# jul/06/2026 15:46:32 by RouterOS 7.5 # software id = E3H0-EVXR # # model = CCR2004-1G-12S+2XS # serial number = HDD08647CP6 /interface bridge add name=office add name=server add add-dhcp-option82=yes dhcp-snooping=yes name=vpn /interface ethernet set [ find default-name=ether1 ] comment="ISP BIZNET" set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no comment=\ "ISP IDBIZ" set [ find default-name=sfp-sfpplus2 ] comment=DELL-main-netwokrkVMBR0 \ loop-protect=on loop-protect-disable-time=10s set [ find default-name=sfp-sfpplus3 ] comment=DELL loop-protect=on \ loop-protect-disable-time=10s set [ find default-name=sfp-sfpplus4 ] comment=IBM loop-protect=on \ loop-protect-disable-time=10s set [ find default-name=sfp-sfpplus5 ] comment=NAS set [ find default-name=sfp-sfpplus6 ] auto-negotiation=no disabled=yes set [ find default-name=sfp-sfpplus10 ] comment="swich server" set [ find default-name=sfp-sfpplus11 ] comment="swich production" speed=\ 10Gbps set [ find default-name=sfp-sfpplus12 ] comment="swich adm" speed=10Gbps /interface vlan add interface=sfp-sfpplus12 loop-protect=on name=vlan3 vlan-id=3 add interface=sfp-sfpplus10 loop-protect=on name=vlan10 vlan-id=10 add interface=sfp-sfpplus11 loop-protect=on name=vlan11 vlan-id=11 add interface=sfp-sfpplus12 loop-protect=on name=vlan12 vlan-id=12 add interface=sfp-sfpplus10 name=vlan99 vlan-id=99 add disabled=yes interface=sfp-sfpplus10 loop-protect=on name=vlan2001 \ vlan-id=2001 add interface=sfp-sfpplus4 name=vlan2004 vlan-id=2001 add interface=sfp-sfpplus10 loop-protect=on name=vlan2010 vlan-id=2010 add interface=sfp-sfpplus12 loop-protect=on name=vlan2012 vlan-id=2012 /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip pool add name=dhcp_pool0 ranges=192.168.0.2-192.168.0.254 add name=dhcp_pool1 ranges=192.168.0.2-192.168.0.254 add name=dhcp_pool2 ranges=192.168.0.2-192.168.0.254 add name=dhcp_pool3 ranges=192.168.0.2-192.168.0.254 add name=dhcp_pool4 ranges=100.100.1.2-100.100.1.254 add name=dhcp_pool5 ranges=192.168.2.2-192.168.2.254 add name=dhcp_pool6 ranges=192.168.2.2-192.168.2.254 /ip dhcp-server add address-pool=dhcp_pool3 interface=office lease-time=4w3d name=dhcp1 add address-pool=dhcp_pool4 interface=vpn name=dhcp2 # DHCP server can not run on slave interface! add address-pool=dhcp_pool6 interface=vlan2004 name=dhcp3 relay=192.168.2.1 /port set 0 name=serial0 set 1 name=serial1 /queue simple add name=multimedia priority=1/1 target=192.168.0.4/32 add disabled=yes name=priotiry priority=2/2 target=office /routing table add disabled=no fib name="KE ISP 1" add disabled=no fib name="KE ISP 2" /snmp community set [ find default=yes ] write-access=yes /interface bridge port add bridge=server interface=sfp-sfpplus2 add bridge=server interface=sfp-sfpplus3 add bridge=server interface=sfp-sfpplus4 add bridge=server interface=sfp-sfpplus5 add bridge=office interface=sfp-sfpplus10 trusted=yes add bridge=office interface=sfp-sfpplus11 trusted=yes add bridge=office disabled=yes interface=sfp-sfpplus12 add bridge=server interface=vlan10 add bridge=server interface=vlan11 add bridge=server interface=vlan12 add bridge=server interface=vlan99 add bridge=office interface=vlan2010 trusted=yes add bridge=server interface=vlan3 add bridge=office interface=vlan2012 trusted=yes add bridge=office interface=vlan2004 trusted=yes add bridge=server interface=sfp-sfpplus6 /interface pptp-server server # PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead set enabled=yes /interface sstp-server server set enabled=yes /ip address add address=192.168.88.1/24 comment=defconf disabled=yes interface=ether1 \ network=192.168.88.0 add address=117.102.73.102/29 comment=gisportal.id interface=ether1 network=\ 117.102.73.96 add address=117.102.73.101 comment="Not Set" interface=ether1 