| IBM (inactive)   | 192.168.2.0/24  | 192.168.2.1      | vlan2004              | relay (off) |
| WAN publik       | 117.102.73.96/29| 117.102.73.97    | ether1                | —           |

DNS DHCP office & VPN : 203.142.82.222, 203.142.84.222


C. ALUR KONEKSI USER → INTERNET
-------------------------------

C1. User kantor (192.168.0.x)
  PC
    → DHCP Mikrotik (pool 192.168.0.2–254, gateway 192.168.0.1)
    → Forward Mikrotik (tanpa mangle PCC — semua rule dual-wan DIHAPUS)
    → NAT masquerade out-interface=ether1
    → Internet sebagai IP publik 117.102.73.x

C2. User VPN remote (100.100.1.x)
  Client SSTP/PPTP (port 443)
    → Autentikasi RADIUS → AD 10.100.1.40 (domain gisportal.id)
    → IP dari dhcp2
    → NAT masquerade → ether1 → Internet

C3. User PPP dengan IP server (10.100.1.2xx)
  VPN dial-in → IP tetap di LAN server → Internet via masquerade ether1


D. ALUR KONEKSI USER → SERVER
-----------------------------

D1. User kantor → server internal (langsung)
  192.168.0.x → 10.100.1.x
    Routing: connected route 10.100.1.0/24 via bridge server
    Tidak ada firewall block umum office→server (kecuali host terisolasi)
    Contoh host: .24 reverse proxy, .25 DB, .40 AD, .41 web, .42 Zabbix, .10 NAS

D2. User kantor → layanan publik (hairpin)
  Browser ke gisportal.id / geonet.co.id
    → dst-nat inbound tetap ke ether1 (tidak diubah)
    → Hairpin NAT mengarahkan 192.168.0.x ke 10.100.1.24 tanpa keluar WAN

D3. User VPN → server
  100.100.1.x → 10.100.1.0/24 (full access server LAN)

D4. Akses management Mikrotik dari user
  SSH  : port 255, subnet 10.100.1.0/24 dan 192.168.0.0/24
  Winbox: port 8291, subnet yang sama


E. HOST PENTING (USER ↔ SERVER)
-------------------------------

| Host              | IP server      | IP office (jika ada) | Akses user kantor        |
|-------------------|----------------|----------------------|--------------------------|
| Mikrotik          | 10.100.1.1     | 192.168.0.1          | SSH/Winbox               |
| NAS QNAP          | 10.100.1.10    | 192.168.0.10         | https://192.168.0.10     |
| SwOS CRS326       | 10.100.1.2     | —                    | http://10.100.1.2        |
| SwOS CSS610       | 10.100.1.3     | —                    | http://10.100.1.3        |
| Reverse proxy     | 10.100.1.24    | —                    | Hairpin / internal       |
| Main Database     | 10.100.1.25    | —                    | Port app (1433/5432)     |
| AD-LDAP           | 10.100.1.40    | —                    | LDAP/RADIUS              |
| Main Webserver    | 10.100.1.41    | —                    | IIS internal             |
| Zabbix            | 10.100.1.42    | —                    | Monitoring               |

SSH ke server: lihat server/host.txt


F. KONFIGURASI MIKROTIK SAAT INI (ELEMEN KRITIS)
------------------------------------------------

F1. WAN — failover Fase 1
  ether1         : RUNNING — ISP utama, IP publik 117.102.73.96/29
  sfp-sfpplus1   : RUNNING — ISP kedua standby failover
  dhcp-client sfp-sfpplus1 : ENABLED, bound 192.168.1.52/24, add-default-route=no

F2. Routing
  Main table:
    failover ISP1 primary : 0.0.0.0/0 → 117.102.73.97 distance=1 check-gateway=ping [ACTIVE]
    failover ISP2 backup  : 0.0.0.0/0 → 192.168.1.1   distance=2 check-gateway=ping [STANDBY]
  Connected (otomatis):
    10.100.1.0/24  → server
    192.168.0.0/24 → office
    100.100.1.0/32 → vpn
    117.102.73.x   → ether1
  Legacy (tidak dipakai failover user):
    0.0.0.0/0 → 192.168.1.1 routing-table=KE ISP 2  [ada, bukan main failover]
  Routing rules dual-wan : TIDAK ADA

F3. Mangle — tidak ada policy routing dual-WAN
  Rule dual-wan (PCC, route mark, server force ISP1) : DIHAPUS
  Rule office-to-server-bypass                        : DIHAPUS
  Rule load-balance lama (pra dual-WAN)               : ADA, semua DISABLED (X)
    — tidak mempengaruhi traffic; jangan di-enable tanpa review

F4. NAT srcnat (baseline)
  #0 masquerade out-interface=ether1         — enabled
  #1 masquerade out-interface=sfp-sfpplus1 — enabled (ISP2 mati, tidak terpakai)
  #2 masquerade (catch-all)                — enabled
  #3–#5 Hairpin NAT                        — enabled

F5. Port fisik → bridge (ringkas)
  server bridge : sfp-sfpplus2,3,5 + vlan3,10,11,12,99
  office bridge : sfp-sfpplus10,11 + vlan2010,2012
  NAS           : sfp-sfpplus5 → server
  Switch kantor : sfp-sfpplus10,11 → office


