You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
635 lines
32 KiB
635 lines
32 KiB
# jul/06/2026 15:46:32 by RouterOS 7.5 |
|
# software id = E3H0-EVXR |
|
# |
|
# model = CCR2004-1G-12S+2XS |
|
# serial number = HDD08647CP6 |
|
/interface bridge |
|
add name=office |
|
add name=server |
|
add add-dhcp-option82=yes dhcp-snooping=yes name=vpn |
|
/interface ethernet |
|
set [ find default-name=ether1 ] comment="ISP BIZNET" |
|
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no comment=\ |
|
"ISP IDBIZ" |
|
set [ find default-name=sfp-sfpplus2 ] comment=DELL-main-netwokrkVMBR0 \ |
|
loop-protect=on loop-protect-disable-time=10s |
|
set [ find default-name=sfp-sfpplus3 ] comment=DELL loop-protect=on \ |
|
loop-protect-disable-time=10s |
|
set [ find default-name=sfp-sfpplus4 ] comment=IBM loop-protect=on \ |
|
loop-protect-disable-time=10s |
|
set [ find default-name=sfp-sfpplus5 ] comment=NAS |
|
set [ find default-name=sfp-sfpplus6 ] auto-negotiation=no disabled=yes |
|
set [ find default-name=sfp-sfpplus10 ] comment="swich server" |
|
set [ find default-name=sfp-sfpplus11 ] comment="swich production" speed=\ |
|
10Gbps |
|
set [ find default-name=sfp-sfpplus12 ] comment="swich adm" speed=10Gbps |
|
/interface vlan |
|
add interface=sfp-sfpplus12 loop-protect=on name=vlan3 vlan-id=3 |
|
add interface=sfp-sfpplus10 loop-protect=on name=vlan10 vlan-id=10 |
|
add interface=sfp-sfpplus11 loop-protect=on name=vlan11 vlan-id=11 |
|
add interface=sfp-sfpplus12 loop-protect=on name=vlan12 vlan-id=12 |
|
add interface=sfp-sfpplus10 name=vlan99 vlan-id=99 |
|
add disabled=yes interface=sfp-sfpplus10 loop-protect=on name=vlan2001 \ |
|
vlan-id=2001 |
|
add interface=sfp-sfpplus4 name=vlan2004 vlan-id=2001 |
|
add interface=sfp-sfpplus10 loop-protect=on name=vlan2010 vlan-id=2010 |
|
add interface=sfp-sfpplus12 loop-protect=on name=vlan2012 vlan-id=2012 |
|
/interface wireless security-profiles |
|
set [ find default=yes ] supplicant-identity=MikroTik |
|
/ip pool |
|
add name=dhcp_pool0 ranges=192.168.0.2-192.168.0.254 |
|
add name=dhcp_pool1 ranges=192.168.0.2-192.168.0.254 |
|
add name=dhcp_pool2 ranges=192.168.0.2-192.168.0.254 |
|
add name=dhcp_pool3 ranges=192.168.0.2-192.168.0.254 |
|
add name=dhcp_pool4 ranges=100.100.1.2-100.100.1.254 |
|
add name=dhcp_pool5 ranges=192.168.2.2-192.168.2.254 |
|
add name=dhcp_pool6 ranges=192.168.2.2-192.168.2.254 |
|
/ip dhcp-server |
|
add address-pool=dhcp_pool3 interface=office lease-time=4w3d name=dhcp1 |
|
add address-pool=dhcp_pool4 interface=vpn name=dhcp2 |
|
# DHCP server can not run on slave interface! |
|
add address-pool=dhcp_pool6 interface=vlan2004 name=dhcp3 relay=192.168.2.1 |
|
/port |
|
set 0 name=serial0 |
|
set 1 name=serial1 |
|
/queue simple |
|
add name=multimedia priority=1/1 target=192.168.0.4/32 |
|
add disabled=yes name=priotiry priority=2/2 target=office |
|
/routing table |
|
add disabled=no fib name="KE ISP 1" |
|
add disabled=no fib name="KE ISP 2" |
|
/snmp community |
|
set [ find default=yes ] write-access=yes |
|
/interface bridge port |
|
add bridge=server interface=sfp-sfpplus2 |
|
add bridge=server interface=sfp-sfpplus3 |
|
add bridge=server interface=sfp-sfpplus4 |
|
add bridge=server interface=sfp-sfpplus5 |
|
add bridge=office interface=sfp-sfpplus10 trusted=yes |
|
add bridge=office interface=sfp-sfpplus11 trusted=yes |
|
add bridge=office disabled=yes interface=sfp-sfpplus12 |
|
add bridge=server interface=vlan10 |
|
add bridge=server interface=vlan11 |
|
add bridge=server interface=vlan12 |
|
add bridge=server interface=vlan99 |
|
add bridge=office interface=vlan2010 trusted=yes |
|
add bridge=server interface=vlan3 |
|
add bridge=office interface=vlan2012 trusted=yes |
|
add bridge=office interface=vlan2004 trusted=yes |
|
add bridge=server interface=sfp-sfpplus6 |
|
/interface pptp-server server |
|
# PPTP connections are considered unsafe, it is suggested to use a more modern VPN protocol instead |
|
set enabled=yes |
|
/interface sstp-server server |
|
set enabled=yes |
|
/ip address |
|
add address=192.168.88.1/24 comment=defconf disabled=yes interface=ether1 \ |
|
network=192.168.88.0 |