network=\ 117.102.73.101 add address=117.102.73.100 comment=dev.gisportal.id interface=ether1 network=\ 117.102.73.100 add address=117.102.73.98 comment=geonet.co.id interface=ether1 network=\ 117.102.73.96 add address=10.100.1.1/24 interface=server network=10.100.1.0 add address=117.102.73.99 comment=geonet.co.id interface=ether1 network=\ 117.102.73.99 add address=192.168.0.1/24 interface=sfp-sfpplus10 network=192.168.0.0 add address=100.100.1.0 interface=vpn network=100.100.1.0 add address=192.168.2.0/24 interface=vlan2004 network=192.168.2.0 /ip dhcp-client add add-default-route=no interface=sfp-sfpplus1 use-peer-dns=no /ip dhcp-server lease add address=192.168.0.11 client-id=1:bc:fc:e7:8e:55:67 mac-address=\ BC:FC:E7:8E:55:67 server=dhcp1 add address=192.168.0.102 client-id=1:18:fb:7b:a5:50:8b mac-address=\ 18:FB:7B:A5:50:8B server=dhcp1 add address=192.168.0.9 client-id=1:18:fd:74:52:8e:5f comment=swich \ mac-address=18:FD:74:52:8E:5F server=dhcp1 add address=192.168.0.8 client-id=1:18:fd:74:8b:b2:7f comment=swich \ mac-address=18:FD:74:8B:B2:7F server=dhcp1 add address=192.168.0.4 mac-address=10:5F:02:84:F0:2F server=dhcp1 add address=192.168.0.10 client-id=1:24:5e:be:42:8f:a5 mac-address=\ 24:5E:BE:42:8F:A5 server=dhcp1 add address=192.168.0.74 client-id=1:b4:2e:99:2a:30:4c mac-address=\ B4:2E:99:2A:30:4C server=dhcp1 add address=192.168.0.20 client-id=1:80:3f:5d:f9:c1:40 comment=WAVLINK \ mac-address=80:3F:5D:F9:C1:40 server=dhcp1 add address=192.168.0.57 client-id=1:bc:24:11:5d:58:56 mac-address=\ BC:24:11:5D:58:56 server=dhcp1 add address=192.168.0.13 client-id=1:a0:d3:65:73:c7:97 mac-address=\ A0:D3:65:73:C7:97 server=dhcp1 add address=192.168.0.18 client-id=1:10:ff:e0:3a:7d:15 mac-address=\ 10:FF:E0:3A:7D:15 server=dhcp1 add address=192.168.0.64 client-id=1:72:7e:64:31:eb:13 mac-address=\ 72:7E:64:31:EB:13 server=dhcp1 add address=192.168.0.80 client-id=1:0:1:f5:2:b:d1 mac-address=\ 00:01:F5:02:0B:D1 server=dhcp1 add address=192.168.0.69 mac-address=40:A3:CC:B1:02:15 server=dhcp1 /ip dhcp-server network add address=100.100.1.0/24 dns-server=100.100.1.1 gateway=100.100.1.1 add address=192.168.0.0/24 dns-server=203.142.82.222,203.142.84.222 gateway=\ 192.168.0.1 add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.1.1 gateway=192.168.2.1 /ip dns set allow-remote-requests=yes servers=203.142.82.222,203.142.84.222 /ip dns static add address=10.100.1.61 disabled=yes name=arcgisenterprise.gisportal.id add address=10.100.1.72 name=aernd.gisportal.id add address=10.100.1.25 name=database.gisportal.id add address=10.100.1.24 comment="split-dns gisportal apex" name=gisportal.id add address=10.100.1.24 comment="split-dns dockge" name=dockge.gisportal.id add address=10.100.1.24 name=geonet.gisportal.id add address=10.100.1.24 name=api.gisportal.id add address=10.100.1.25 comment="split-dns database regexp" regexp=\ "^database\\.gisportal\\.id" add address=10.100.1.72 comment="split-dns aernd regexp" regexp=\ "^aernd\\.gisportal\\.id" add address=10.100.1.51 comment="split-dns dev regexp" regexp=\ "^dev\\.gisportal\\.id" add address=10.100.1.24 comment="split-dns gisportal catch-all" regexp=\ "\\.gisportal\\.id" add address=10.100.1.24 comment="split-dns iguf" name=iguf.geonet.co.id add address=10.100.1.24 comment=geonetagent-collector name=\ collector.gisportal.id add address=10.100.1.24 comment=geonetagent-agent name=agent.gisportal.id /ip firewall address-list add address=10.100.1.101 list=blocked-internet add address=10.100.1.100 list=blocked-internet add address=10.100.1.88 list=blocked-internet add address=10.100.1.84 list=blocked-internet add address=10.100.1.91 list=blocked-internet add address=10.100.1.61 list=blocked-internet add address=10.100.1.72 list=blocked-internet add address=10.100.1.80 