DESAIN HYBRID MIKROTIK — FAILOVER + PCC + NETWATCH + CHECK-GATEWAY
==================================================================
Tanggal desain : 2026-06-13
Router : MikroTik CCR2004-1G-12S+2XS, RouterOS 7.5, 10.100.1.1
Baseline aktif : Failover Fase 1 (server/mikrotik-failover-phase1-backup.txt)
Prasyarat : Fase 1 failover AKTIF & terverifikasi
Restore point : server/mikrotik-failover-phase1-backup.txt (jika Fase 2 gagal)
Status: RENCANA — BELUM DIEKSEKUSI
Tujuan gabungan:
1. Pembagian beban internet user (PCC ~50/50) saat ISP1 DAN ISP2 sehat
2. Failover otomatis saat salah satu ISP down (tanpa blackhole 50%)
3. Server 10.100.1.0/24 tetap ISP1; dst-nat publik tetap ether1
1. PERBANDINGAN TIGA DESAIN
---------------------------
| Aspek | Failover saja | PCC saja (lama) | Hybrid (ini) |
|--------------------------|--------------------|-------------------|---------------------|
| File acuan | mikrotik-failover | mikrotik-dual-wan | mikrotik-hybrid |
| Bagi beban 2 ISP | Tidak | Ya | Ya (kondisional) |
| Failover ISP down | Ya | Tidak | Ya |
| Satu download = 2 ISP | Tidak | Tidak | Tidak |
| Health check | check-gateway | Tidak | check-gateway + Netwatch |
| Risiko blackhole 50% | Tidak | Tinggi | Rendah (PCC off saat ISP down) |
| Kompleksitas | Rendah | Sedang | Tinggi |
2. TIGA MODE OPERASI (STATE MACHINE)
------------------------------------
```mermaid
stateDiagram-v2
[*] --> CheckHealth: Boot / monitor
CheckHealth --> BothUp: ISP1 GW OK dan ISP2 GW OK
CheckHealth --> ISP1Down: ISP1 GW gagal
CheckHealth --> ISP2Down: ISP2 GW gagal
CheckHealth --> BothDown: Keduanya gagal
state BothUp {
[*] --> PCC_On
PCC_On: PCC 50/50 office+VPN
PCC_On: Route KE ISP 1/2 + check-gateway
}
state ISP1Down {
[*] --> Failover_ISP2
Failover_ISP2: PCC OFF semua
Failover_ISP2: 100% traffic user via ISP2
}
state ISP2Down {
[*] --> ISP1_Only
ISP1_Only: PCC ISP2 OFF
ISP1_Only: 100% traffic user via ISP1
}
state BothDown {
[*] --> NoInternet
NoInternet: Internet user mati total
}
BothUp --> ISP1Down: Netwatch ISP1 down
BothUp --> ISP2Down: Netwatch ISP2 down
ISP1Down --> BothUp: ISP1 recovery + ISP2 OK
ISP2Down --> BothUp: ISP2 recovery + ISP1 OK
```
3. TOPOLOGI & ALUR TRAFFIC
--------------------------
### 3.1 Mode BOTH UP — load balance aktif
```mermaid
flowchart TB
subgraph users [Sumber traffic]
OFF[office 192.168.0.x]
VPN[vpn 100.100.1.x]
SRV[server 10.100.1.0/24]
end
subgraph mangle [Mangle prerouting — urutan penting]
R0[0 server force ISP1]
R1[1 office→server bypass accept]
R2[2 office PCC 2/0 → ISP1]
R3[3 office PCC 2/1 → ISP2]
R4[4 vpn PCC 2/0 → ISP1]
R5[5 vpn PCC 2/1 → ISP2]
R6[6 route mark KE ISP 1]
R7[7 route mark KE ISP 2]
end
subgraph tables [Routing tables]
T1[KE ISP 1
0.0.0.0/0 → 117.102.73.97
check-gateway=ping]
T2[KE ISP 2
0.0.0.0/0 → 192.168.1.1
check-gateway=ping]
end
OFF --> R1
OFF --> R2
OFF --> R3
VPN --> R4
VPN --> R5
SRV --> R0
R0 --> T1
R2 --> R6 --> T1
R3 --> R7 --> T2
R4 --> R6 --> T1
R5 --> R7 --> T2
R1 --> SRV
T1 --> NAT1[NAT ether1]
T2 --> NAT2[NAT sfp-sfpplus1]
```
### 3.2 Mode ISP1 DOWN — failover murni
```mermaid
flowchart LR
U[User office/VPN] --> M[PCC DISABLED
Netwatch script]
M --> RT[Main table]
RT -->|distance=2 ACTIVE| ISP2[ISP2 sfp-sfpplus1]
ISP2 --> NAT[NAT masquerade]
SRV[Server 10.100.1.x] -.->|force ISP1 — internet server mati| X[ISP1 down]
```
### 3.3 Mode ISP2 DOWN — ISP1 only
```mermaid
flowchart LR
U[User office/VPN] --> M[PCC ISP2 rules DISABLED]
M --> PCC1[PCC ISP1 only / atau semua ke ISP1]
PCC1 --> T1[KE ISP 1]
T1 --> ISP1[ether1]
```
4. KOMPONEN KONFIGURASI
-----------------------
### 4.1 Interface & DHCP ISP2
/interface ethernet set sfp-sfpplus1 disabled=no
/ip dhcp-client set [find interface=sfp-sfpplus1] \
add-default-route=no use-peer-dns=no disabled=no
DHCP tidak menambah default route otomatis — route dikontrol manual/script.
