You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
429 lines
15 KiB
429 lines
15 KiB
DESAIN HYBRID MIKROTIK — FAILOVER + PCC + NETWATCH + CHECK-GATEWAY |
|
================================================================== |
|
Tanggal desain : 2026-06-13 |
|
Router : MikroTik CCR2004-1G-12S+2XS, RouterOS 7.5, 10.100.1.1 |
|
Baseline aktif : Failover Fase 1 (server/mikrotik-failover-phase1-backup.txt) |
|
Prasyarat : Fase 1 failover AKTIF & terverifikasi |
|
Restore point : server/mikrotik-failover-phase1-backup.txt (jika Fase 2 gagal) |
|
|
|
Status: RENCANA — BELUM DIEKSEKUSI |
|
|
|
Tujuan gabungan: |
|
1. Pembagian beban internet user (PCC ~50/50) saat ISP1 DAN ISP2 sehat |
|
2. Failover otomatis saat salah satu ISP down (tanpa blackhole 50%) |
|
3. Server 10.100.1.0/24 tetap ISP1; dst-nat publik tetap ether1 |
|
|
|
|
|
1. PERBANDINGAN TIGA DESAIN |
|
--------------------------- |
|
|
|
| Aspek | Failover saja | PCC saja (lama) | Hybrid (ini) | |
|
|--------------------------|--------------------|-------------------|---------------------| |
|
| File acuan | mikrotik-failover | mikrotik-dual-wan | mikrotik-hybrid | |
|
| Bagi beban 2 ISP | Tidak | Ya | Ya (kondisional) | |
|
| Failover ISP down | Ya | Tidak | Ya | |
|
| Satu download = 2 ISP | Tidak | Tidak | Tidak | |
|
| Health check | check-gateway | Tidak | check-gateway + Netwatch | |
|
| Risiko blackhole 50% | Tidak | Tinggi | Rendah (PCC off saat ISP down) | |
|
| Kompleksitas | Rendah | Sedang | Tinggi | |
|
|
|
|
|
2. TIGA MODE OPERASI (STATE MACHINE) |
|
------------------------------------ |
|
|
|
```mermaid |
|
stateDiagram-v2 |
|
[*] --> CheckHealth: Boot / monitor |
|
|
|
CheckHealth --> BothUp: ISP1 GW OK dan ISP2 GW OK |
|
CheckHealth --> ISP1Down: ISP1 GW gagal |
|
CheckHealth --> ISP2Down: ISP2 GW gagal |
|
CheckHealth --> BothDown: Keduanya gagal |
|
|
|
state BothUp { |
|
[*] --> PCC_On |
|
PCC_On: PCC 50/50 office+VPN |
|
PCC_On: Route KE ISP 1/2 + check-gateway |
|
} |
|
|
|
state ISP1Down { |
|
[*] --> Failover_ISP2 |
|
Failover_ISP2: PCC OFF semua |
|
Failover_ISP2: 100% traffic user via ISP2 |
|
} |
|
|
|
state ISP2Down { |
|
[*] --> ISP1_Only |
|
ISP1_Only: PCC ISP2 OFF |
|
ISP1_Only: 100% traffic user via ISP1 |
|
} |
|
|
|
state BothDown { |
|
[*] --> NoInternet |
|
NoInternet: Internet user mati total |
|
} |
|
|
|
BothUp --> ISP1Down: Netwatch ISP1 down |
|
BothUp --> ISP2Down: Netwatch ISP2 down |
|
ISP1Down --> BothUp: ISP1 recovery + ISP2 OK |
|
ISP2Down --> BothUp: ISP2 recovery + ISP1 OK |
|
``` |
|
|
|
|
|
3. TOPOLOGI & ALUR TRAFFIC |
|
-------------------------- |
|
|
|
### 3.1 Mode BOTH UP — load balance aktif |
|
|
|
```mermaid |
|
flowchart TB |
|
subgraph users [Sumber traffic] |
|
OFF[office 192.168.0.x] |
|
VPN[vpn 100.100.1.x] |
|
SRV[server 10.100.1.0/24] |
|
end |
|
|
|