|
add address=117.102.73.102/29 comment=gisportal.id interface=ether1 network=\ |
|
117.102.73.96 |
|
add address=117.102.73.101 comment="Not Set" interface=ether1 network=\ |
|
117.102.73.101 |
|
add address=117.102.73.100 comment=dev.gisportal.id interface=ether1 network=\ |
|
117.102.73.100 |
|
add address=117.102.73.98 comment=geonet.co.id interface=ether1 network=\ |
|
117.102.73.96 |
|
add address=10.100.1.1/24 interface=server network=10.100.1.0 |
|
add address=117.102.73.99 comment=geonet.co.id interface=ether1 network=\ |
|
117.102.73.99 |
|
add address=192.168.0.1/24 interface=sfp-sfpplus10 network=192.168.0.0 |
|
add address=100.100.1.0 interface=vpn network=100.100.1.0 |
|
add address=192.168.2.0/24 interface=vlan2004 network=192.168.2.0 |
|
/ip dhcp-client |
|
add add-default-route=no interface=sfp-sfpplus1 use-peer-dns=no |
|
/ip dhcp-server lease |
|
add address=192.168.0.11 client-id=1:bc:fc:e7:8e:55:67 mac-address=\ |
|
BC:FC:E7:8E:55:67 server=dhcp1 |
|
add address=192.168.0.102 client-id=1:18:fb:7b:a5:50:8b mac-address=\ |
|
18:FB:7B:A5:50:8B server=dhcp1 |
|
add address=192.168.0.9 client-id=1:18:fd:74:52:8e:5f comment=swich \ |
|
mac-address=18:FD:74:52:8E:5F server=dhcp1 |
|
add address=192.168.0.8 client-id=1:18:fd:74:8b:b2:7f comment=swich \ |
|
mac-address=18:FD:74:8B:B2:7F server=dhcp1 |
|
add address=192.168.0.4 mac-address=10:5F:02:84:F0:2F server=dhcp1 |
|
add address=192.168.0.10 client-id=1:24:5e:be:42:8f:a5 mac-address=\ |
|
24:5E:BE:42:8F:A5 server=dhcp1 |
|
add address=192.168.0.74 client-id=1:b4:2e:99:2a:30:4c mac-address=\ |
|
B4:2E:99:2A:30:4C server=dhcp1 |
|
add address=192.168.0.20 client-id=1:80:3f:5d:f9:c1:40 comment=WAVLINK \ |
|
mac-address=80:3F:5D:F9:C1:40 server=dhcp1 |
|
add address=192.168.0.57 client-id=1:bc:24:11:5d:58:56 mac-address=\ |
|
BC:24:11:5D:58:56 server=dhcp1 |
|
add address=192.168.0.13 client-id=1:a0:d3:65:73:c7:97 mac-address=\ |
|
A0:D3:65:73:C7:97 server=dhcp1 |
|
add address=192.168.0.18 client-id=1:10:ff:e0:3a:7d:15 mac-address=\ |
|
10:FF:E0:3A:7D:15 server=dhcp1 |
|
add address=192.168.0.64 client-id=1:72:7e:64:31:eb:13 mac-address=\ |
|
72:7E:64:31:EB:13 server=dhcp1 |
|
add address=192.168.0.80 client-id=1:0:1:f5:2:b:d1 mac-address=\ |
|
00:01:F5:02:0B:D1 server=dhcp1 |
|
add address=192.168.0.69 mac-address=40:A3:CC:B1:02:15 server=dhcp1 |
|
/ip dhcp-server network |
|
add address=100.100.1.0/24 dns-server=100.100.1.1 gateway=100.100.1.1 |
|
add address=192.168.0.0/24 dns-server=203.142.82.222,203.142.84.222 gateway=\ |
|
192.168.0.1 |
|
add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.1.1 gateway=192.168.2.1 |
|
/ip dns |
|
set allow-remote-requests=yes servers=203.142.82.222,203.142.84.222 |
|
/ip dns static |
|
add address=10.100.1.61 disabled=yes name=arcgisenterprise.gisportal.id |
|
add address=10.100.1.72 name=aernd.gisportal.id |
|
add address=10.100.1.25 name=database.gisportal.id |
|
add address=10.100.1.24 comment="split-dns gisportal apex" name=gisportal.id |
|
add address=10.100.1.24 comment="split-dns dockge" name=dockge.gisportal.id |
|
add address=10.100.1.24 name=geonet.gisportal.id |
|
add address=10.100.1.24 name=api.gisportal.id |
|
add address=10.100.1.25 comment="split-dns database regexp" regexp=\ |
|
"^database\\.gisportal\\.id" |
|
add address=10.100.1.72 comment="split-dns aernd regexp" regexp=\ |
|
"^aernd\\.gisportal\\.id" |
|
add address=10.100.1.51 comment="split-dns dev regexp" regexp=\ |
|
"^dev\\.gisportal\\.id" |
|
add address=10.100.1.24 comment="split-dns gisportal catch-all" regexp=\ |
|
"\\.gisportal\\.id" |
|
add address=10.100.1.24 comment="split-dns iguf" name=iguf.geonet.co.id |
|
add address=10.100.1.24 comment=geonetagent-collector name=\ |
|
collector.gisportal.id |
|
add address=10.100.1.24 comment=geonetagent-agent name=agent.gisportal.id |
|
/ip firewall address-list |
|
add address=10.100.1.101 list=blocked-internet |
|
add address=10.100.1.100 list=blocked-internet |
|
add address=10.100.1.88 list=blocked-internet |
|
add address=10.100.1.84 list=blocked-internet |
|
add address=10.100.1.91 list=blocked-internet |
|
