# jun/13/2026 16:09:28 by RouterOS 7.5 # software id = E3H0-EVXR # # model = CCR2004-1G-12S+2XS # serial number = HDD08647CP6 /interface bridge add add-dhcp-option82=yes dhcp-snooping=yes name=office add name=server add add-dhcp-option82=yes dhcp-snooping=yes name=vpn /interface ethernet set [ find default-name=ether1 ] comment="ISP1 BIZNET" set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no comment=\ "ISP2 IDBIZ" set [ find default-name=sfp-sfpplus2 ] comment=DELL-main-netwokrkVMBR0 \ loop-protect=on loop-protect-disable-time=10s set [ find default-name=sfp-sfpplus3 ] comment=DELL loop-protect=on \ loop-protect-disable-time=10s set [ find default-name=sfp-sfpplus4 ] comment=IBM loop-protect=on \ loop-protect-disable-time=10s set [ find default-name=sfp-sfpplus5 ] comment=NAS set [ find default-name=sfp-sfpplus6 ] auto-negotiation=no disabled=yes set [ find default-name=sfp-sfpplus10 ] comment="swich server" set [ find default-name=sfp-sfpplus11 ] comment="swich production" speed=\ 10Gbps set [ find default-name=sfp-sfpplus12 ] comment="swich adm" speed=10Gbps /interface vlan add interface=sfp-sfpplus12 loop-protect=on name=vlan3 vlan-id=3 add interface=sfp-sfpplus10 loop-protect=on name=vlan10 vlan-id=10 add interface=sfp-sfpplus11 loop-protect=on name=vlan11 vlan-id=11 add interface=sfp-sfpplus12 loop-protect=on name=vlan12 vlan-id=12 add interface=sfp-sfpplus10 name=vlan99 vlan-id=99 add disabled=yes interface=sfp-sfpplus10 loop-protect=on name=vlan2001 \ vlan-id=2001 add interface=sfp-sfpplus4 name=vlan2004 vlan-id=2001 add interface=sfp-sfpplus10 loop-protect=on name=vlan2010 vlan-id=2010 add interface=sfp-sfpplus12 loop-protect=on name=vlan2012 vlan-id=2012 /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik /ip pool add name=dhcp_pool0 ranges=192.168.0.2-192.168.0.254 add name=dhcp_pool1 ranges=192.168.0.2-192.168.0.254 add name=dhcp_pool2 ranges=192.168.0.2-192.168.0.254 add name=dhcp_pool3 ranges=192.168.0.2-192.168.0.254 add name=dhcp_pool4 ranges=100.100.1.2-100.100.1.254 add name=dhcp_pool5 ranges=192.168.2.2-192.168.2.254 add name=dhcp_pool6 ranges=192.168.2.2-192.168.2.254 /ip dhcp-server add address-pool=dhcp_pool3 interface=office lease-time=4w3d name=dhcp1 add address-pool=dhcp_pool4 interface=vpn name=dhcp2 # DHCP server can not run on slave interface! add address-pool=dhcp_pool6 interface=vlan2004 name=dhcp3 relay=192.168.2.1 /port set 0 name=serial0 set 1 name=serial1 /queue simple add name=multimedia priority=1/1 target=192.168.0.4/32 add disabled=yes name=priotiry priority=2/2 target=office /routing table add disabled=no fib name="KE ISP 1" add disabled=no fib name="KE ISP 2" /snmp community set [ find default=yes ] write-access=yes /interface bridge port add bridge=server interface=sfp-sfpplus2 add bridge=server interface=sfp-sfpplus3 add bridge=server interface=sfp-sfpplus4 add bridge=server interface=sfp-sfpplus5 add bridge=office interface=sfp-sfpplus10 trusted=yes add bridge=office interface=sfp-sfpplus11 trusted=yes add bridge=office disabled=yes interface=sfp-sfpplus12 add bridge=server interface=vlan10 add bridge=server interface=vlan11 add bridge=server interface=vlan12 add bridge=server interface=vlan99 add bridge=office interface=vlan2010 trusted=yes add bridge=server interface=vlan3 add bridge=office interface=vlan2012 trusted=yes add bridge=office interface=vlan2004 trusted=yes add bridge=server interface=sfp-sfpplus6 /interface pptp-server server # PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead set enabled=yes /interface sstp-server server set enabled=yes /ip address add address=192.168.88.1/24 comment=defconf disabled=yes interface=ether1 \ network=192.168.88.0 add address=117.102.73.102/29 comment=gisportal.id interface=ether1 network=\ 117.102.73.96 add address=117.102.73.101 comment="Not Set" interface=ether1 network=\ 117.102.73.101 add address=117.102.73.100 comment=dev.gisportal.id interface=ether1 network=\ 117.102.73.100 add address=117.102.73.98 comment=geonet.co.id interface=ether1 network=\ 117.102.73.96 add address=10.100.1.1/24 interface=server network=10.100.1.0 add address=117.102.73.99 comment=geonet.co.id interface=ether1 network=\ 117.102.73.99 