### 4.2 Routing tables & rules
Tabel (sudah ada di router): KE ISP 1, KE ISP 2
Route per tabel (dengan check-gateway):
hybrid ISP1:
dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table="KE ISP 1"
check-gateway=ping distance=1
hybrid ISP2:
dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table="KE ISP 2"
check-gateway=ping distance=1
Route failover main table (cadangan saat PCC off):
hybrid failover primary:
dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table=main
check-gateway=ping distance=1
hybrid failover backup:
dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main
check-gateway=ping distance=2
Routing rules:
routing-mark=KE ISP 1 → lookup table KE ISP 1 comment=hybrid ISP1
routing-mark=KE ISP 2 → lookup table KE ISP 2 comment=hybrid ISP2
### 4.3 Mangle — urutan rule (KRITIS)
| # | Comment | Chain | Aksi | Kondisi enable |
|---|---------------------------------|-------------|-------------------|------------------|
| 0 | hybrid mgmt bypass laptop | prerouting | accept | Selalu (192.168.0.33) |
| 1 | hybrid server force ISP1 | prerouting | mark-routing ISP1 | Selalu |
| 2 | hybrid office-to-server-bypass | prerouting | accept | Selalu |
| 3 | hybrid office PCC ISP1 | prerouting | PCC 2/0 | Mode BothUp |
| 4 | hybrid office PCC ISP2 | prerouting | PCC 2/1 | Mode BothUp |
| 5 | hybrid vpn PCC ISP1 | prerouting | PCC 2/0 | Mode BothUp |
| 6 | hybrid vpn PCC ISP2 | prerouting | PCC 2/1 | Mode BothUp |
| 7 | hybrid route ISP1 | prerouting | mark-routing | Mode BothUp |
| 8 | hybrid route ISP2 | prerouting | mark-routing | Mode BothUp |
Rule #0 mgmt bypass: laptop admin 192.168.0.33 tidak kena PCC — SSH stabil saat apply.
Rule #2 mencegah traffic office→10.100.1.0/24 ter-mark PCC.
Saat ISP2 down: disable rule #3, #5, #7 (PCC/route ISP2).
Saat ISP1 down: disable rule #2–#7 (semua PCC); failover via main table.
Saat both up: enable rule #2–#7.
### 4.4 NAT
Tetap seperti baseline:
masquerade out-interface=ether1
masquerade out-interface=sfp-sfpplus1
masquerade catch-all (rule #2) — enabled
Jangan disable catch-all NAT (berbeda dengan dual-wan.rsc lama).