add address=10.100.1.61 list=blocked-internet |
|
add address=10.100.1.72 list=blocked-internet |
|
add address=10.100.1.80 list=blocked-internet |
|
add address=10.100.1.40 list=blocked-internet |
|
add address=10.100.1.51 list=blocked-internet |
|
add address=10.100.1.25 list=blocked-internet |
|
add address=10.100.1.56 list=blocked-internet |
|
add address=10.100.1.58 list=blocked-internet |
|
add address=10.100.1.55 list=blocked-internet |
|
add address=10.100.1.53 list=blocked-internet |
|
/ip firewall filter |
|
add action=drop chain=forward connection-state=new dst-address-list=ddosed \ |
|
src-address-list=ddoser |
|
add action=jump chain=forward connection-state=new jump-target=detect-ddos |
|
add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/1s |
|
add action=add-dst-to-address-list address-list=ddosed address-list-timeout=\ |
|
10m chain=detect-ddos |
|
add action=add-src-to-address-list address-list=ddoser address-list-timeout=\ |
|
10m chain=detect-ddos |
|
add action=drop chain=forward comment=block-internet-biznet disabled=yes \ |
|
out-interface=ether1 src-address-list=blocked-internet |
|
add action=drop chain=forward comment=block-internet-idbiz disabled=yes \ |
|
out-interface=sfp-sfpplus1 src-address-list=blocked-internet |
|
/ip firewall mangle |
|
add action=accept chain=prerouting comment="hybrid server-local-bypass" \ |
|
dst-address=10.100.1.0/24 src-address=10.100.1.0/24 |
|
add action=accept chain=prerouting comment="hybrid server-to-office-bypass" \ |
|
dst-address=192.168.0.0/24 src-address=10.100.1.0/24 |
|
add action=accept chain=prerouting comment="hybrid server-to-vpn-bypass" \ |
|
dst-address=100.100.1.0/24 src-address=10.100.1.0/24 |
|
add action=accept chain=prerouting comment="hybrid mgmt bypass laptop" \ |
|
disabled=yes src-address=192.168.0.33 |
|
add action=accept chain=prerouting comment="hybrid mgmt bypass laptop" \ |
|
src-address=10.100.1.220 |
|
add action=accept chain=prerouting comment="hybrid server hairpin bypass" \ |
|
dst-address=117.102.73.96/29 src-address=10.100.1.0/24 |
|
add action=mark-routing chain=prerouting comment=temp-speedtest-isp2 \ |
|
disabled=yes new-routing-mark="KE ISP 2" passthrough=yes src-address=\ |
|
10.100.1.24 |
|
add action=mark-routing chain=prerouting comment="hybrid server force ISP1" \ |
|
new-routing-mark="KE ISP 1" passthrough=no src-address=10.100.1.0/24 |
|
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ |
|
yes in-interface=vlan2004 new-connection-mark="ISP 2" passthrough=yes \ |
|
per-connection-classifier=both-addresses-and-ports:2/1 |
|
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ |
|
yes in-interface=server new-connection-mark="ISP 1" passthrough=yes \ |
|
per-connection-classifier=both-addresses-and-ports:2/0 |
|
add action=mark-routing chain=prerouting connection-mark="ISP 2" disabled=yes \ |
|
in-interface=vlan2004 new-routing-mark="KE ISP 2" passthrough=yes \ |
|
per-connection-classifier=both-addresses-and-ports:2/1 |
|
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ |
|
yes in-interface=sfp-sfpplus1 new-connection-mark="ISP 2" passthrough=yes |
|
add action=mark-connection chain=prerouting connection-mark=no-mark disabled=\ |
|
yes in-interface=ether1 new-connection-mark="ISP 1" passthrough=yes |
|
add action=mark-routing chain=output connection-mark="ISP 2" disabled=yes \ |
|
new-routing-mark="KE ISP 2" passthrough=yes |
|
add action=accept chain=prerouting comment="hybrid office-to-server-bypass" \ |
|
dst-address=10.100.1.0/24 in-interface=office |
|
add action=accept chain=prerouting comment="hybrid office hairpin bypass" \ |
|
dst-address=117.102.73.96/29 in-interface=office |
|
add action=mark-connection chain=prerouting comment="hybrid office PCC ISP1" \ |
|
connection-mark=no-mark in-interface=office new-connection-mark="ISP 1" \ |
|
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0 |
|
add action=mark-connection chain=prerouting comment="hybrid office PCC ISP2" \ |
|
connection-mark=no-mark in-interface=office new-connection-mark="ISP 2" \ |
|
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 |
|
add action=accept chain=prerouting comment="hybrid vpn hairpin bypass" \ |
