JARINGAN GEONET — ACUAN STANDAR KONEKSI (BASELINE) ================================================== Tanggal snapshot : 2026-06-13 Status : AKTIF — Failover Fase 1 (ISP1 primary + ISP2 backup, check-gateway) Router : MikroTik CCR2004-1G-12S+2XS, RouterOS 7.5, hostname MikroTik Sumber data : Live SSH 10.100.1.1, apply-failover-mikrotik.ps1, tes ping 2026-06-13 Dokumen ini adalah BACKUP ACUAN untuk: 1. Internet user kantor & VPN (failover ISP1→ISP2) 2. Komunikasi user (office/VPN) ↔ server (10.100.1.0/24) 3. Restore jika perubahan routing merusak koneksi Detail audit lengkap (NAT publik, firewall, VPN): server/mikrotik-audit.txt Desain failover: server/mikrotik-failover-design.txt Script deploy failover: scripts/apply-failover-mikrotik.ps1 Rollback ke single-ISP: scripts/rollback-single-wan-mikrotik.ps1 Backup Fase 1 (restore setelah Hybrid gagal): server/mikrotik-failover-phase1-backup.txt A. PRINSIP KONEKSI STANDAR -------------------------- Internet keluar ISP1 utama (ether1); ISP2 standby failover otomatis. Route primary : 0.0.0.0/0 → 117.102.73.97 distance=1 check-gateway=ping [failover ISP1 primary] Route backup : 0.0.0.0/0 → 192.168.1.1 distance=2 check-gateway=ping [failover ISP2 backup] ISP2 interface: sfp-sfpplus1 ENABLED, DHCP bound (192.168.1.52/24) Saat ISP1 GW down → traffic user otomatis ke ISP2; recovery otomatis ke ISP1 User kantor dan server saling routing lewat Mikrotik tanpa policy routing khusus: Office 192.168.0.0/24 ──► Mikrotik ──► Server 10.100.1.0/24 (langsung, bridge) Server 10.100.1.0/24 ──► Mikrotik ──► Office / Internet NAT keluar internet: masquerade out-interface=ether1 (utama) masquerade out-interface=sfp-sfpplus1 (siap ISP2, tidak aktif) masquerade tanpa out-interface (catch-all, rule #2 — AKTIF) Hairpin NAT: user kantor akses domain publik diarahkan ke server internal 192.168.0.0/24 → 10.100.1.24:80/443 dan 10.100.1.100:443 B. SEGMEN JARINGAN & GATEWAY ---------------------------- | Segment | Network | Gateway Mikrotik | Bridge/Interface | DHCP | |------------------|-----------------|------------------|-----------------------|-------------| | Server LAN | 10.100.1.0/24 | 10.100.1.1 | server | — | | Office kantor | 192.168.0.0/24 | 192.168.0.1 | office / sfp-sfpplus10| dhcp1 (4w3d)| | VPN remote | 100.100.1.0/24 | 100.100.1.0 | vpn | dhcp2 (10m) | | IBM (inactive) | 192.168.2.0/24 | 192.168.2.1 | vlan2004 | relay (off) | | WAN publik | 117.102.73.96/29| 117.102.73.97 | ether1 | — | DNS DHCP office & VPN : 203.142.82.222, 203.142.84.222 C. ALUR KONEKSI USER → INTERNET ------------------------------- C1. User kantor (192.168.0.x) PC → DHCP Mikrotik (pool 192.168.0.2–254, gateway 192.168.0.1) → Forward Mikrotik (tanpa mangle PCC — semua rule dual-wan DIHAPUS) → NAT masquerade out-interface=ether1 → Internet sebagai IP publik 117.102.73.x C2. User VPN remote (100.100.1.x) Client SSTP/PPTP (port 443) → Autentikasi RADIUS → AD 10.100.1.40 (domain gisportal.id) → IP dari dhcp2 → NAT masquerade → ether1 → Internet C3. User PPP dengan IP server (10.100.1.2xx) VPN dial-in → IP tetap di LAN server → Internet via masquerade ether1 D. ALUR KONEKSI USER → SERVER ----------------------------- D1. User kantor → server internal (langsung) 192.168.0.x → 10.100.1.x Routing: connected route 