# Hybrid Fase 2 — Failover + PCC + Netwatch + check-gateway
# Import: /import file=hybrid.rsc
# Restore Fase 1: scripts/restore-failover-phase1-mikrotik.ps1
# SSH saat apply: admin@192.168.0.1 port 255 (bukan 10.100.1.1)

# --- Cleanup hybrid lama (idempotent, termasuk prep) ---
/tool netwatch remove [find comment~"hybrid"]
/system scheduler remove [find name~"hybrid"]
/system script remove [find name~"hybrid"]
/ip firewall mangle remove [find comment~"hybrid"]
/routing rule remove [find comment~"hybrid"]
/ip route remove [find comment~"hybrid ISP1"]

# --- Routes per routing-table (PCC) ---
/ip route add dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table="KE ISP 1" check-gateway=ping distance=1 comment="hybrid ISP1" disabled=no
/ip route set [find dst-address=0.0.0.0/0 routing-table="KE ISP 2"] check-gateway=ping distance=1 comment="hybrid ISP2"

# Connected routes di policy table (wajib agar PCC office/VPN bisa reach gateway)
/ip route add dst-address=117.102.73.96/29 gateway=ether1 routing-table="KE ISP 1" distance=1 comment="hybrid ISP1 WAN lan"
/ip route add dst-address=192.168.1.0/24 gateway=sfp-sfpplus1 routing-table="KE ISP 2" distance=1 comment="hybrid ISP2 WAN lan"
/ip route add dst-address=192.168.0.0/24 gateway=office routing-table="KE ISP 1" distance=1 comment="hybrid office lan ISP1"
/ip route add dst-address=192.168.0.0/24 gateway=office routing-table="KE ISP 2" distance=1 comment="hybrid office lan ISP2"

# Main table failover (saat PCC off)
/ip route set [find dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table=main] comment="hybrid failover ISP1 primary"
/ip route set [find dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main] comment="hybrid failover ISP2 backup"

# --- Routing rules ---
/routing rule add action=lookup-only-in-table table="KE ISP 1" routing-mark="KE ISP 1" comment="hybrid ISP1"
/routing rule add action=lookup-only-in-table table="KE ISP 2" routing-mark="KE ISP 2" comment="hybrid ISP2"

# --- Mangle (urutan: server bypass → mgmt → server force → office bypass → PCC) ---
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.1.0/24 dst-address=10.100.1.0/24 comment="hybrid server-local-bypass" place-before=0
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.1.0/24 dst-address=192.168.0.0/24 comment="hybrid server-to-office-bypass" place-before=0
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.1.0/24 dst-address=100.100.1.0/24 comment="hybrid server-to-vpn-bypass" place-before=0
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.1.0/24 dst-address=117.102.73.96/29 comment="hybrid server hairpin bypass" place-before=0
/ip firewall mangle add chain=prerouting action=accept src-address=192.168.0.33 comment="hybrid mgmt bypass laptop" place-before=0
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark="KE ISP 1" passthrough=no src-address=10.100.1.0/24 comment="hybrid server force ISP1" place-before=0
/ip firewall mangle add chain=prerouting action=accept dst-address=10.100.1.0/24 in-interface=office comment="hybrid office-to-server-bypass"
/ip firewall mangle add chain=prerouting action=accept dst-address=117.102.73.96/29 in-interface=office comment="hybrid office hairpin bypass"
/ip firewall mangle add chain=prerouting action=accept src-address=100.100.1.0/24 dst-address=117.102.73.96/29 comment="hybrid vpn hairpin bypass"
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark="ISP 1" passthrough=yes connection-mark=no-mark in-interface=office per-connection-classifier=both-addresses-and-ports:2/0 comment="hybrid office PCC ISP1"
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark="ISP 2" passthrough=yes connection-mark=no-mark in-interface=office per-connection-classifier=both-addresses-and-ports:2/1 comment="hybrid office PCC ISP2"
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark="ISP 1" passthrough=yes connection-mark=no-mark in-interface=vpn per-connection-classifier=both-addresses-and-ports:2/0 comment="hybrid vpn PCC ISP1"
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark="ISP 2" passthrough=yes connection-mark=no-mark in-interface=vpn per-connection-classifier=both-addresses-and-ports:2/1 comment="hybrid vpn PCC ISP2"
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark="KE ISP 1" passthrough=yes connection-mark="ISP 1" comment="hybrid route ISP1"
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark="KE ISP 2" passthrough=yes connection-mark="ISP 2" comment="hybrid route ISP2"

