You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
72 lines
2.4 KiB
72 lines
2.4 KiB
# Hybrid PREP — bypass laptop + office→server (tanpa PCC/Netwatch) |
|
# Usage: .\scripts\apply-hybrid-prep-mikrotik.ps1 |
|
# Hapus prep: /ip firewall mangle remove [find comment~"hybrid"] |
|
|
|
param( |
|
[string]$HostAddr = "192.168.0.1", |
|
[string]$MgmtLaptopIp = "192.168.0.33", |
|
[switch]$DryRun |
|
) |
|
|
|
$SshPort = 255 |
|
$SshUser = "admin" |
|
$KeyFile = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik" |
|
$RscLocal = Join-Path (Split-Path $PSScriptRoot -Parent) "server\mikrotik-hybrid-prep.rsc" |
|
$RscRemote = "hybrid-prep.rsc" |
|
|
|
$SshBase = @( |
|
"-o", "BatchMode=yes", |
|
"-o", "ConnectTimeout=15", |
|
"-o", "IdentitiesOnly=yes", |
|
"-i", $KeyFile, |
|
"-o", "PubkeyAcceptedAlgorithms=rsa-sha2-256,rsa-sha2-512,ssh-rsa", |
|
"-o", "StrictHostKeyChecking=accept-new", |
|
"-m", "hmac-sha1", |
|
"-p", $SshPort, |
|
"${SshUser}@${HostAddr}" |
|
) |
|
|
|
function Invoke-Mikrotik { |
|
param([string]$Cmd) |
|
if ($DryRun) { Write-Host "[dry-run] $Cmd"; return $true } |
|
$out = & ssh @SshBase $Cmd 2>&1 |
|
foreach ($line in $out) { Write-Host $line } |
|
return ($LASTEXITCODE -eq 0) |
|
} |
|
|
|
Write-Host "=== Hybrid PREP (bukan Fase 2 penuh) ===" |
|
Write-Host "SSH: ${SshUser}@${HostAddr}:${SshPort}" |
|
Write-Host "Mgmt IP: $MgmtLaptopIp" |
|
Write-Host "Hanya: mgmt bypass + office-to-server bypass" |
|
Write-Host "TIDAK: PCC, Netwatch, routing rules hybrid" |
|
Write-Host "" |
|
|
|
if (-not $DryRun) { |
|
if ($MgmtLaptopIp -ne "192.168.0.33") { |
|
Write-Warning "Edit mikrotik-hybrid-prep.rsc jika IP laptop bukan 192.168.0.33" |
|
} |
|
$existing = & ssh @SshBase '/ip firewall mangle print where comment~"hybrid"' 2>&1 |
|
if ($existing -match "hybrid mgmt bypass") { |
|
Write-Host "Prep sudah ada — skip import." |
|
} else { |
|
& scp -P $SshPort -o MACs=hmac-sha1 -o StrictHostKeyChecking=accept-new ` |
|
-i $KeyFile $RscLocal "${SshUser}@${HostAddr}:$RscRemote" |
|
if ($LASTEXITCODE -ne 0) { throw "SCP gagal" } |
|
Invoke-Mikrotik "/import file=$RscRemote" | Out-Null |
|
Invoke-Mikrotik "/file remove $RscRemote" | Out-Null |
|
} |
|
} |
|
|
|
@( |
|
'/ip firewall mangle print where comment~"hybrid"', |
|
'/routing rule print', |
|
'/tool netwatch print', |
|
'/ip route print where comment~"failover"', |
|
'/ping 8.8.8.8 count=2' |
|
) | ForEach-Object { |
|
Write-Host "--- $_ ---" |
|
Invoke-Mikrotik $_ | Out-Null |
|
Write-Host "" |
|
} |
|
|
|
Write-Host "Selesai. Failover Fase 1 tetap aktif. Fase 2 penuh: apply-hybrid-mikrotik.ps1"
|
|
|