list=blocked-internet add address=10.100.1.40 list=blocked-internet add address=10.100.1.51 list=blocked-internet add address=10.100.1.25 list=blocked-internet add address=10.100.1.56 list=blocked-internet add address=10.100.1.58 list=blocked-internet add address=10.100.1.55 list=blocked-internet add address=10.100.1.53 list=blocked-internet /ip firewall filter add action=drop chain=forward connection-state=new dst-address-list=ddosed \ src-address-list=ddoser add action=jump chain=forward connection-state=new jump-target=detect-ddos add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/1s add action=add-dst-to-address-list address-list=ddosed address-list-timeout=\ 10m chain=detect-ddos add action=add-src-to-address-list address-list=ddoser address-list-timeout=\ 10m chain=detect-ddos add action=drop chain=forward comment=block-internet-biznet disabled=yes \ out-interface=ether1 src-address-list=blocked-internet add action=drop chain=forward comment=block-internet-idbiz disabled=yes \ out-interface=sfp-sfpplus1 src-address-list=blocked-internet /ip firewall mangle add action=accept chain=prerouting comment="hybrid server-local-bypass" \ dst-address=10.100.1.0/24 src-address=10.100.1.0/24 add action=accept chain=prerouting comment="hybrid server-to-office-bypass" \ dst-address=192.168.0.0/24 src-address=10.100.1.0/24 add action=accept chain=prerouting comment="hybrid server-to-vpn-bypass" \ dst-address=100.100.1.0/24 src-address=10.100.1.0/24 add action=accept chain=prerouting comment="hybrid mgmt bypass laptop" \ disabled=yes src-address=192.168.0.33 add action=accept chain=prerouting comment="hybrid mgmt bypass laptop" \ src-address=10.100.1.220 add action=accept chain=prerouting comment="hybrid server hairpin bypass" \ dst-address=117.102.73.96/29 src-address=10.100.1.0/24 add action=mark-routing chain=prerouting comment=temp-speedtest-isp2 \ disabled=yes new-routing-mark="KE ISP 2" passthrough=yes src-address=\ 10.100.1.24 add action=mark-routing chain=prerouting comment="hybrid server force ISP1" \ new-routing-mark="KE ISP 1" passthrough=no src-address=10.100.1.0/24 add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ yes in-interface=vlan2004 new-connection-mark="ISP 2" passthrough=yes \ per-connection-classifier=both-addresses-and-ports:2/1 add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ yes in-interface=server new-connection-mark="ISP 1" passthrough=yes \ per-connection-classifier=both-addresses-and-ports:2/0 add action=mark-routing chain=prerouting connection-mark="ISP 2" disabled=yes \ in-interface=vlan2004 new-routing-mark="KE ISP 2" passthrough=yes \ per-connection-classifier=both-addresses-and-ports:2/1 add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ yes in-interface=sfp-sfpplus1 new-connection-mark="ISP 2" passthrough=yes add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ yes in-interface=ether1 new-connection-mark="ISP 1" passthrough=yes add action=mark-routing chain=output connection-mark="ISP 2" disabled=yes \ new-routing-mark="KE ISP 2" passthrough=yes add action=accept chain=prerouting comment="hybrid office-to-server-bypass" \ dst-address=10.100.1.0/24 in-interface=office add action=accept chain=prerouting comment="hybrid office hairpin bypass" \ dst-address=117.102.73.96/29 in-interface=office add action=mark-connection chain=prerouting comment="hybrid office PCC ISP1" \ connection-mark=no-mark in-interface=office new-connection-mark="ISP 1" \ passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0 add action=mark-connection chain=prerouting comment="hybrid office PCC ISP2" \ connection-mark=no-mark in-interface=office new-connection-mark="ISP 2" \ passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 add action=accept chain=prerouting comment="hybrid vpn hairpin