|
dst-address=117.102.73.96/29 src-address=100.100.1.0/24 |
|
add action=mark-connection chain=prerouting comment="hybrid vpn PCC ISP1" \ |
|
connection-mark=no-mark disabled=yes in-interface=vpn \ |
|
new-connection-mark="ISP 1" passthrough=yes per-connection-classifier=\ |
|
both-addresses-and-ports:2/0 |
|
add action=mark-connection chain=prerouting comment="hybrid vpn PCC ISP2" \ |
|
connection-mark=no-mark disabled=yes in-interface=vpn \ |
|
new-connection-mark="ISP 2" passthrough=yes per-connection-classifier=\ |
|
both-addresses-and-ports:2/1 |
|
add action=mark-routing chain=prerouting comment="hybrid route ISP1" \ |
|
connection-mark="ISP 1" new-routing-mark="KE ISP 1" passthrough=yes |
|
add action=mark-routing chain=prerouting comment="hybrid route ISP2" \ |
|
connection-mark="ISP 2" new-routing-mark="KE ISP 2" passthrough=yes |
|
/ip firewall nat |
|
add action=masquerade chain=srcnat out-interface=ether1 |
|
add action=masquerade chain=srcnat out-interface=sfp-sfpplus1 |
|
add action=masquerade chain=srcnat |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=80 \ |
|
protocol=tcp to-addresses=10.100.1.24 to-ports=80 |
|
add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.101 \ |
|
dst-port=80 protocol=tcp to-addresses=10.100.1.24 to-ports=80 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=80 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=80 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=25 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=25 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=25 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=25 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=143 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=143 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=143 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=143 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=993 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=993 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=993 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=993 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=587 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=587 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=587 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=587 |
|
add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.101 \ |
|
dst-port=443 protocol=tcp to-addresses=10.100.1.24 to-ports=443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=24 \ |
|
protocol=tcp to-addresses=10.100.1.24 to-ports=22 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=21 \ |
|
protocol=tcp to-addresses=10.100.1.10 to-ports=21 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=443 \ |
|
protocol=tcp to-addresses=10.100.1.24 to-ports=443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=443 \ |
|
protocol=tcp to-addresses=10.100.1.24 to-ports=443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=80 \ |
|
protocol=tcp to-addresses=10.100.1.24 to-ports=80 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=443 \ |
|
protocol=tcp to-addresses=10.100.1.51 to-ports=443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=1433 \ |
|
protocol=tcp to-addresses=10.100.1.25 to-ports=1433 |
|
add action=dst-nat chain=dstnat comment="rnd SQL Server 2016" dst-address=\ |
|
117.102.73.102 dst-port=1434 protocol=tcp to-addresses=10.100.1.75 \ |
|
to-ports=1433 |
|
add action=dst-nat chain=dstnat comment="Zabbiz agenet active" dst-address=\ |
|
117.102.73.102 dst-port=10051 protocol=tcp to-addresses=10.100.1.42 \ |
|
to-ports=10051 |
|
add action=dst-nat chain=dstnat comment="rnd SQL Server 2022" dst-address=\ |
|
117.102.73.102 dst-port=1437 protocol=tcp to-addresses=10.100.1.77 \ |
|
to-ports=1433 |
|
add action=dst-nat chain=dstnat comment="rnd SQL Server 2016" dst-address=\ |
|
117.102.73.102 dst-port=1436 protocol=tcp to-addresses=10.100.1.76 \ |
|
to-ports=1433 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5432 \ |
|
protocol=tcp to-addresses=10.100.1.25 to-ports=5432 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=8080 \ |