subgraph mangle [Mangle prerouting — urutan penting] |
|
R0[0 server force ISP1] |
|
R1[1 office→server bypass accept] |
|
R2[2 office PCC 2/0 → ISP1] |
|
R3[3 office PCC 2/1 → ISP2] |
|
R4[4 vpn PCC 2/0 → ISP1] |
|
R5[5 vpn PCC 2/1 → ISP2] |
|
R6[6 route mark KE ISP 1] |
|
R7[7 route mark KE ISP 2] |
|
end |
|
|
|
subgraph tables [Routing tables] |
|
T1[KE ISP 1<br/>0.0.0.0/0 → 117.102.73.97<br/>check-gateway=ping] |
|
T2[KE ISP 2<br/>0.0.0.0/0 → 192.168.1.1<br/>check-gateway=ping] |
|
end |
|
|
|
OFF --> R1 |
|
OFF --> R2 |
|
OFF --> R3 |
|
VPN --> R4 |
|
VPN --> R5 |
|
SRV --> R0 |
|
|
|
R0 --> T1 |
|
R2 --> R6 --> T1 |
|
R3 --> R7 --> T2 |
|
R4 --> R6 --> T1 |
|
R5 --> R7 --> T2 |
|
R1 --> SRV |
|
|
|
T1 --> NAT1[NAT ether1] |
|
T2 --> NAT2[NAT sfp-sfpplus1] |
|
``` |
|
|
|
### 3.2 Mode ISP1 DOWN — failover murni |
|
|
|
```mermaid |
|
flowchart LR |
|
U[User office/VPN] --> M[PCC DISABLED<br/>Netwatch script] |
|
M --> RT[Main table] |
|
RT -->|distance=2 ACTIVE| ISP2[ISP2 sfp-sfpplus1] |
|
ISP2 --> NAT[NAT masquerade] |
|
SRV[Server 10.100.1.x] -.->|force ISP1 — internet server mati| X[ISP1 down] |
|
``` |
|
|
|
### 3.3 Mode ISP2 DOWN — ISP1 only |
|
|
|
```mermaid |
|
flowchart LR |
|
U[User office/VPN] --> M[PCC ISP2 rules DISABLED] |
|
M --> PCC1[PCC ISP1 only / atau semua ke ISP1] |
|
PCC1 --> T1[KE ISP 1] |
|
T1 --> ISP1[ether1] |
|
``` |
|
|
|
|
|
4. KOMPONEN KONFIGURASI |
|
----------------------- |
|
|
|
### 4.1 Interface & DHCP ISP2 |
|
|
|
/interface ethernet set sfp-sfpplus1 disabled=no |
|
/ip dhcp-client set [find interface=sfp-sfpplus1] \ |
|
add-default-route=no use-peer-dns=no disabled=no |
|
|
|
DHCP tidak menambah default route otomatis — route dikontrol manual/script. |
|
|
|
|
|
### 4.2 Routing tables & rules |
|
|
|
Tabel (sudah ada di router): KE ISP 1, KE ISP 2 |
|
|
|
Route per tabel (dengan check-gateway): |
|
hybrid ISP1: |
|
dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table="KE ISP 1" |
|
check-gateway=ping distance=1 |
|
|
|
hybrid ISP2: |
|
dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table="KE ISP 2" |
|
check-gateway=ping distance=1 |
|
|
|
Route failover main table (cadangan saat PCC off): |
|
hybrid failover primary: |
|
dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table=main |
|
check-gateway=ping distance=1 |
|
|
|
hybrid failover backup: |
|
dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main |
|
check-gateway=ping distance=2 |
|
|
|
Routing rules: |
|
routing-mark=KE ISP 1 → lookup table KE ISP 1 comment=hybrid ISP1 |
|
routing-mark=KE ISP 2 → lookup table KE ISP 2 comment=hybrid ISP2 |
|
|
|
|
|
### 4.3 Mangle — urutan rule (KRITIS) |
|
|
|
| # | Comment | Chain | Aksi | Kondisi enable | |
|
|---|---------------------------------|-------------|-------------------|------------------| |
|
| 0 | hybrid mgmt bypass laptop | prerouting | accept | Selalu (192.168.0.33) | |