bypass" \ dst-address=117.102.73.96/29 src-address=100.100.1.0/24 add action=mark-connection chain=prerouting comment="hybrid vpn PCC ISP1" \ connection-mark=no-mark disabled=yes in-interface=vpn \ new-connection-mark="ISP 1" passthrough=yes per-connection-classifier=\ both-addresses-and-ports:2/0 add action=mark-connection chain=prerouting comment="hybrid vpn PCC ISP2" \ connection-mark=no-mark disabled=yes in-interface=vpn \ new-connection-mark="ISP 2" passthrough=yes per-connection-classifier=\ both-addresses-and-ports:2/1 add action=mark-routing chain=prerouting comment="hybrid route ISP1" \ connection-mark="ISP 1" new-routing-mark="KE ISP 1" passthrough=yes add action=mark-routing chain=prerouting comment="hybrid route ISP2" \ connection-mark="ISP 2" new-routing-mark="KE ISP 2" passthrough=yes /ip firewall nat add action=masquerade chain=srcnat out-interface=ether1 add action=masquerade chain=srcnat out-interface=sfp-sfpplus1 add action=masquerade chain=srcnat add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=80 \ protocol=tcp to-addresses=10.100.1.24 to-ports=80 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.101 \ dst-port=80 protocol=tcp to-addresses=10.100.1.24 to-ports=80 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=80 \ protocol=tcp to-addresses=10.100.1.76 to-ports=80 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=25 \ protocol=tcp to-addresses=10.100.1.76 to-ports=25 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=25 \ protocol=tcp to-addresses=10.100.1.76 to-ports=25 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=143 \ protocol=tcp to-addresses=10.100.1.76 to-ports=143 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=143 \ protocol=tcp to-addresses=10.100.1.76 to-ports=143 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=993 \ protocol=tcp to-addresses=10.100.1.76 to-ports=993 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=993 \ protocol=tcp to-addresses=10.100.1.76 to-ports=993 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=587 \ protocol=tcp to-addresses=10.100.1.76 to-ports=587 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=587 \ protocol=tcp to-addresses=10.100.1.76 to-ports=587 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.101 \ dst-port=443 protocol=tcp to-addresses=10.100.1.24 to-ports=443 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=24 \ protocol=tcp to-addresses=10.100.1.24 to-ports=22 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=21 \ protocol=tcp to-addresses=10.100.1.10 to-ports=21 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=443 \ protocol=tcp to-addresses=10.100.1.24 to-ports=443 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=443 \ protocol=tcp to-addresses=10.100.1.24 to-ports=443 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=80 \ protocol=tcp to-addresses=10.100.1.24 to-ports=80 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=443 \ protocol=tcp to-addresses=10.100.1.51 to-ports=443 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=1433 \ protocol=tcp to-addresses=10.100.1.25 to-ports=1433 add action=dst-nat chain=dstnat comment="rnd SQL Server 2016" dst-address=\ 117.102.73.102 dst-port=1434 protocol=tcp to-addresses=10.100.1.75 \ to-ports=1433 add action=dst-nat chain=dstnat comment="Zabbiz agenet active" dst-address=\ 117.102.73.102 dst-port=10051 protocol=tcp to-addresses=10.100.1.42 \ to-ports=10051 add action=dst-nat chain=dstnat comment="rnd SQL Server 2022" dst-address=\ 117.102.73.102 dst-port=1437 protocol=tcp to-addresses=10.100.1.77 \ to-ports=1433 add action=dst-nat chain=dstnat comment="rnd SQL Server 2016" dst-address=\ 117.102.73.102 dst-port=1436 protocol=tcp to-addresses=10.100.1.76 \ to-ports=1433 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5432 \ protocol=tcp to-addresses=10.100.1.25 to-ports=5432 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=8080 \ protocol=tcp to-addresses=10.100.1.27 to-ports=8080 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5434 \ protocol=tcp to-addresses=10.100.1.27 to-ports=5434 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=30443 \ protocol=tcp to-addresses=10.100.1.59 to-ports=30443 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=6143 \ protocol=tcp to-addresses=10.100.1.59 to-ports=6143 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=13443 \ protocol=tcp to-addresses=10.100.1.57 to-ports=13443 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=6443 \ protocol=tcp to-addresses=10.100.1.51 to-ports=6443 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=80 \ protocol=tcp to-addresses=10.100.1.51 to-ports=80 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=7443 \ protocol=tcp to-addresses=10.100.1.51 to-ports=7443 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=2443 \ protocol=tcp to-addresses=10.100.1.51 to-ports=2443 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5433 \ protocol=tcp to-addresses=10.100.1.27 to-ports=5432 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=25 \ protocol=tcp to-addresses=10.100.1.28 to-ports=25 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=993 \ protocol=tcp to-addresses=10.100.1.28 to-ports=993 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=587 \ protocol=tcp to-addresses=10.100.1.28 to-ports=587 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=465 \ protocol=tcp to-addresses=10.100.1.28 to-ports=465 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=25 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=25 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=995 \ protocol=tcp to-addresses=10.100.1.40 to-ports=995 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=995 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=995 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=25 protocol=udp to-addresses=10.100.1.40 to-ports=25 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=587 \ protocol=tcp to-addresses=10.100.1.40 to-ports=587 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=587 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=587 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=587 protocol=udp to-addresses=10.100.1.40 to-ports=587 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=389 \ protocol=tcp to-addresses=10.100.1.40 to-ports=389 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=389 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=389 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=389 protocol=udp to-addresses=10.100.1.40 to-ports=389 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=143 protocol=udp to-addresses=10.100.1.40 to-ports=143 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=143 \ protocol=tcp to-addresses=10.100.1.40 to-ports=143 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=143 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=143 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=110 protocol=udp to-addresses=10.100.1.40 to-ports=110 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=110 \ protocol=tcp to-addresses=10.100.1.40 to-ports=110 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=110 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=110 add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ 10.100.1.24 dst-port=443 out-interface=ether1 protocol=tcp src-address=\ 192.168.0.0/24 add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ 10.100.1.100 dst-port=443 out-interface=ether1 protocol=tcp src-address=\ 192.168.0.0/24 add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ 10.100.1.24 