### 4.5 Netwatch — monitor gateway
Monitor ISP1:
host=117.102.73.97 interval=10s timeout=3s
comment=hybrid monitor ISP1
Monitor ISP2:
host=192.168.1.1 interval=10s timeout=3s
comment=hybrid monitor ISP2
Script terhubung ke Netwatch memanggil fungsi mode:
hybrid-set-mode-both-up
hybrid-set-mode-isp1-down
hybrid-set-mode-isp2-down
### 4.5b Management bypass — laptop admin
Rule paling atas (tidak pernah di-disable oleh script mode):
/ip firewall mangle add chain=prerouting action=accept \
src-address=192.168.0.33 comment="hybrid mgmt bypass laptop" place-before=0
SSH saat apply/maintenance: admin@192.168.0.1 port 255
Checklist: server/mikrotik-hybrid-apply-checklist.txt
### 4.6 Logika script mode (konsep RouterOS)
hybrid-set-mode-both-up:
enable mangle [find comment~"hybrid office PCC"]
enable mangle [find comment~"hybrid vpn PCC"]
enable mangle [find comment~"hybrid route ISP"]
log: "HYBRID: mode BOTH-UP — PCC enabled"
hybrid-set-mode-isp1-down:
disable mangle [find comment~"hybrid office PCC"]
disable mangle [find comment~"hybrid vpn PCC"]
disable mangle [find comment~"hybrid route ISP"]
log: "HYBRID: mode ISP1-DOWN — failover ISP2, PCC off"
(traffic user mengikuti main table → backup route ISP2)
hybrid-set-mode-isp2-down:
disable mangle [find comment~"hybrid office PCC ISP2"]
disable mangle [find comment~"hybrid vpn PCC ISP2"]
disable mangle [find comment~"hybrid route ISP2"]
enable mangle [find comment~"hybrid office PCC ISP1"]
enable mangle [find comment~"hybrid vpn PCC ISP1"]
enable mangle [find comment~"hybrid route ISP1"]
log: "HYBRID: mode ISP2-DOWN — ISP1 only"
Scheduler cadangan (setiap 1 menit): hybrid-sync-mode
Deteksi GW pakai :len [/ping ...] — bukan packet-loss=0 (bug Fase 2 pertama).
5. APA YANG DI-HYBRID — APA YANG TIDAK
--------------------------------------
LOAD BALANCE (PCC, saat both up):
[x] Internet user kantor 192.168.0.x (~50/50 per koneksi)
[x] Internet user VPN 100.100.1.x (~50/50 per koneksi)
FAILOVER (saat salah satu ISP down):
[x] User kantor & VPN → ISP yang masih hidup (100%)
[x] Office ↔ server 10.100.1.x (bypass rule, tidak terpengaruh PCC)
TIDAK DI-HYBRID:
[ ] Satu koneksi/download = gabungan kecepatan ISP1+ISP2
[ ] dst-nat inbound 117.102.73.x (tetap ether1; mati jika ISP1 down)
[ ] Server 10.100.1.x internet keluar (tetap ISP1; mati jika ISP1 down)
[ ] Hairpin NAT berbasis ether1 saat ISP1 down
6. MENGAPA PERLU TIGA LAPIS (PCC + check-gateway + Netwatch)
------------------------------------------------------------
| Lapisan | Fungsi |
|------------------|-----------------------------------------------------|
| PCC | Bagi koneksi user ke ISP1/ISP2 saat keduanya sehat |
| check-gateway | Route per tabel ISP inactive jika GW tidak pingable |
| Netwatch | Disable PCC saat ISP down — cegah mark ke tabel mati |
check-gateway saja TIDAK cukup: koneksi sudah ter-mark PCC ISP2 tetap
diarahkan ke tabel KE ISP 2 meski route inactive → blackhole.
Netwatch saja TIDAK cukup: perlu check-gateway agar route failover
main table akurat.
PCC saja TIDAK cukup: sudah terbukti merusak internet kantor (Jun 2026).
7. PRA-SYARAT EKSEKUSI
----------------------
Wajib selesai SEBELUM hybrid:
[ ] Failover dasar (mikrotik-failover-design) sudah dites — ISP2 backup OK
[ ] sfp-sfpplus1 link UP, DHCP bound (mis. 192.168.1.52/24)
[ ] Ping 117.102.73.97 dan 192.168.1.1 dari Mikrotik OK
[ ] Internet via masing-masing ISP terbukti (tes terpisah)
[ ] Export backup: /export file=pre-hybrid-backup
[ ] Restore Fase 1 siap: restore-failover-phase1-mikrotik.ps1
[ ] Backup Fase 1: server/mikrotik-failover-phase1-backup.txt
[ ] Buka 2 sesi SSH ke 192.168.0.1:255 (cadangan)
[ ] Aktifkan Safe Mode Winbox/SSH (disarankan)
[ ] IP laptop admin di hybrid.rsc: 192.168.0.33
[ ] Checklist lengkap: server/mikrotik-hybrid-apply-checklist.txt
Jangan lompat langsung ke hybrid dari baseline single-ISP.
