AUDIT INFRASTRUKTUR — MIKROTIK ROUTER ====================================== Tanggal audit : 2026-06-13 Sumber : server/host.txt, config-check.rsc Metode : SSH langsung (key-based) IP/SSH : 10.100.1.1 | .\scripts\ssh-mikrotik.ps1 | ssh -i ~/.ssh/id_rsa_mikrotik -o IdentitiesOnly=yes -m hmac-sha1 admin@10.100.1.1 -p 255 Hostname : MikroTik Model : CCR2004-1G-12S+2XS (ARM64, serial HDD08647CP6) OS : RouterOS 7.5 (stable), build Aug/30/2022 Uptime : ~1 minggu 14 jam (saat audit) Resource : RAM 3811 MiB free / 4032 MiB | CPU load ~2% | Disk 8.6 MiB free / 129 MiB Peran host: gateway internet, firewall perimeter, NAT publik, DHCP office/VPN, segmentasi VLAN server/office, VPN remote (SSTP/PPTP), RADIUS ke AD. A. INTERFACE & SEGMENTASI JARINGAN ----------------------------------- A1. WAN | Interface | Peran | Status | |-----------|--------------------|----------| | ether1 | WAN ke ISP utama | Running | | sfp-sfpplus1 | ISP kedua (DHCP) | Disabled | A2. Bridge utama | Bridge | Fungsi | IP gateway | |---------|--------------------------------|---------------| | server | Jaringan server/datacenter | 10.100.1.1/24 | | office | Jaringan user kantor + switch | 192.168.0.1/24 (juga di sfp-sfpplus10) | | vpn | Pool VPN remote dial-in | 100.100.1.1/32 | A3. Port fisik → bridge | Port | Keterangan | Bridge | Status | |----------------|---------------------|--------|-------------| | sfp-sfpplus2 | DELL-main-network | server | Running | | sfp-sfpplus3 | DELL | server | Running | | sfp-sfpplus4 | IBM | server | Inactive | | sfp-sfpplus5 | NAS | server | Running | | sfp-sfpplus6 | — | server | Inactive | | sfp-sfpplus10 | switch server | office | Running | | sfp-sfpplus11 | switch production | office | Running | | sfp-sfpplus12 | switch adm | office | Disabled | A4. VLAN | VLAN | VLAN-ID | Parent port | Bridge | Keterangan | |----------|---------|----------------|--------|-------------------| | vlan3 | 3 | sfp-sfpplus12 | server | Admin segment | | vlan10 | 10 | sfp-sfpplus10 | server | Server VLAN | | vlan11 | 11 | sfp-sfpplus11 | server | Production VLAN | | vlan12 | 12 | sfp-sfpplus12 | server | Admin VLAN | | vlan99 | 99 | sfp-sfpplus10 | server | — | | vlan2010 | 2010 | sfp-sfpplus10 | office | Office VLAN | | vlan2012 | 2012 | sfp-sfpplus12 | office | Office admin VLAN | | vlan2004 | 2001 | sfp-sfpplus4 | office | IBM (inactive) | Catatan interface: - sfp-sfpplus12 + vlan3/12/2012 sering link flap (100+ link-downs). - vlan2004 & sfp-sfpplus4 inactive — network IBM tidak aktif. - sfp-sfpplus1 (ISP 2) disabled; load-balance disiapkan tapi tidak aktif. B. IP ADDRESS ------------- B1. IP publik (semua di ether1, blok ISP 117.102.73.96/29, gateway .97) | IP | Keterangan | Fungsi utama | |--------------------|------------------|---------------------------------------| | 117.102.73.102/29 | gisportal.id | IP utama — web, DB, mail, LDAP, Zabbix | | 117.102.73.101/32 | Not Set | Mail server (→ 10.100.1.76) | | 117.102.73.100/32 | dev.gisportal.id | Dev/K8s (.51, .57, .59) | | 117.102.73.98/32 | geonet.co.id | Domain geonet | | 117.102.73.99/32 | geonet.co.id | HTTP/HTTPS → reverse proxy | B2. IP internal | Network | Interface | Gateway | Pengguna | |-----------------|---------------|-------------|-----------------------------| | 10.100.1.0/24 | server | 10.100.1.1 | Server/infrastruktur | | 192.168.0.0/24 | office | 192.168.0.1 | User kantor (DHCP) | | 100.100.1.0/24 | vpn | 100.100.1.1 | User VPN remote (DHCP) | | 192.168.2.0/24 | vlan2004 | 192.168.2.1 | Network IBM (DHCP relay) | B3. Routing aktif Default route : 0.0.0.0/0 → 117.102.73.97 via ether1 (ISP utama) Backup route : 0.0.0.0/0 → 192.168.1.1 via routing-table "KE ISP 