dst-port=80 out-interface=ether1 protocol=tcp src-address=\ 192.168.0.0/24 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=995 \ protocol=tcp to-addresses=10.100.1.76 to-ports=995 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=995 \ protocol=tcp to-addresses=10.100.1.76 to-ports=995 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=465 \ protocol=tcp to-addresses=10.100.1.76 to-ports=465 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=465 \ protocol=tcp to-addresses=10.100.1.76 to-ports=465 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=993 \ protocol=tcp to-addresses=10.100.1.76 to-ports=993 add action=masquerade chain=srcnat comment=hairpin-10.100.1-nginx-443 \ dst-address=10.100.1.24 dst-port=443 protocol=tcp src-address=\ 10.100.1.0/24 add action=masquerade chain=srcnat comment=hairpin-10.100.1-nginx-80 \ dst-address=10.100.1.24 dst-port=80 protocol=tcp src-address=\ 10.100.1.0/24 add action=masquerade chain=srcnat comment=hairpin-vpn-nginx-443 dst-address=\ 10.100.1.24 dst-port=443 protocol=tcp src-address=100.100.1.0/24 add action=masquerade chain=srcnat comment=hairpin-vpn-nginx-80 dst-address=\ 10.100.1.24 dst-port=80 protocol=tcp src-address=100.100.1.0/24 add action=dst-nat chain=dstnat comment=ssh-mikrotik-public-102 dst-address=\ 117.102.73.102 dst-port=255 protocol=tcp to-addresses=10.100.1.1 \ to-ports=255 add action=dst-nat chain=dstnat comment=ssh-nginx-public-22 disabled=yes \ dst-address=117.102.73.102 dst-port=22 protocol=tcp to-addresses=\ 10.100.1.24 to-ports=22 add action=masquerade chain=srcnat comment=hairpin-ssh-mikrotik dst-address=\ 10.100.1.1 dst-port=255 protocol=tcp src-address=10.100.1.0/24 add action=masquerade chain=srcnat comment=hairpin-ssh-nginx disabled=yes \ dst-address=10.100.1.24 dst-port=22 protocol=tcp src-address=\ 10.100.1.0/24 add action=masquerade chain=srcnat comment=hairpin-ssh-mikrotik-office \ dst-address=10.100.1.1 dst-port=255 protocol=tcp src-address=\ 192.168.0.0/24 add action=masquerade chain=srcnat comment=hairpin-ssh-nginx-office disabled=\ yes dst-address=10.100.1.24 dst-port=22 protocol=tcp src-address=\ 192.168.0.0/24 add action=dst-nat chain=dstnat comment=ssh-public-db dst-address=\ 117.102.73.102 dst-port=225 protocol=tcp to-addresses=10.100.1.25 \ to-ports=22 add action=masquerade chain=srcnat comment=hairpin-ssh-public-db dst-address=\ 10.100.1.25 dst-port=22 protocol=tcp src-address=10.100.1.0/24 add action=masquerade chain=srcnat comment=hairpin-ssh-public-db-office \ dst-address=10.100.1.25 dst-port=22 protocol=tcp src-address=\ 192.168.0.0/24 /ip route add check-gateway=ping comment="hybrid failover ISP1 primary" disabled=no \ distance=1 dst-address=0.0.0.0/0 gateway=117.102.73.97 pref-src="" \ routing-table=main scope=30 suppress-hw-offload=no target-scope=10 add check-gateway=none comment="hybrid ISP2" disabled=no distance=1 \ dst-address=0.0.0.0/0 gateway=192.168.1.1 pref-src="" routing-table=\ "KE ISP 2" scope=30 suppress-hw-offload=no target-scope=10 add check-gateway=ping comment="hybrid failover ISP2 backup" disabled=no \ distance=2 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main add check-gateway=none comment="hybrid ISP1" disabled=no distance=1 \ dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table="KE ISP 1" add comment="hybrid ISP1 WAN lan" distance=1 dst-address=117.102.73.96/29 \ gateway=ether1 routing-table="KE ISP 1" add comment="hybrid ISP2 WAN lan" distance=1 dst-address=192.168.1.0/24 \ gateway=sfp-sfpplus1 routing-table="KE ISP 2" add comment="hybrid office lan ISP1" distance=1 dst-address=192.168.0.0/24 \ gateway=office routing-table="KE ISP 1" add comment="hybrid office lan ISP2" distance=1 dst-address=192.168.0.0/24 \ gateway=office routing-table="KE ISP 2" /ip service set telnet