|
protocol=tcp to-addresses=10.100.1.27 to-ports=8080 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5434 \ |
|
protocol=tcp to-addresses=10.100.1.27 to-ports=5434 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=30443 \ |
|
protocol=tcp to-addresses=10.100.1.59 to-ports=30443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=6143 \ |
|
protocol=tcp to-addresses=10.100.1.59 to-ports=6143 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=13443 \ |
|
protocol=tcp to-addresses=10.100.1.57 to-ports=13443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=6443 \ |
|
protocol=tcp to-addresses=10.100.1.51 to-ports=6443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=80 \ |
|
protocol=tcp to-addresses=10.100.1.51 to-ports=80 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=7443 \ |
|
protocol=tcp to-addresses=10.100.1.51 to-ports=7443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.100 dst-port=2443 \ |
|
protocol=tcp to-addresses=10.100.1.51 to-ports=2443 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=5433 \ |
|
protocol=tcp to-addresses=10.100.1.27 to-ports=5432 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=25 \ |
|
protocol=tcp to-addresses=10.100.1.28 to-ports=25 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=993 \ |
|
protocol=tcp to-addresses=10.100.1.28 to-ports=993 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=587 \ |
|
protocol=tcp to-addresses=10.100.1.28 to-ports=587 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=465 \ |
|
protocol=tcp to-addresses=10.100.1.28 to-ports=465 |
|
add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ |
|
dst-address=117.102.73.99 dst-port=25 protocol=tcp to-addresses=\ |
|
10.100.1.40 to-ports=25 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=995 \ |
|
protocol=tcp to-addresses=10.100.1.40 to-ports=995 |
|
add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ |
|
dst-address=117.102.73.99 dst-port=995 protocol=tcp to-addresses=\ |
|
10.100.1.40 to-ports=995 |
|
add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ |
|
dst-port=25 protocol=udp to-addresses=10.100.1.40 to-ports=25 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=587 \ |
|
protocol=tcp to-addresses=10.100.1.40 to-ports=587 |
|
add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ |
|
dst-address=117.102.73.99 dst-port=587 protocol=tcp to-addresses=\ |
|
10.100.1.40 to-ports=587 |
|
add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ |
|
dst-port=587 protocol=udp to-addresses=10.100.1.40 to-ports=587 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=389 \ |
|
protocol=tcp to-addresses=10.100.1.40 to-ports=389 |
|
add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ |
|
dst-address=117.102.73.99 dst-port=389 protocol=tcp to-addresses=\ |
|
10.100.1.40 to-ports=389 |
|
add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ |
|
dst-port=389 protocol=udp to-addresses=10.100.1.40 to-ports=389 |
|
add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ |
|
dst-port=143 protocol=udp to-addresses=10.100.1.40 to-ports=143 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=143 \ |
|
protocol=tcp to-addresses=10.100.1.40 to-ports=143 |
|
add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ |
|
dst-address=117.102.73.99 dst-port=143 protocol=tcp to-addresses=\ |
|
10.100.1.40 to-ports=143 |
|
add action=dst-nat chain=dstnat disabled=yes dst-address=117.102.73.102 \ |
|
dst-port=110 protocol=udp to-addresses=10.100.1.40 to-ports=110 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.102 dst-port=110 \ |
|
protocol=tcp to-addresses=10.100.1.40 to-ports=110 |
|
add action=dst-nat chain=dstnat comment=geonet.co.id disabled=yes \ |
|
dst-address=117.102.73.99 dst-port=110 protocol=tcp to-addresses=\ |
|
10.100.1.40 to-ports=110 |
|
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ |
|
10.100.1.24 dst-port=443 out-interface=ether1 protocol=tcp src-address=\ |
|
192.168.0.0/24 |
|
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ |
|
10.100.1.100 dst-port=443 out-interface=ether1 protocol=tcp src-address=\ |
|
192.168.0.0/24 |
|
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\ |