G. VERIFIKASI KONEKTIVITAS (2026-06-13)
---------------------------------------

Tes dari laptop 192.168.0.33 (Ethernet) dan Mikrotik 10.100.1.1:

| Target        | Laptop | Mikrotik | Catatan                          |
|---------------|:------:|:--------:|----------------------------------|
| 10.100.1.1    | OK     | OK       | Gateway server                   |
| 10.100.1.10   | OK     | OK       | NAS 10GbE                        |
| 10.100.1.2    | OK     | OK       | SwOS switch                      |
| 10.100.1.3    | OK     | OK       | SwOS switch                      |
| 10.100.1.24   | timeout| timeout  | ICMP diblokir host (bukan routing)|
| 192.168.0.1   | OK     | OK       | Gateway office                   |
| 192.168.0.10  | OK     | OK       | NAS 1GbE                         |
| 100.100.1.0   | OK     | OK       | Gateway VPN (bukan .1)         |
| 8.8.8.8       | OK     | OK       | Internet ~14 ms                  |

Kesimpulan verifikasi: routing office↔server dan internet NORMAL pada baseline ini.


H. RESTORE KE BASELINE (JIKA KONEKSI RUSAK)
-------------------------------------------

Gejala umum setelah eksperimen dual-WAN:
  - User kantor tidak bisa internet (~50% packet loss)
  - User kantor tidak bisa akses 10.100.1.x
  - Server traffic ter-mark ke routing table KE ISP 1/2

Langkah restore:

  1. SSH ke Mikrotik:
       .\scripts\ssh-mikrotik.ps1
       # dari office: admin@192.168.0.1 port 255

  2. Jalankan rollback otomatis:
       .\scripts\rollback-single-wan-mikrotik.ps1

  3. Verifikasi:
       /ip route print where dst-address=0.0.0.0/0
       /routing rule print
       /ip firewall mangle print
       /ping 8.8.8.8 count=3
       /ping 192.168.0.1 count=2

  4. Tes dari laptop kantor:
       ping 192.168.0.1
       ping 10.100.1.1
       ping 10.100.1.10
       ping 8.8.8.8

File rollback : server/mikrotik-rollback-single-wan.rsc

Perintah manual (jika script tidak bisa):
  /interface ethernet set sfp-sfpplus1 disabled=yes
  /ip dhcp-client set [find interface=sfp-sfpplus1] disabled=yes
  /ip firewall mangle remove [find comment~"dual-wan"]
  /ip firewall mangle remove [find comment="office-to-server-bypass"]
  /routing rule remove [find comment~"dual-wan"]
  /ip route remove [find comment~"dual-wan ISP1"]
  /ip firewall nat set 2 disabled=no


I. BACKUP CONFIG ROUTER
-----------------------

Export config periodik (disarankan sebelum perubahan besar):

  .\scripts\ssh-mikrotik.ps1 -Command "/export file=backup-existing-network-geonet"

Download backup:
  scp -P 255 -m hmac-sha1 -i %USERPROFILE%\.ssh\id_rsa_mikrotik \
      admin@10.100.1.1:backup-existing-network-geonet.rsc server/


J. YANG TIDAK BOLEH DIUBAH TANPA REVIEW
---------------------------------------

  - dst-nat rules ke 10.100.1.x (layanan publik gisportal.id / geonet.co.id)
  - Hairpin NAT office → 10.100.1.24
  - DHCP pool & gateway office (192.168.0.1)
  - Firewall DROP server tertentu ke internet langsung
  - RADIUS VPN → 10.100.1.40

Eksperimen Hybrid Fase 2: lihat server/mikrotik-hybrid-design.txt.
Restore ke Fase 1 jika gagal: scripts/restore-failover-phase1-mikrotik.ps1
Acuan backup Fase 1: server/mikrotik-failover-phase1-backup.txt


L. RESTORE FASE 1 (SETELAH HYBRID FASE 2 GAGAL)
-----------------------------------------------

  .\scripts\restore-failover-phase1-mikrotik.ps1

  Menghapus: mangle/routing/netwatch hybrid
  Mengembalikan: route failover ISP1+ISP2 dengan check-gateway
  BUKAN menghapus failover — tetap dual-WAN failover mode.


K. REFERENSI FILE TERKAIT
-------------------------

  server/existing-network-geonet.txt        ← dokumen ini (acuan koneksi)
  server/mikrotik-failover-phase1-backup.txt ← BACKUP Fase 1 terverifikasi
  server/backup-failover-phase1.rsc         ← export penuh dari router
  server/mikrotik-failover-design.txt       ← desain failover
  server/mikrotik-hybrid-design.txt         ← Fase 2 Hybrid (rencana)
  server/mikrotik-audit.txt                 ← audit perimeter
  server/host.txt                           ← SSH ke semua host
  server/mikrotik-failover.rsc
  server/mikrotik-restore-failover-phase1.rsc
  server/mikrotik-rollback-single-wan.rsc
  scripts/ssh-mikrotik.ps1
  scripts/apply-failover-mikrotik.ps1
  scripts/restore-failover-phase1-mikrotik.ps1
  scripts/rollback-single-wan-mikrotik.ps1