# --- System scripts (hybrid-sync: ping gagal = return kosong, bukan packet-loss) ---
/system script add name=hybrid-set-mode-both-up dont-require-permissions=yes policy=read,write,test source={
/ip firewall mangle enable [find comment="hybrid office PCC ISP1"]
/ip firewall mangle enable [find comment="hybrid office PCC ISP2"]
/ip firewall mangle enable [find comment="hybrid vpn PCC ISP1"]
/ip firewall mangle enable [find comment="hybrid vpn PCC ISP2"]
/ip firewall mangle enable [find comment="hybrid route ISP1"]
/ip firewall mangle enable [find comment="hybrid route ISP2"]
:log info "HYBRID: mode BOTH-UP"
}

/system script add name=hybrid-set-mode-isp1-down dont-require-permissions=yes policy=read,write,test source={
/ip firewall mangle disable [find comment="hybrid office PCC ISP1"]
/ip firewall mangle disable [find comment="hybrid office PCC ISP2"]
/ip firewall mangle disable [find comment="hybrid vpn PCC ISP1"]
/ip firewall mangle disable [find comment="hybrid vpn PCC ISP2"]
/ip firewall mangle disable [find comment="hybrid route ISP1"]
/ip firewall mangle disable [find comment="hybrid route ISP2"]
:log info "HYBRID: mode ISP1-DOWN"
}

/system script add name=hybrid-set-mode-isp2-down dont-require-permissions=yes policy=read,write,test source={
/ip firewall mangle disable [find comment="hybrid office PCC ISP2"]
/ip firewall mangle disable [find comment="hybrid vpn PCC ISP2"]
/ip firewall mangle disable [find comment="hybrid route ISP2"]
/ip firewall mangle enable [find comment="hybrid office PCC ISP1"]
/ip firewall mangle enable [find comment="hybrid vpn PCC ISP1"]
/ip firewall mangle enable [find comment="hybrid route ISP1"]
:log info "HYBRID: mode ISP2-DOWN"
}

/system script add name=hybrid-sync-mode dont-require-permissions=yes policy=read,write,test,sniff source={
:local r1 [/ping 117.102.73.97 count=2 as-value]
:local r2 [/ping 192.168.1.1 count=2 as-value]
:local loss1 ($r1->"packet-loss")
:local loss2 ($r2->"packet-loss")
:if ($loss1=0 && $loss2=0) do={
  /system script run hybrid-set-mode-both-up
} else={
  :if ($loss1>0) do={
    /system script run hybrid-set-mode-isp1-down
  } else={
    :if ($loss2>0) do={
      /system script run hybrid-set-mode-isp2-down
    }
  }
}
}

# --- Netwatch ---
/tool netwatch add comment="hybrid monitor ISP1" host=117.102.73.97 interval=10s timeout=3s up-script="hybrid-sync-mode" down-script="hybrid-set-mode-isp1-down"
/tool netwatch add comment="hybrid monitor ISP2" host=192.168.1.1 interval=10s timeout=3s up-script="hybrid-sync-mode" down-script="hybrid-set-mode-isp2-down"

# --- Scheduler cadangan ---
/system scheduler add name=hybrid-sync-mode comment="hybrid scheduler" interval=1m on-event=hybrid-sync-mode

# Set mode awal sesuai kesehatan GW
/system script run hybrid-sync-mode

# --- DNS internal: gisportal → reverse proxy; geonet hanya iguf (nginx) ---
/ip dns static remove [find comment~"hybrid dns geonet"]
/ip dns static add name=iguf.geonet.co.id address=10.100.1.24 ttl=1d comment="split-dns iguf"
/ip dhcp-server network set [find address=192.168.0.0/24] dns-server=192.168.0.1,203.142.82.222,203.142.84.222
/ip dhcp-server network set [find address=100.100.1.0/24] dns-server=10.100.1.1,203.142.82.222,203.142.84.222