DUAL-WAN MIKROTIK — RENCANA & KONFIGURASI
=========================================
Tanggal        : 2026-06-13
Router         : MikroTik CCR2004, RouterOS 7.5, 10.100.1.1

TOPOLOGI ISP
------------
| Port           | ISP | Alamat                      | Peran                          |
|----------------|-----|-----------------------------|--------------------------------|
| ether1         | 1   | 117.102.73.96/29 (statis)   | IP publik, dst-nat, server WAN |
| sfp-sfpplus1   | 2   | DHCP dari router ISP 2      | Tambahan bandwidth user        |
| Gateway ISP 2  |     | 192.168.1.1                 | Routing table "KE ISP 2"       |

PEMISAHAN TRAFFIC
-----------------
| Sumber              | Metode           | Keluar via    |
|---------------------|------------------|---------------|
| 10.100.1.0/24 server| mark-routing fix | KE ISP 1 saja |
| 192.168.0.0/24 office| PCC 2/0 + 2/1   | ISP1 + ISP2   |
| 100.100.1.0/24 vpn  | PCC 2/0 + 2/1   | ISP1 + ISP2   |
| dst-nat inbound     | tidak diubah     | ether1        |

CARA TERAPKAN
-------------
  .\scripts\apply-dual-wan-mikrotik.ps1
  .\scripts\apply-dual-wan-mikrotik.ps1 -DryRun   # preview perintah

VERIFIKASI
----------
  .\scripts\ssh-mikrotik.ps1 -Command "/ip dhcp-client print"
  .\scripts\ssh-mikrotik.ps1 -Command "/ip route print where dst-address=0.0.0.0/0"
  .\scripts\ssh-mikrotik.ps1 -Command "/routing rule print"
  .\scripts\ssh-mikrotik.ps1 -Command "/ip firewall mangle print where comment~\"dual-wan\""

ROLLBACK (jika perlu)
---------------------
  /interface ethernet set sfp-sfpplus1 disabled=yes
  /ip dhcp-client set [find interface=sfp-sfpplus1] disabled=yes
  /ip firewall mangle remove [find comment~"dual-wan"]
  /routing rule remove [find comment~"dual-wan"]
  /ip route remove [find comment~"dual-wan ISP1"]
  /ip firewall nat set [find chain=srcnat action=masquerade out-interface=""] disabled=no

CATATAN
-------
- Satu koneksi tunggal tidak mendapat speed ISP1+ISP2; total naik saat banyak koneksi.
- DHCP ISP2: add-default-route=no agar default route main tetap ether1.
- Rule masquerade tanpa out-interface dinonaktifkan.