add address=192.168.0.1/24 interface=sfp-sfpplus10 network=192.168.0.0 add address=100.100.1.0 interface=vpn network=100.100.1.0 add address=192.168.2.0/24 interface=vlan2004 network=192.168.2.0 /ip dhcp-client add add-default-route=no interface=sfp-sfpplus1 use-peer-dns=no /ip dhcp-server lease add address=192.168.0.11 client-id=1:bc:fc:e7:8e:55:67 mac-address=\ BC:FC:E7:8E:55:67 server=dhcp1 add address=192.168.0.102 client-id=1:18:fb:7b:a5:50:8b mac-address=\ 18:FB:7B:A5:50:8B server=dhcp1 add address=192.168.0.9 client-id=1:18:fd:74:52:8e:5f comment=swich \ mac-address=18:FD:74:52:8E:5F server=dhcp1 add address=192.168.0.8 client-id=1:18:fd:74:8b:b2:7f comment=swich \ mac-address=18:FD:74:8B:B2:7F server=dhcp1 add address=192.168.0.4 mac-address=10:5F:02:84:F0:2F server=dhcp1 add address=192.168.0.10 client-id=1:24:5e:be:42:8f:a5 mac-address=\ 24:5E:BE:42:8F:A5 server=dhcp1 add address=192.168.0.74 client-id=1:b4:2e:99:2a:30:4c mac-address=\ B4:2E:99:2A:30:4C server=dhcp1 add address=192.168.0.20 client-id=1:80:3f:5d:f9:c1:40 comment=WAVLINK \ mac-address=80:3F:5D:F9:C1:40 server=dhcp1 add address=192.168.0.57 client-id=1:bc:24:11:5d:58:56 mac-address=\ BC:24:11:5D:58:56 server=dhcp1 add address=192.168.0.13 client-id=1:a0:d3:65:73:c7:97 mac-address=\ A0:D3:65:73:C7:97 server=dhcp1 add address=192.168.0.18 client-id=1:10:ff:e0:3a:7d:15 mac-address=\ 10:FF:E0:3A:7D:15 server=dhcp1 add address=192.168.0.64 client-id=1:72:7e:64:31:eb:13 mac-address=\ 72:7E:64:31:EB:13 server=dhcp1 add address=192.168.0.80 client-id=1:0:1:f5:2:b:d1 mac-address=\ 00:01:F5:02:0B:D1 server=dhcp1 /ip dhcp-server network add address=100.100.1.0/24 dns-server=203.142.82.222,203.142.84.222 gateway=\ 100.100.1.1 add address=192.168.0.0/24 dns-server=203.142.82.222,203.142.84.222 gateway=\ 192.168.0.1 add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.1.1 gateway=192.168.2.1 /ip dns set allow-remote-requests=yes servers=203.142.82.222,203.142.84.222 /ip dns static add address=10.100.1.61 disabled=yes name=arcgisenterprise.gisportal.id add address=10.100.1.72 disabled=yes name=aernd.gisportal.id add address=10.100.1.25 disabled=yes name=database.gisportal.id /ip firewall filter add action=drop chain=forward src-address=192.168.0.64 add action=drop chain=forward src-address=192.168.0.57 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.101 add action=drop chain=forward out-interface=ether1 src-address=10.100.1.100 add action=drop chain=forward out-interface=ether1 src-address=10.100.1.88 add action=drop chain=forward out-interface=ether1 src-address=10.100.1.84 add action=drop chain=forward src-address=10.100.1.91 add action=drop chain=forward out-interface=ether1 src-address=10.100.1.61 add action=drop chain=forward out-interface=ether1 src-address=10.100.1.100 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.24 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.40 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.51 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.25 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.56 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.58 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.55 add action=drop chain=forward disabled=yes out-interface=ether1 src-address=\ 10.100.1.53 add action=drop chain=forward out-interface=ether1 src-address=10.100.1.72 add action=drop chain=forward connection-state=new dst-address-list=ddosed \ src-address-list=ddoser add action=jump chain=forward connection-state=new jump-target=detect-ddos add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/1s add action=add-dst-to-address-list address-list=ddosed address-list-timeout=\ 10m chain=detect-ddos add action=add-src-to-address-list address-list=ddoser address-list-timeout=\ 10m chain=detect-ddos add action=drop chain=forward out-interface=ether1 src-address=10.100.1.80 /ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ yes in-interface=vlan2004 new-connection-mark="ISP 2" passthrough=yes \ per-connection-classifier=both-addresses-and-ports:2/1 add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ yes in-interface=server new-connection-mark="ISP 1" passthrough=yes \ per-connection-classifier=both-addresses-and-ports:2/0 add action=mark-routing chain=prerouting connection-mark="ISP 2" disabled=yes \ in-interface=vlan2004 new-routing-mark="KE ISP 2" passthrough=yes \ per-connection-classifier=both-addresses-and-ports:2/1 add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ yes in-interface=sfp-sfpplus1 new-connection-mark="ISP 2" passthrough=yes add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ yes in-interface=ether1 new-connection-mark="ISP 1" passthrough=yes add action=mark-routing chain=output connection-mark="ISP 2" disabled=yes \ new-routing-mark="KE ISP 2" passthrough=yes /ip firewall nat add action=masquerade chain=srcnat out-interface=ether1 add action=masquerade chain=srcnat out-interface=sfp-sfpplus1 add action=masquerade chain=srcnat add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=80 \ protocol=tcp to-addresses=10.100.1.24 to-ports=80 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.101 \ dst-port=80 protocol=tcp to-addresses=10.100.1.24 to-ports=80 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=80 \ protocol=tcp to-addresses=10.100.1.76 to-ports=80 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=25 \ protocol=tcp to-addresses=10.100.1.76 to-ports=25 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=143 \ protocol=tcp to-addresses=10.100.1.76 to-ports=143 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=993 \ protocol=tcp to-addresses=10.100.1.76 to-ports=993 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=587 \ protocol=tcp to-addresses=10.100.1.76 to-ports=587 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.101 \ dst-port=443 protocol=tcp to-addresses=10.100.1.24 to-ports=443 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=24 \ protocol=tcp to-addresses=10.100.1.24 to-ports=22 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=21 \ protocol=tcp to-addresses=10.100.1.10 to-ports=21 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=443 \ protocol=tcp to-addresses=10.100.1.24 to-ports=443 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=443 \ protocol=tcp to-addresses=10.100.1.24 to-ports=443 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=80 \ protocol=tcp to-addresses=10.100.1.24 to-ports=80 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=443 \ protocol=tcp to-addresses=10.100.1.51 to-ports=443 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=1433 \ protocol=tcp to-addresses=10.100.1.25 to-ports=1433 add action=dst-nat chain=dstnat comment="rnd SQL Server 2016" dst-address=\ 117.102.73.102 dst-port=1434 protocol=tcp to-addresses=10.100.1.75 \ to-ports=1433 add action=dst-nat chain=dstnat comment="Zabbiz agenet active" dst-address=\ 117.102.73.102 dst-port=10051 protocol=tcp to-addresses=10.100.1.42 \ to-ports=10051 add action=dst-nat chain=dstnat comment="rnd SQL Server 2022" dst-address=\ 117.102.73.102 dst-port=1437 protocol=tcp to-addresses=10.100.1.77 \ to-ports=1433 add action=dst-nat chain=dstnat comment="rnd SQL Server 2016" dst-address=\ 117.102.73.102 dst-port=1436 protocol=tcp to-addresses=10.100.1.76 \ to-ports=1433 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5432 \ protocol=tcp to-addresses=10.100.1.25 to-ports=5432 add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=8080 \ protocol=tcp to-addresses=10.100.1.27 to-ports=8080 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5434 \ protocol=tcp to-addresses=10.100.1.27 to-ports=5434 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=30443 \ protocol=tcp to-addresses=10.100.1.59 to-ports=30443 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=6143 \ protocol=tcp to-addresses=10.100.1.59 to-ports=6143 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=13443 \ protocol=tcp to-addresses=10.100.1.57 to-ports=13443 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=6443 \ protocol=tcp to-addresses=10.100.1.51 to-ports=6443 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.100 \ dst-port=80 protocol=tcp to-addresses=10.100.1.51 to-ports=80 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=7443 \ protocol=tcp to-addresses=10.100.1.51 to-ports=7443 add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=2443 \ protocol=tcp to-addresses=10.100.1.51 to-ports=2443 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5433 \ protocol=tcp to-addresses=10.100.1.27 to-ports=5432 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=25 \ protocol=tcp to-addresses=10.100.1.40 to-ports=25 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=25 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=25 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=995 \ protocol=tcp to-addresses=10.100.1.40 to-ports=995 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=995 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=995 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=25 protocol=udp to-addresses=10.100.1.40 to-ports=25 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=587 \ protocol=tcp to-addresses=10.100.1.40 to-ports=587 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=587 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=587 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=587 protocol=udp to-addresses=10.100.1.40 to-ports=587 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=389 \ protocol=tcp to-addresses=10.100.1.40 to-ports=389 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=389 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=389 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=389 protocol=udp to-addresses=10.100.1.40 to-ports=389 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=143 protocol=udp to-addresses=10.100.1.40 to-ports=143 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=143 \ protocol=tcp to-addresses=10.100.1.40 to-ports=143 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=143 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=143 add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ dst-port=110 protocol=udp to-addresses=10.100.1.40 to-ports=110 add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=110 \ protocol=tcp to-addresses=10.100.1.40 to-ports=110 add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ dst-address=117.102.73.99 dst-port=110 protocol=tcp to-addresses=\ 10.100.1.40 to-ports=110 add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ 10.100.1.24 dst-port=443 out-interface=ether1 protocol=tcp src-address=\ 192.168.0.0/24 add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ 10.100.1.100 dst-port=443 out-interface=ether1 protocol=tcp src-address=\ 192.168.0.0/24 add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ 10.100.1.24 dst-port=80 out-interface=ether1 protocol=tcp src-address=\ 192.168.0.0/24 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=995 \ protocol=tcp to-addresses=10.100.1.76 to-ports=995 add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=465 \ protocol=tcp to-addresses=10.100.1.76 to-ports=465 /ip route add check-gateway=ping comment="failover ISP1 primary" disabled=no distance=1 \ dst-address=0.0.0.0/0 gateway=117.102.73.97 pref-src="" routing-table=\ main scope=30 suppress-hw-offload=no target-scope=10 add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 \ pref-src="" routing-table="KE ISP 2" scope=30 suppress-hw-offload=no \ target-scope=10 add check-gateway=ping comment="failover ISP2 backup" disabled=no distance=2 \ dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main /ip service set telnet disabled=yes set ftp disabled=yes set www disabled=yes set ssh address=10.100.1.0/24,192.168.0.0/24 port=255 set api disabled=yes set winbox address=10.100.1.0/24,192.168.0.0/24 set api-ssl disabled=yes /ppp aaa set use-radius=yes /ppp secret add local-address=10.100.1.1 name=rbsetiawan remote-address=10.100.1.220 add local-address=10.100.1.1 name=asobari remote-address=10.100.1.225 add local-address=10.100.1.1 name=uabdurrohman remote-address=10.100.1.226 add local-address=10.100.1.1 name=trachman remote-address=10.100.1.227 add local-address=10.100.1.1 name=test remote-address=10.100.1.211 add local-address=10.100.1.1 name=dpradana remote-address=10.100.1.228 add local-address=10.100.1.1 name=ataufik remote-address=10.100.1.229 /radius add address=10.100.1.40 domain=gisportal.id service=ppp src-address=\ 10.100.1.1 /snmp set enabled=yes /system clock set time-zone-name=Asia/Jakarta