8. TAHAP EKSEKUSI (BERURUTAN)
-----------------------------
Fase 0 — Backup baseline
/export file=pre-hybrid-backup
Fase 1 — Failover dasar (dokumen terpisah)
Aktifkan ISP2, route main check-gateway distance 1+2
Tes: cabut ISP1 → user internet via ISP2 → restore
Fase 2 — Routing table + rules hybrid
Tambah route KE ISP 1/2 dengan check-gateway
Tambah routing rules hybrid ISP1/ISP2
Belum enable PCC
Fase 3 — Mangle bypass + server force
Rule server force ISP1 + office-to-server-bypass
Tes: office→10.100.1.x tetap OK
Fase 4 — PCC (awal disabled ISP2 half)
Enable PCC ISP1 only → tes internet office
Enable PCC ISP2 + route marks → tes both ISP
Fase 5 — Netwatch + script mode
Pasang monitor GW + script enable/disable PCC
Tes failover: ISP1 down → PCC off → ISP2 100%
Tes failover: ISP2 down → PCC ISP2 off → ISP1 100%
Tes recovery: kedua ISP up → PCC on lagi
Fase 6 — Dokumentasi produksi
Update existing-network-geonet.txt jika diterima sebagai standar baru
9. ROLLBACK
-----------
Restore ke Failover Fase 1 (RECOMMENDED jika Hybrid gagal):
.\scripts\restore-failover-phase1-mikrotik.ps1
Acuan: server/mikrotik-failover-phase1-backup.txt
Rollback ke single-ISP (hanya jika perlu hapus failover sepenuhnya):
.\scripts\rollback-single-wan-mikrotik.ps1
Manual restore Fase 1:
/import file=restore-failover-phase1.rsc
10. RISIKO & MITIGASI
---------------------
| Risiko | Dampak | Mitigasi |
|--------------------------------|---------------------------|---------------------------------|
| Flapping ISP1/ISP2 | Internet putus-nyambung | Netwatch timeout+interval; hysteresis scheduler |
| PCC on saat ISP2 down | ~50% koneksi gagal | Netwatch WAJIB disable PCC ISP2 |
| Office tidak bisa ke server | Produksi terganggu | Rule bypass place-before PCC |
| dst-nat mati ISP1 down | Layanan publik down | Komunikasi ke stakeholder; monitor |
| Config terlalu kompleks | Sulit troubleshoot | Comment prefix "hybrid"; dokumentasi mode |
| Script RouterOS error | Mode salah | Scheduler koreksi + log |
11. VERIFIKASI SETELAH IMPLEMENTASI
-----------------------------------
# Mode & route
/ip route print detail where comment~"hybrid"
/routing rule print
/ip firewall mangle print
# Netwatch
/tool netwatch print
# Tes dari Mikrotik
/ping 8.8.8.8 count=5
/ping 192.168.0.1 count=2
/ping 10.100.1.10 count=2
# Tes dari laptop kantor (192.168.0.x)
ping 8.8.8.8
ping 10.100.1.1
ping 10.100.1.10
tracert 8.8.8.8 (lihat keluar ISP1 atau ISP2)
# Tes failover manual
- Simulasi ISP1 down → semua user via ISP2, PCC off
- Simulasi ISP2 down → semua user via ISP1, PCC ISP2 off
- Restore → PCC 50/50 kembali
12. FILE YANG AKAN DIBUAT SAAT EKSEKUSI (BELUM ADA)
---------------------------------------------------
server/mikrotik-hybrid.rsc — config + script (mgmt bypass + sync fix)
server/mikrotik-hybrid-apply-checklist.txt — checklist apply aman
scripts/apply-hybrid-mikrotik.ps1 — deploy (default SSH 192.168.0.1)
Rollback tetap:
scripts/rollback-single-wan-mikrotik.ps1
server/mikrotik-rollback-single-wan.rsc
13. REFERENSI
-------------
server/mikrotik-hybrid-design.txt — dokumen ini
server/existing-network-geonet.txt — baseline produksi (single-ISP)
server/mikrotik-failover-design.txt — Fase 1 failover (prasyarat)
server/mikrotik-dual-wan.rsc — PCC lama TANPA Netwatch (JANGAN pakai langsung)
server/mikrotik-audit.txt — audit perimeter lengkap
scripts/rollback-single-wan-mikrotik.ps1