|
10.100.1.24 dst-port=80 out-interface=ether1 protocol=tcp src-address=\ |
|
192.168.0.0/24 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=995 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=995 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=995 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=995 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.101 dst-port=465 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=465 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=465 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=465 |
|
add action=dst-nat chain=dstnat dst-address=117.102.73.99 dst-port=993 \ |
|
protocol=tcp to-addresses=10.100.1.76 to-ports=993 |
|
add action=masquerade chain=srcnat comment=hairpin-10.100.1-nginx-443 \ |
|
dst-address=10.100.1.24 dst-port=443 protocol=tcp src-address=\ |
|
10.100.1.0/24 |
|
add action=masquerade chain=srcnat comment=hairpin-10.100.1-nginx-80 \ |
|
dst-address=10.100.1.24 dst-port=80 protocol=tcp src-address=\ |
|
10.100.1.0/24 |
|
add action=masquerade chain=srcnat comment=hairpin-vpn-nginx-443 dst-address=\ |
|
10.100.1.24 dst-port=443 protocol=tcp src-address=100.100.1.0/24 |
|
add action=masquerade chain=srcnat comment=hairpin-vpn-nginx-80 dst-address=\ |
|
10.100.1.24 dst-port=80 protocol=tcp src-address=100.100.1.0/24 |
|
add action=dst-nat chain=dstnat comment=ssh-mikrotik-public-102 dst-address=\ |
|
117.102.73.102 dst-port=255 protocol=tcp to-addresses=10.100.1.1 \ |
|
to-ports=255 |
|
add action=dst-nat chain=dstnat comment=ssh-nginx-public-22 disabled=yes \ |
|
dst-address=117.102.73.102 dst-port=22 protocol=tcp to-addresses=\ |
|
10.100.1.24 to-ports=22 |
|
add action=masquerade chain=srcnat comment=hairpin-ssh-mikrotik dst-address=\ |
|
10.100.1.1 dst-port=255 protocol=tcp src-address=10.100.1.0/24 |
|
add action=masquerade chain=srcnat comment=hairpin-ssh-nginx disabled=yes \ |
|
dst-address=10.100.1.24 dst-port=22 protocol=tcp src-address=\ |
|
10.100.1.0/24 |
|
add action=masquerade chain=srcnat comment=hairpin-ssh-mikrotik-office \ |
|
dst-address=10.100.1.1 dst-port=255 protocol=tcp src-address=\ |
|
192.168.0.0/24 |
|
add action=masquerade chain=srcnat comment=hairpin-ssh-nginx-office disabled=\ |
|
yes dst-address=10.100.1.24 dst-port=22 protocol=tcp src-address=\ |
|
192.168.0.0/24 |
|
add action=dst-nat chain=dstnat comment=ssh-public-db dst-address=\ |
|
117.102.73.102 dst-port=225 protocol=tcp to-addresses=10.100.1.25 \ |
|
to-ports=22 |
|
add action=masquerade chain=srcnat comment=hairpin-ssh-public-db dst-address=\ |
|
10.100.1.25 dst-port=22 protocol=tcp src-address=10.100.1.0/24 |
|
add action=masquerade chain=srcnat comment=hairpin-ssh-public-db-office \ |
|
dst-address=10.100.1.25 dst-port=22 protocol=tcp src-address=\ |
|
192.168.0.0/24 |
|
/ip route |
|
add check-gateway=ping comment="hybrid failover ISP1 primary" disabled=no \ |
|
distance=1 dst-address=0.0.0.0/0 gateway=117.102.73.97 pref-src="" \ |
|
routing-table=main scope=30 suppress-hw-offload=no target-scope=10 |
|
add check-gateway=none comment="hybrid ISP2" disabled=no distance=1 \ |
|
dst-address=0.0.0.0/0 gateway=192.168.1.1 pref-src="" routing-table=\ |
|
"KE ISP 2" scope=30 suppress-hw-offload=no target-scope=10 |
|
add check-gateway=ping comment="hybrid failover ISP2 backup" disabled=no \ |
|
distance=2 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main |
|
add check-gateway=none comment="hybrid ISP1" disabled=no distance=1 \ |
|
dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table="KE ISP 1" |
|
add comment="hybrid ISP1 WAN lan" distance=1 dst-address=117.102.73.96/29 \ |
|
gateway=ether1 routing-table="KE ISP 1" |
|
add comment="hybrid ISP2 WAN lan" distance=1 dst-address=192.168.1.0/24 \ |
|
gateway=sfp-sfpplus1 routing-table="KE ISP 2" |
|
add comment="hybrid office lan ISP1" distance=1 dst-address=192.168.0.0/24 \ |
|
gateway=office routing-table="KE ISP 1" |
|
add comment="hybrid office lan ISP2" distance=1 dst-address=192.168.0.0/24 \ |
|
gateway=office routing-table="KE ISP 2" |
|
/ip service |
|
set telnet disabled=yes |
|
set ftp disabled=yes |
|
