# System Overview — MikroTik Gateway

**Last updated:** 2026-07-06  
**Source:** Live SSH audit + `backups/mikrotik-export-2026-07-06.rsc`

---

## Perangkat

| Item | Nilai |
|------|-------|
| Hostname | MikroTik |
| Model | CCR2004-1G-12S+2XS (ARM64, 4 CPU) |
| RouterOS | 7.5 stable |
| RAM | 4032 MiB (~3820 free) |
| Serial | HDD08647CP6 |

---

## Diagram tingkat tinggi

```
                    Internet
                        │
         ┌──────────────┴──────────────┐
         │ ISP1 Biznet (ether1)        │ ISP2 IDBiz (sfp-sfpplus1, DHCP)
         │ GW 117.102.73.97            │ GW 192.168.1.1
         └──────────────┬──────────────┘
                        │
              ┌─────────▼─────────┐
              │  MikroTik .1    │
              │  hybrid failover │
              │  + PCC office    │
              └─────────┬─────────┘
        ┌───────────────┼───────────────┐
        │               │               │
   bridge:server   bridge:office    bridge:vpn
   10.100.1.0/24   192.168.0.0/24   100.100.1.0/24
        │               │               │
   Proxmox, DB,     User kantor,     SSTP/PPTP
   Mailcow .28,     MULTIMEDIA .14   RADIUS→AD .40
   nginx .24, ...
```

---

## Segment jaringan

| Segment | Gateway | Bridge / IF | DHCP |
|---------|---------|-------------|------|
| Server LAN | `10.100.1.1` | `server` | — |
| Office | `192.168.0.1` | `office` (sfp-sfpplus10) | dhcp1, lease 4w3d |
| VPN remote | `100.100.1.0` | `vpn` | dhcp2 |
| IBM (legacy) | `192.168.2.1` | vlan2004 | relay (inactive) |

---

## WAN publik (blok `117.102.73.96/29`)

| IP | Komentar | Fungsi utama |
|----|----------|--------------|
| `.102` | gisportal.id | Web/API/mail NAT → internal |
| `.99` | geonet.co.id | HTTP/S → `.24`; beberapa mail rule legacy |
| `.98` | geonet.co.id | — |
| `.100` | dev.gisportal.id | Dev/ArcGIS NAT |
| `.101` | Not Set | Mail legacy → `.76` |

---

## Routing (aktif 2026-07-06)

| Route | Tabel | Gateway | Catatan |
|-------|-------|---------|---------|
| `0.0.0.0/0` | main | `117.102.73.97` | **Primary**, `check-gateway=ping` |
| `0.0.0.0/0` | KE ISP 1/2 | hybrid tables | PCC / failover scripts |
| ISP2 WAN | sfp-sfpplus1 | `192.168.1.4/24` | DHCP dynamic — **UP** |

Scheduler `hybrid-sync-mode` + netwatch ping ISP1/ISP2 menyesuaikan mangle PCC.

---

## NAT penting (publik → internal)

| Publik | Port | Internal | Service |
|--------|------|----------|---------|
| `.102` | 80, 443 | `10.100.1.24` | nginx reverse proxy |
| `.102` | 25, 587, 993, 465 | `10.100.1.28` | **Mailcow** |
| `.102` | 5432, 1433, … | `.25`, `.75`, … | DB / SQL (hati-hati expose) |
| `.99` | 80, 443 | `10.100.1.24` | geonet web |
| `.100` | 443, 6443, … | `.51`, `.57`, `.59` | ArcGIS dev |

Mail **geonet.co.id** masih ada rule ke `.76` / `.40` (legacy cPanel/AD) — beberapa **disabled**.

---

## VPN & auth

| Protokol | Status | Auth |
|----------|--------|------|
| SSTP | enabled (:443) | RADIUS → `10.100.1.40` |
| PPTP | enabled ⚠️ | Legacy — disarankan matikan |
| PPP secrets | lokal + RADIUS | IP tetap `10.100.1.220–230` |

---

## DNS

- Forwarder: `203.142.82.222`, `203.142.84.222`
- **Split-DNS** static: `*.gisportal.id` → `10.100.1.24` (user office/VPN resolve internal)

---

## Layanan management

| Service | Port | Akses |
|---------|------|-------|
| SSH | **255** | Key RSA |
| Winbox | default | `10.100.1.0/24`, `192.168.0.0/24` |
| WWW/API | disabled | — |

---

## Backup otomatis

| Target | Jadwal |
|--------|--------|
| QNAP `10.100.1.10:mainpve/mikrotik/` | Daily 03:00 (scheduler) |
| Repo `Mikrotik/backups/` | Manual / sesi audit |