disabled=yes set ftp disabled=yes set www disabled=yes set ssh port=255 set api disabled=yes set winbox address=10.100.1.0/24,192.168.0.0/24 set api-ssl disabled=yes /ppp aaa set use-radius=yes /ppp secret add local-address=10.100.1.1 name=rbsetiawan remote-address=10.100.1.220 add local-address=10.100.1.1 name=asobari remote-address=10.100.1.225 add local-address=10.100.1.1 name=uabdurrohman remote-address=10.100.1.226 add local-address=10.100.1.1 name=trachman remote-address=10.100.1.227 add local-address=10.100.1.1 name=test remote-address=10.100.1.211 add local-address=10.100.1.1 name=dpradana remote-address=10.100.1.228 add local-address=10.100.1.1 name=ataufik remote-address=10.100.1.229 add local-address=10.100.1.1 name=awrahajeng remote-address=10.100.1.230 /radius add address=10.100.1.40 domain=gisportal.id service=ppp src-address=\ 10.100.1.1 /routing rule add action=lookup comment="hybrid ISP1" routing-mark="KE ISP 1" table=\ "KE ISP 1" add action=lookup comment="hybrid ISP2" routing-mark="KE ISP 2" table=\ "KE ISP 2" /snmp set enabled=yes /system clock set time-zone-name=Asia/Jakarta /system scheduler add comment="hybrid scheduler" interval=1m name=hybrid-sync-mode on-event=\ hybrid-sync-mode policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ start-date=jun/13/2026 start-time=17:41:40 add comment="Monitor latency ISP1 vs ISP2" interval=2m name=latency-monitor \ on-event=latency-monitor policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ start-time=startup add comment="Backup config ke QNAP 10.100.1.10" interval=1d name=\ nas-backup-daily on-event=nas-backup policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ start-date=jun/15/2026 start-time=03:00:00 /system script add dont-require-permissions=yes name=hybrid-set-mode-both-up owner=admin \ policy=read,write,test source="\r\ \n/ip firewall mangle enable [find comment=\"hybrid office PCC ISP1\"]\r\ \n/ip firewall mangle enable [find comment=\"hybrid office PCC ISP2\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP1\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP2\"]\r\ \n/ip firewall mangle enable [find comment=\"hybrid route ISP1\"]\r\ \n/ip firewall mangle enable [find comment=\"hybrid route ISP2\"]\r\ \n:log info \"HYBRID: mode BOTH-UP (office PCC 50/50, VPN failover only)\"\ \r\ \n" add dont-require-permissions=yes name=hybrid-set-mode-isp1-down owner=admin \ policy=read,write,test source="\r\ \n/ip firewall mangle disable [find comment=\"hybrid office PCC ISP1\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid office PCC ISP2\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP1\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP2\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid route ISP1\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid route ISP2\"]\r\ \n:log info \"HYBRID: mode ISP1-DOWN\"\r\ \n" add dont-require-permissions=yes name=hybrid-set-mode-isp2-down owner=admin \ policy=read,write,test source="\r\ \n/ip firewall mangle disable [find comment=\"hybrid office PCC ISP2\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP2\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid route ISP2\"]\r\ \n/ip firewall mangle enable [find comment=\"hybrid office PCC ISP1\"]\r\ \n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP1\"]\r\ \n/ip firewall mangle enable [find comment=\"hybrid route ISP1\"]\r\ \n:log info \"HYBRID: mode ISP2-DOWN (office ISP1 only, VPN failover only)\ \"\r\ \n" add dont-require-permissions=yes name=hybrid-sync-mode owner=admin policy=\ read,write,test,sniff source="\r\ \n:local up1 false\r\ \n:local up2 false\r\ \n:local ok1 0\r\ \n:local ok2 0\r\ \n:for i from=1 to=3 do={\r\ \n :local r1 [/ping 117.102.73.97 count=1 as-value]\r\ \n :if ([:typeof (\$r1->\"time\")] != \"nothing\") do={ :set ok1 (\$ok1 +\ \_1) }\r\ \n :local r2 [/ping 192.168.1.1 count=1 as-value]\r\ \n :if ([:typeof (\$r2->\"time\")] != \"nothing\") do={ :set ok2 (\$ok2 +\ \_1) }\r\ \n}\r\ \n:if (\$ok1 >= 2) do={ :set up1 true }\r\ \n:if (\$ok2 >= 2) do={ :set up2 true }\r\ \n:if (\$up1 && \$up2) do={\r\ \n /system script run hybrid-set-mode-both-up\r\ \n} else={\r\ \n :if (!