set www disabled=yes |
|
set ssh port=255 |
|
set api disabled=yes |
|
set winbox address=10.100.1.0/24,192.168.0.0/24 |
|
set api-ssl disabled=yes |
|
/ppp aaa |
|
set use-radius=yes |
|
/ppp secret |
|
add local-address=10.100.1.1 name=rbsetiawan remote-address=10.100.1.220 |
|
add local-address=10.100.1.1 name=asobari remote-address=10.100.1.225 |
|
add local-address=10.100.1.1 name=uabdurrohman remote-address=10.100.1.226 |
|
add local-address=10.100.1.1 name=trachman remote-address=10.100.1.227 |
|
add local-address=10.100.1.1 name=test remote-address=10.100.1.211 |
|
add local-address=10.100.1.1 name=dpradana remote-address=10.100.1.228 |
|
add local-address=10.100.1.1 name=ataufik remote-address=10.100.1.229 |
|
add local-address=10.100.1.1 name=awrahajeng remote-address=10.100.1.230 |
|
/radius |
|
add address=10.100.1.40 domain=gisportal.id service=ppp src-address=\ |
|
10.100.1.1 |
|
/routing rule |
|
add action=lookup comment="hybrid ISP1" routing-mark="KE ISP 1" table=\ |
|
"KE ISP 1" |
|
add action=lookup comment="hybrid ISP2" routing-mark="KE ISP 2" table=\ |
|
"KE ISP 2" |
|
/snmp |
|
set enabled=yes |
|
/system clock |
|
set time-zone-name=Asia/Jakarta |
|
/system scheduler |
|
add comment="hybrid scheduler" interval=1m name=hybrid-sync-mode on-event=\ |
|
hybrid-sync-mode policy=\ |
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ |
|
start-date=jun/13/2026 start-time=17:41:40 |
|
add comment="Monitor latency ISP1 vs ISP2" interval=2m name=latency-monitor \ |
|
on-event=latency-monitor policy=\ |
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ |
|
start-time=startup |
|
add comment="Backup config ke QNAP 10.100.1.10" interval=1d name=\ |
|
nas-backup-daily on-event=nas-backup policy=\ |
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \ |
|
start-date=jun/15/2026 start-time=03:00:00 |
|
/system script |
|
add dont-require-permissions=yes name=hybrid-set-mode-both-up owner=admin \ |
|
policy=read,write,test source="\r\ |
|
\n/ip firewall mangle enable [find comment=\"hybrid office PCC ISP1\"]\r\ |
|
\n/ip firewall mangle enable [find comment=\"hybrid office PCC ISP2\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP1\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP2\"]\r\ |
|
\n/ip firewall mangle enable [find comment=\"hybrid route ISP1\"]\r\ |
|
\n/ip firewall mangle enable [find comment=\"hybrid route ISP2\"]\r\ |
|
\n:log info \"HYBRID: mode BOTH-UP (office PCC 50/50, VPN failover only)\"\ |
|
\r\ |
|
\n" |
|
add dont-require-permissions=yes name=hybrid-set-mode-isp1-down owner=admin \ |
|
policy=read,write,test source="\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid office PCC ISP1\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid office PCC ISP2\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP1\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP2\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid route ISP1\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid route ISP2\"]\r\ |
|
\n:log info \"HYBRID: mode ISP1-DOWN\"\r\ |
|
\n" |
|
add dont-require-permissions=yes name=hybrid-set-mode-isp2-down owner=admin \ |
|
policy=read,write,test source="\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid office PCC ISP2\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP2\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid route ISP2\"]\r\ |
|
\n/ip firewall mangle enable [find comment=\"hybrid office PCC ISP1\"]\r\ |
|
\n/ip firewall mangle disable [find comment=\"hybrid vpn PCC ISP1\"]\r\ |
|
\n/ip firewall mangle enable [find comment=\"hybrid route ISP1\"]\r\ |
|
\n:log info \"HYBRID: mode ISP2-DOWN (office ISP1 only, VPN failover only)\ |
|
\"\r\ |
|
\n" |
|
add dont-require-permissions=yes name=hybrid-sync-mode owner=admin policy=\ |
|
read,write,test,sniff source="\r\ |
|
\n:local up1 false\r\ |
|
\n:local up2 false\r\ |
|
\n:local ok1 0\r\ |
|
\n:local ok2 0\r\ |
|
\n:for i from=1 to=3 do={\r\ |
|
\n :local r1 [/ping 117.102.73.97 count=1 as-value]\r\ |
|
\n :if ([:typeof (\$r1->\"time\")] != \"nothing\") do={ :set ok1 (\$ok1 +\ |
|
\_1) }\r\ |
|
\n :local r2 [/ping 192.168.1.1 count=1 as-value]\r\ |