2" (load-balance disabled) C. INTERNET UNTUK USER ---------------------- C1. User kantor (192.168.0.x) Alur: PC → DHCP Mikrotik (dhcp1, pool 192.168.0.2–254, lease 4 minggu) → Gateway 192.168.0.1 → DNS 203.142.82.222 / 203.142.84.222 → NAT masquerade out-interface=ether1 → Internet sebagai IP publik 117.102.73.x DHCP reservation (contoh): switch .8/.9, multimedia .4, WAVLINK .20, dll. Hairpin NAT: user kantor yang akses domain publik di-redirect ke server internal 192.168.0.0/24 → 10.100.1.24:80/443 (tanpa keluar internet) C2. User VPN remote (100.100.1.x) Alur: User → SSTP (port 443) / PPTP → Autentikasi RADIUS ke AD 10.100.1.40 (domain gisportal.id) → IP 100.100.1.x via DHCP (dhcp2, lease 10 menit) → NAT masquerade → internet SSTP : enabled (port 443, auth pap/chap/mschap) PPTP : enabled (tidak aman — disarankan nonaktifkan) C3. User PPP dengan IP server (10.100.1.2xx) Akun PPP lokal (rbsetiawan, asobari, uabdurrohman, trachman, test, dpradana, ataufik) mendapat IP tetap di jaringan server (10.100.1.220–229). Alur: VPN dial-in → IP 10.100.1.2xx (langsung di LAN server) → Akses penuh ke 10.100.1.0/24 → Internet via masquerade ether1 [KEAMANAN] Password PPP disimpan plain-text di /ppp secret — pertimbangkan migrasi ke RADIUS-only atau hapus akun tidak terpakai. D. NAT (PORT FORWARDING PUBLIK → INTERNAL) ------------------------------------------ Total aturan NAT : 55 (dst-nat aktif: 27, forward filter: 21) D1. IP 117.102.73.102 (gisportal.id) — port forward aktif | Port | → Internal | Layanan | |-------|------------------|----------------------| | 21 | 10.100.1.10:21 | FTP | | 24 | 10.100.1.24:22 | SSH (disabled) | | 25 | 10.100.1.40:25 | SMTP | | 80 | 10.100.1.24:80 | HTTP reverse proxy | | 110 | 10.100.1.40:110 | POP3 | | 143 | 10.100.1.40:143 | IMAP | | 389 | 10.100.1.40:389 | LDAP | | 443 | 10.100.1.24:443 | HTTPS reverse proxy | | 587 | 10.100.1.40:587 | SMTP submission | | 995 | 10.100.1.40:995 | POP3S | | 1433 | 10.100.1.25:1433 | SQL Server utama | | 1434 | 10.100.1.75:1433 | SQL Server RND 2016 | | 1436 | 10.100.1.76:1433 | SQL Server RND 2016 | | 1437 | 10.100.1.77:1433 | SQL Server RND 2022 | | 5432 | 10.100.1.25:5432 | PostgreSQL | | 5433 | 10.100.1.27:5432 | PostgreSQL alt | | 5434 | 10.100.1.27:5434 | PostgreSQL alt | | 10051 | 10.100.1.42:10051| Zabbix active checks | D2. IP 117.102.73.99 (geonet.co.id) | Port | → Internal | |-------|------------------| | 80 | 10.100.1.24:80 | | 443 | 10.100.1.24:443 | | 8080 | 10.100.1.27:8080 | (disabled) | D3. IP 117.102.73.100 (dev.gisportal.id) | Port | → Internal | |--------|--------------------| | 443 | 10.100.1.51:443 | | 2443 | 10.100.1.51:2443 | | 6443 | 10.100.1.51:6443 | | 7443 | 10.100.1.51:7443 | | 6143 | 10.100.1.59:6143 | | 13443 | 10.100.1.57:13443 | | 30443 | 10.100.1.59:30443 | (disabled) | D4. IP 117.102.73.101 (Not Set — mail) | Port | → Internal | |-------|------------------| | 25 | 10.100.1.76:25 | | 80 | 10.100.1.76:80 | | 143 | 10.100.1.76:143 | | 465 | 10.100.1.76:465 | | 587 | 10.100.1.76:587 | | 993 | 10.100.1.76:993 | | 995 | 10.100.1.76:995 | D5. Source NAT (keluar) | Aturan | Fungsi | |-------------------------------------|---------------------------------| | masquerade out-interface=ether1 | Semua traffic keluar → IP publik | | masquerade out-interface=sfp-sfpplus1 | ISP kedua (siap, belum aktif) | | masquerade (tanpa out-interface) | Catch-all — perlu review | | Hairpin NAT ×3 | Loopback 192.168.0.x → 10.100.1.24/100 | E. FIREWALL & KEAMANAN ---------------------- E1. Server diblokir akses langsung ke internet (out-interface=ether1) | IP server | Status rule | |--------------|-------------| | 10.100.1.100 | DROP aktif | | 10.100.1.88 | DROP aktif | | 10.100.1.84 | DROP aktif | | 10.100.1.91 | DROP aktif | | 10.100.1.61 | DROP aktif | | 10.100.1.72 | DROP aktif | | 10.100.1.80 | DROP aktif | E2. Server dengan rule DROP disabled (boleh keluar langsung saat ini) 10.100.1.24 (reverse proxy), .25 (DB), .40 (AD), .51 (dev), .53/.55/.56/.58 E3. User kantor diisolasi 192.168.0.57 — DROP forward (total) 192.168.0.64 — DROP forward (total) E4. DDoS detection Chain detect-ddos: rate-limit 32/s per src+dst, auto-block 10 menit E5. Layanan management | Layanan | Port | Akses dibatasi ke | |----------|------|--------------------------------------| | SSH | 255 | 10.100.1.0/24, 192.168.0.0/24 | | Winbox | — | 10.100.1.0/24, 192.168.0.0/24 | | Telnet | — | Disabled | | FTP/WWW/API | — | Disabled | E6. SSH key User admin: key RSA terdaftar (admin@DESKTOP-RRJ9G01-mikrotik) Login: .\scripts\ssh-mikrotik.ps1 (key-based, IdentitiesOnly=yes) F. HUBUNGAN DENGAN HOST LAIN (dari repo server-connection) ---------------------------------------------------------- | Host internal | IP | Keterangan NAT/firewall | |-----------------|--------------|------------------------------------------| | Reverse_proxy | 10.100.1.24 | dst-nat :80/:443 dari .102/.99 | | Main_Database | 10.100.1.25 | dst-nat :1433/:5432 dari .102 | | AD-LDAP | 10.100.1.40 | dst-nat mail/LDAP; RADIUS untuk VPN | | Zabbix | 10.100.1.42 | dst-nat :10051 dari .102 | | Main_Webserver | 10.100.1.41 | Tidak ada dst-nat langsung ke .41 | Diagram: Internet/User | v [ Mikrotik 10.100.1.1 ] ← audit ini | +---> 192.168.0.0/24 (user kantor, DHCP) +---> 100.100.1.0/24 (VPN remote, RADIUS→AD) +---> 10.100.1.0/24 (server LAN) | +---> .24 reverse proxy (pintu masuk HTTPS publik) +---> .25 database +---> .40 AD/LDAP/mail +---> .41 webserver +---> .42 Zabbix G. ANALISA & REKOMENDASI ------------------------ Yang berjalan baik: 1. Segmentasi jelas: server / office / VPN / VLAN. 2. Multi-IP publik per layanan/domain. 3. Hairpin NAT untuk user kantor akses domain internal. 4. VPN terintegrasi RADIUS AD (domain gisportal.id). 5. DDoS detection aktif. 6. SSH key-based auth untuk admin (port 255, subnet terbatas). Perlu perhatian: 1. [KRITIS] Banyak port sensitif expose publik (1433, 5432, 25, 389, 143). Pastikan service-level auth kuat; pertimbangkan batasi source IP. 2. [KRITIS] Password PPP plain-text di router — migrasi ke RADIUS-only. 3. [KEAMANAN] PPTP masih enabled — nonaktifkan, gunakan SSTP saja. 4. [STABILITAS] sfp-sfpplus12 + VLAN admin sering flap — cek kabel/SFP/switch. 5. [STABILITAS] IBM vlan2004 inactive — DHCP relay invalid. 6. [ROUTING] Load-balance ISP 2 disiapkan tapi semua rule disabled. 7. [NAT] Rule masquerade tanpa out-interface — review dampaknya. 8. [DISK] Free HDD hanya 8.6 MiB / 129 MiB — monitor, backup config rutin. 9. [FIREWALL] Rule DROP server utama (.24/.25/.40) saat ini disabled — server infra bisa keluar internet langsung. PERINTAH VERIFIKASI ULANG ------------------------- # SSH ke Mikrotik .\scripts\ssh-mikrotik.ps1 .\scripts\ssh-mikrotik.ps1 -Command "/system resource print" # Interface & address .\scripts\ssh-mikrotik.ps1 -Command "/interface print stats" .\scripts\ssh-mikrotik.ps1 -Command "/ip address print" # Routing & NAT .\scripts\ssh-mikrotik.ps1 -Command "/ip route print where active=yes" .\scripts\ssh-mikrotik.ps1 -Command "/ip firewall nat print where disabled=no" # DHCP & VPN .\scripts\ssh-mikrotik.ps1 -Command "/ip dhcp-server lease print" .\scripts\ssh-mikrotik.ps1 -Command "/ppp active print" # Firewall .\scripts\ssh-mikrotik.ps1 -Command "/ip firewall filter print where chain=forward" # Export config (backup) .\scripts\ssh-mikrotik.ps1 -Command "/export file=backup-audit"