10.100.1.0/24 via bridge server Tidak ada firewall block umum office→server (kecuali host terisolasi) Contoh host: .24 reverse proxy, .25 DB, .40 AD, .41 web, .42 Zabbix, .10 NAS D2. User kantor → layanan publik (hairpin) Browser ke gisportal.id / geonet.co.id → dst-nat inbound tetap ke ether1 (tidak diubah) → Hairpin NAT mengarahkan 192.168.0.x ke 10.100.1.24 tanpa keluar WAN D3. User VPN → server 100.100.1.x → 10.100.1.0/24 (full access server LAN) D4. Akses management Mikrotik dari user SSH : port 255, subnet 10.100.1.0/24 dan 192.168.0.0/24 Winbox: port 8291, subnet yang sama E. HOST PENTING (USER ↔ SERVER) ------------------------------- | Host | IP server | IP office (jika ada) | Akses user kantor | |-------------------|----------------|----------------------|--------------------------| | Mikrotik | 10.100.1.1 | 192.168.0.1 | SSH/Winbox | | NAS QNAP | 10.100.1.10 | 192.168.0.10 | https://192.168.0.10 | | SwOS CRS326 | 10.100.1.2 | — | http://10.100.1.2 | | SwOS CSS610 | 10.100.1.3 | — | http://10.100.1.3 | | Reverse proxy | 10.100.1.24 | — | Hairpin / internal | | Main Database | 10.100.1.25 | — | Port app (1433/5432) | | AD-LDAP | 10.100.1.40 | — | LDAP/RADIUS | | Main Webserver | 10.100.1.41 | — | IIS internal | | Zabbix | 10.100.1.42 | — | Monitoring | SSH ke server: lihat server/host.txt F. KONFIGURASI MIKROTIK SAAT INI (ELEMEN KRITIS) ------------------------------------------------ F1. WAN — failover Fase 1 ether1 : RUNNING — ISP utama, IP publik 117.102.73.96/29 sfp-sfpplus1 : RUNNING — ISP kedua standby failover dhcp-client sfp-sfpplus1 : ENABLED, bound 192.168.1.52/24, add-default-route=no F2. Routing Main table: failover ISP1 primary : 0.0.0.0/0 → 117.102.73.97 distance=1 check-gateway=ping [ACTIVE] failover ISP2 backup : 0.0.0.0/0 → 192.168.1.1 distance=2 check-gateway=ping [STANDBY] Connected (otomatis): 10.100.1.0/24 → server 192.168.0.0/24 → office 100.100.1.0/32 → vpn 117.102.73.x → ether1 Legacy (tidak dipakai failover user): 0.0.0.0/0 → 192.168.1.1 routing-table=KE ISP 2 [ada, bukan main failover] Routing rules dual-wan : TIDAK ADA F3. Mangle — tidak ada policy routing dual-WAN Rule dual-wan (PCC, route mark, server force ISP1) : DIHAPUS Rule office-to-server-bypass : DIHAPUS Rule load-balance lama (pra dual-WAN) : ADA, semua DISABLED (X) — tidak mempengaruhi traffic; jangan di-enable tanpa review F4. NAT srcnat (baseline) #0 masquerade out-interface=ether1 — enabled #1 masquerade out-interface=sfp-sfpplus1 — enabled (ISP2 mati, tidak terpakai) #2 masquerade (catch-all) — enabled #3–#5 Hairpin NAT — enabled F5. Port fisik → bridge (ringkas) server bridge : sfp-sfpplus2,3,5 + vlan3,10,11,12,99 office bridge : sfp-sfpplus10,11 + vlan2010,2012 NAS : sfp-sfpplus5 → server Switch kantor : sfp-sfpplus10,11 → office G. VERIFIKASI KONEKTIVITAS (2026-06-13) --------------------------------------- Tes dari laptop 192.168.0.33 (Ethernet) dan Mikrotik 10.100.1.1: | Target | Laptop | Mikrotik | Catatan | |---------------|:------:|:--------:|----------------------------------| | 10.100.1.1 | OK | OK | Gateway server | | 10.100.1.10 | OK | OK | NAS 10GbE | | 10.100.1.2 | OK | OK | SwOS switch | | 10.100.1.3 | OK | OK | SwOS switch | | 10.100.1.24 | timeout| timeout | ICMP diblokir host (bukan routing)| | 