|
\n :if ([:typeof (\$r2->\"time\")] != \"nothing\") do={ :set ok2 (\$ok2 +\ |
|
\_1) }\r\ |
|
\n}\r\ |
|
\n:if (\$ok1 >= 2) do={ :set up1 true }\r\ |
|
\n:if (\$ok2 >= 2) do={ :set up2 true }\r\ |
|
\n:if (\$up1 && \$up2) do={\r\ |
|
\n /system script run hybrid-set-mode-both-up\r\ |
|
\n} else={\r\ |
|
\n :if (!\$up1) do={\r\ |
|
\n /system script run hybrid-set-mode-isp1-down\r\ |
|
\n } else={\r\ |
|
\n :if (!\$up2) do={\r\ |
|
\n /system script run hybrid-set-mode-isp2-down\r\ |
|
\n }\r\ |
|
\n }\r\ |
|
\n}\r\ |
|
\n" |
|
add dont-require-permissions=yes name=latency-monitor owner=admin policy=\ |
|
read,write,test,sniff source="\r\ |
|
\n:local hysteresis 10ms\r\ |
|
\n:global bestWan\r\ |
|
\n:global isp1Latency\r\ |
|
\n:global isp2Latency\r\ |
|
\n:global isp1Loss\r\ |
|
\n:global isp2Loss\r\ |
|
\n:if ([:typeof \$bestWan] = \"nothing\") do={ :set bestWan \"isp1\" }\r\ |
|
\n:local t1 0ms\r\ |
|
\n:local t2 0ms\r\ |
|
\n:local ok1 0\r\ |
|
\n:local ok2 0\r\ |
|
\n:local i 0\r\ |
|
\n:do {\r\ |
|
\n :local r1 [/ping 117.102.73.97 count=1 as-value]\r\ |
|
\n :if ([:typeof (\$r1->\"time\")] != \"nothing\") do={\r\ |
|
\n :set t1 (\$t1 + (\$r1->\"time\"))\r\ |
|
\n :set ok1 (\$ok1 + 1)\r\ |
|
\n }\r\ |
|
\n :local r2 [/ping 192.168.1.1 count=1 as-value]\r\ |
|
\n :if ([:typeof (\$r2->\"time\")] != \"nothing\") do={\r\ |
|
\n :set t2 (\$t2 + (\$r2->\"time\"))\r\ |
|
\n :set ok2 (\$ok2 + 1)\r\ |
|
\n }\r\ |
|
\n :set i (\$i + 1)\r\ |
|
\n} while=(\$i < 5)\r\ |
|
\n:local avg1 9999ms\r\ |
|
\n:local avg2 9999ms\r\ |
|
\n:local loss1 100\r\ |
|
\n:local loss2 100\r\ |
|
\n:if (\$ok1 > 0) do={\r\ |
|
\n :set avg1 (\$t1 / \$ok1)\r\ |
|
\n :set loss1 (100 - ((\$ok1 * 100) / 5))\r\ |
|
\n}\r\ |
|
\n:if (\$ok2 > 0) do={\r\ |
|
\n :set avg2 (\$t2 / \$ok2)\r\ |
|
\n :set loss2 (100 - ((\$ok2 * 100) / 5))\r\ |
|
\n}\r\ |
|
\n:set isp1Latency \$avg1\r\ |
|
\n:set isp2Latency \$avg2\r\ |
|
\n:set isp1Loss \$loss1\r\ |
|
\n:set isp2Loss \$loss2\r\ |
|
\n:local newBest \$bestWan\r\ |
|
\n:if (\$loss1>49 && \$loss2>49) do={\r\ |
|
\n :log warning \"Latency Monitor: kedua ISP loss tinggi, tetap \$bestWan\ |
|
\"\r\ |
|
\n} else={\r\ |
|
\n :if (\$loss2>49) do={ :set newBest \"isp1\" } else={\r\ |
|
\n :if (\$loss1>49) do={ :set newBest \"isp2\" } else={\r\ |
|
\n :if (\$avg1 < (\$avg2 - \$hysteresis)) do={ :set newBest \"isp1\" \ |
|
} else={\r\ |
|
\n :if (\$avg1 > (\$avg2 + \$hysteresis)) do={ :set newBest \"isp2\ |
|
\" }\r\ |
|
\n }\r\ |
|
\n }\r\ |
|
\n }\r\ |
|
\n :set bestWan \$newBest\r\ |
|
\n}\r\ |
|
\n:log info (\"Latency Monitor: ISP1=\" . [:tostr \$avg1] . \" loss=\" . \ |
|
\$loss1 . \"% | ISP2=\" . [:tostr \$avg2] . \" loss=\" . \$loss2 . \"% | b\ |
|
est=\" . \$bestWan)\r\ |
|
\n" |
|
add dont-require-permissions=yes name=nas-backup owner=admin policy=\ |
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\ |
|
\r\ |
|
\n:global nasFtpHost \"10.100.1.10\"\r\ |
|
\n:global nasFtpUser \"admin\"\r\ |
|
\n:global nasFtpPass \"REDACTED_SEE_NAS_VAULT\"\r\ |
|
\n:global nasFtpPath \"mainpve/mikrotik\"\r\ |
|
\n:local bname \"nas-latest\"\r\ |
|
\n:log info \"NAS backup: mulai\"\r\ |
|
\n/system backup save name=\$bname\r\ |
|
\n/export file=\$bname\r\ |
|
\n:delay 2s\r\ |
|
\n/tool fetch address=\$nasFtpHost mode=ftp user=\$nasFtpUser password=\$n\ |
|
asFtpPass src-path=(\$bname . \".backup\") dst-path=(\$nasFtpPath . \"/\" \ |
|
. \$bname . \".backup\") upload=yes\r\ |
|
\n/tool fetch address=\$nasFtpHost mode=ftp user=\$nasFtpUser password=\$n\ |
|
asFtpPass src-path=(\$bname . \".rsc\") dst-path=(\$nasFtpPath . \"/\" . \ |
|
\$bname . \".rsc\") upload=yes\r\ |
|
\n/file remove (\$bname . \".backup\")\r\ |
|
\n/file remove (\$bname . \".rsc\")\r\ |
|
\n:log info \"NAS backup: selesai\"\r\ |
|
\n" |
|
/tool netwatch |
|
add comment="hybrid monitor ISP1" down-script=hybrid-set-mode-isp1-down host=\ |
|
117.102.73.97 interval=10s timeout=3s type=simple up-script=\ |
|
hybrid-sync-mode |
|
add comment="hybrid monitor ISP2" down-script=hybrid-set-mode-isp2-down host=\ |
|
192.168.1.1 interval=10s timeout=3s type=simple up-script=\ |
|
hybrid-sync-mode
|
|
|