\$up1) do={\r\ \n /system script run hybrid-set-mode-isp1-down\r\ \n } else={\r\ \n :if (!\$up2) do={\r\ \n /system script run hybrid-set-mode-isp2-down\r\ \n }\r\ \n }\r\ \n}\r\ \n" add dont-require-permissions=yes name=latency-monitor owner=admin policy=\ read,write,test,sniff source="\r\ \n:local hysteresis 10ms\r\ \n:global bestWan\r\ \n:global isp1Latency\r\ \n:global isp2Latency\r\ \n:global isp1Loss\r\ \n:global isp2Loss\r\ \n:if ([:typeof \$bestWan] = \"nothing\") do={ :set bestWan \"isp1\" }\r\ \n:local t1 0ms\r\ \n:local t2 0ms\r\ \n:local ok1 0\r\ \n:local ok2 0\r\ \n:local i 0\r\ \n:do {\r\ \n :local r1 [/ping 117.102.73.97 count=1 as-value]\r\ \n :if ([:typeof (\$r1->\"time\")] != \"nothing\") do={\r\ \n :set t1 (\$t1 + (\$r1->\"time\"))\r\ \n :set ok1 (\$ok1 + 1)\r\ \n }\r\ \n :local r2 [/ping 192.168.1.1 count=1 as-value]\r\ \n :if ([:typeof (\$r2->\"time\")] != \"nothing\") do={\r\ \n :set t2 (\$t2 + (\$r2->\"time\"))\r\ \n :set ok2 (\$ok2 + 1)\r\ \n }\r\ \n :set i (\$i + 1)\r\ \n} while=(\$i < 5)\r\ \n:local avg1 9999ms\r\ \n:local avg2 9999ms\r\ \n:local loss1 100\r\ \n:local loss2 100\r\ \n:if (\$ok1 > 0) do={\r\ \n :set avg1 (\$t1 / \$ok1)\r\ \n :set loss1 (100 - ((\$ok1 * 100) / 5))\r\ \n}\r\ \n:if (\$ok2 > 0) do={\r\ \n :set avg2 (\$t2 / \$ok2)\r\ \n :set loss2 (100 - ((\$ok2 * 100) / 5))\r\ \n}\r\ \n:set isp1Latency \$avg1\r\ \n:set isp2Latency \$avg2\r\ \n:set isp1Loss \$loss1\r\ \n:set isp2Loss \$loss2\r\ \n:local newBest \$bestWan\r\ \n:if (\$loss1>49 && \$loss2>49) do={\r\ \n :log warning \"Latency Monitor: kedua ISP loss tinggi, tetap \$bestWan\ \"\r\ \n} else={\r\ \n :if (\$loss2>49) do={ :set newBest \"isp1\" } else={\r\ \n :if (\$loss1>49) do={ :set newBest \"isp2\" } else={\r\ \n :if (\$avg1 < (\$avg2 - \$hysteresis)) do={ :set newBest \"isp1\" \ } else={\r\ \n :if (\$avg1 > (\$avg2 + \$hysteresis)) do={ :set newBest \"isp2\ \" }\r\ \n }\r\ \n }\r\ \n }\r\ \n :set bestWan \$newBest\r\ \n}\r\ \n:log info (\"Latency Monitor: ISP1=\" . [:tostr \$avg1] . \" loss=\" . \ \$loss1 . \"% | ISP2=\" . [:tostr \$avg2] . \" loss=\" . \$loss2 . \"% | b\ est=\" . \$bestWan)\r\ \n" add dont-require-permissions=yes name=nas-backup owner=admin policy=\ ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\ \r\ \n:global nasFtpHost \"10.100.1.10\"\r\ \n:global nasFtpUser \"admin\"\r\ \n:global nasFtpPass \"REDACTED_SEE_NAS_VAULT\"\r\ \n:global nasFtpPath \"mainpve/mikrotik\"\r\ \n:local bname \"nas-latest\"\r\ \n:log info \"NAS backup: mulai\"\r\ \n/system backup save name=\$bname\r\ \n/export file=\$bname\r\ \n:delay 2s\r\ \n/tool fetch address=\$nasFtpHost mode=ftp user=\$nasFtpUser password=\$n\ asFtpPass src-path=(\$bname . \".backup\") dst-path=(\$nasFtpPath . \"/\" \ . \$bname . \".backup\") upload=yes\r\ \n/tool fetch address=\$nasFtpHost mode=ftp user=\$nasFtpUser password=\$n\ asFtpPass src-path=(\$bname . \".rsc\") dst-path=(\$nasFtpPath . \"/\" . \ \$bname . \".rsc\") upload=yes\r\ \n/file remove (\$bname . \".backup\")\r\ \n/file remove (\$bname . \".rsc\")\r\ \n:log info \"NAS backup: selesai\"\r\ \n" /tool netwatch add comment="hybrid monitor ISP1" down-script=hybrid-set-mode-isp1-down host=\ 117.102.73.97 interval=10s timeout=3s type=simple up-script=\ hybrid-sync-mode add comment="hybrid monitor ISP2" down-script=hybrid-set-mode-isp2-down host=\ 192.168.1.1 interval=10s timeout=3s type=simple up-script=\ hybrid-sync-mode