192.168.0.1 | OK | OK | Gateway office | | 192.168.0.10 | OK | OK | NAS 1GbE | | 100.100.1.0 | OK | OK | Gateway VPN (bukan .1) | | 8.8.8.8 | OK | OK | Internet ~14 ms | Kesimpulan verifikasi: routing office↔server dan internet NORMAL pada baseline ini. H. RESTORE KE BASELINE (JIKA KONEKSI RUSAK) ------------------------------------------- Gejala umum setelah eksperimen dual-WAN: - User kantor tidak bisa internet (~50% packet loss) - User kantor tidak bisa akses 10.100.1.x - Server traffic ter-mark ke routing table KE ISP 1/2 Langkah restore: 1. SSH ke Mikrotik: .\scripts\ssh-mikrotik.ps1 # dari office: admin@192.168.0.1 port 255 2. Jalankan rollback otomatis: .\scripts\rollback-single-wan-mikrotik.ps1 3. Verifikasi: /ip route print where dst-address=0.0.0.0/0 /routing rule print /ip firewall mangle print /ping 8.8.8.8 count=3 /ping 192.168.0.1 count=2 4. Tes dari laptop kantor: ping 192.168.0.1 ping 10.100.1.1 ping 10.100.1.10 ping 8.8.8.8 File rollback : server/mikrotik-rollback-single-wan.rsc Perintah manual (jika script tidak bisa): /interface ethernet set sfp-sfpplus1 disabled=yes /ip dhcp-client set [find interface=sfp-sfpplus1] disabled=yes /ip firewall mangle remove [find comment~"dual-wan"] /ip firewall mangle remove [find comment="office-to-server-bypass"] /routing rule remove [find comment~"dual-wan"] /ip route remove [find comment~"dual-wan ISP1"] /ip firewall nat set 2 disabled=no I. BACKUP CONFIG ROUTER ----------------------- Export config periodik (disarankan sebelum perubahan besar): .\scripts\ssh-mikrotik.ps1 -Command "/export file=backup-existing-network-geonet" Download backup: scp -P 255 -m hmac-sha1 -i %USERPROFILE%\.ssh\id_rsa_mikrotik \ admin@10.100.1.1:backup-existing-network-geonet.rsc server/ J. YANG TIDAK BOLEH DIUBAH TANPA REVIEW --------------------------------------- - dst-nat rules ke 10.100.1.x (layanan publik gisportal.id / geonet.co.id) - Hairpin NAT office → 10.100.1.24 - DHCP pool & gateway office (192.168.0.1) - Firewall DROP server tertentu ke internet langsung - RADIUS VPN → 10.100.1.40 Eksperimen Hybrid Fase 2: lihat server/mikrotik-hybrid-design.txt. Restore ke Fase 1 jika gagal: scripts/restore-failover-phase1-mikrotik.ps1 Acuan backup Fase 1: server/mikrotik-failover-phase1-backup.txt L. RESTORE FASE 1 (SETELAH HYBRID FASE 2 GAGAL) ----------------------------------------------- .\scripts\restore-failover-phase1-mikrotik.ps1 Menghapus: mangle/routing/netwatch hybrid Mengembalikan: route failover ISP1+ISP2 dengan check-gateway BUKAN menghapus failover — tetap dual-WAN failover mode. K. REFERENSI FILE TERKAIT ------------------------- server/existing-network-geonet.txt ← dokumen ini (acuan koneksi) server/mikrotik-failover-phase1-backup.txt ← BACKUP Fase 1 terverifikasi server/backup-failover-phase1.rsc ← export penuh dari router server/mikrotik-failover-design.txt ← desain failover server/mikrotik-hybrid-design.txt ← Fase 2 Hybrid (rencana) server/mikrotik-audit.txt ← audit perimeter server/host.txt ← SSH ke semua host server/mikrotik-failover.rsc server/mikrotik-restore-failover-phase1.rsc server/mikrotik-rollback-single-wan.rsc scripts/ssh-mikrotik.ps1 scripts/apply-failover-mikrotik.ps1 scripts/restore-failover-phase1-mikrotik.ps1 scripts/rollback-single-wan-mikrotik.ps1