|
| 1 | hybrid server force ISP1 | prerouting | mark-routing ISP1 | Selalu | |
|
| 2 | hybrid office-to-server-bypass | prerouting | accept | Selalu | |
|
| 3 | hybrid office PCC ISP1 | prerouting | PCC 2/0 | Mode BothUp | |
|
| 4 | hybrid office PCC ISP2 | prerouting | PCC 2/1 | Mode BothUp | |
|
| 5 | hybrid vpn PCC ISP1 | prerouting | PCC 2/0 | Mode BothUp | |
|
| 6 | hybrid vpn PCC ISP2 | prerouting | PCC 2/1 | Mode BothUp | |
|
| 7 | hybrid route ISP1 | prerouting | mark-routing | Mode BothUp | |
|
| 8 | hybrid route ISP2 | prerouting | mark-routing | Mode BothUp | |
|
|
|
Rule #0 mgmt bypass: laptop admin 192.168.0.33 tidak kena PCC — SSH stabil saat apply. |
|
Rule #2 mencegah traffic office→10.100.1.0/24 ter-mark PCC. |
|
|
|
Saat ISP2 down: disable rule #3, #5, #7 (PCC/route ISP2). |
|
Saat ISP1 down: disable rule #2–#7 (semua PCC); failover via main table. |
|
Saat both up: enable rule #2–#7. |
|
|
|
|
|
### 4.4 NAT |
|
|
|
Tetap seperti baseline: |
|
masquerade out-interface=ether1 |
|
masquerade out-interface=sfp-sfpplus1 |
|
masquerade catch-all (rule #2) — enabled |
|
|
|
Jangan disable catch-all NAT (berbeda dengan dual-wan.rsc lama). |
|
|
|
|
|
### 4.5 Netwatch — monitor gateway |
|
|
|
Monitor ISP1: |
|
host=117.102.73.97 interval=10s timeout=3s |
|
comment=hybrid monitor ISP1 |
|
|
|
Monitor ISP2: |
|
host=192.168.1.1 interval=10s timeout=3s |
|
comment=hybrid monitor ISP2 |
|
|
|
Script terhubung ke Netwatch memanggil fungsi mode: |
|
hybrid-set-mode-both-up |
|
hybrid-set-mode-isp1-down |
|
hybrid-set-mode-isp2-down |
|
|
|
### 4.5b Management bypass — laptop admin |
|
|
|
Rule paling atas (tidak pernah di-disable oleh script mode): |
|
/ip firewall mangle add chain=prerouting action=accept \ |
|
src-address=192.168.0.33 comment="hybrid mgmt bypass laptop" place-before=0 |
|
|
|
SSH saat apply/maintenance: admin@192.168.0.1 port 255 |
|
Checklist: server/mikrotik-hybrid-apply-checklist.txt |
|
|
|
|
|
### 4.6 Logika script mode (konsep RouterOS) |
|
|
|
hybrid-set-mode-both-up: |
|
enable mangle [find comment~"hybrid office PCC"] |
|
enable mangle [find comment~"hybrid vpn PCC"] |
|
enable mangle [find comment~"hybrid route ISP"] |
|
log: "HYBRID: mode BOTH-UP — PCC enabled" |
|
|
|
hybrid-set-mode-isp1-down: |
|
disable mangle [find comment~"hybrid office PCC"] |
|
disable mangle [find comment~"hybrid vpn PCC"] |
|
disable mangle [find comment~"hybrid route ISP"] |
|
log: "HYBRID: mode ISP1-DOWN — failover ISP2, PCC off" |
|
(traffic user mengikuti main table → backup route ISP2) |
|
|
|
hybrid-set-mode-isp2-down: |
|
disable mangle [find comment~"hybrid office PCC ISP2"] |
|
disable mangle [find comment~"hybrid vpn PCC ISP2"] |
|
disable mangle [find comment~"hybrid route ISP2"] |
|
enable mangle [find comment~"hybrid office PCC ISP1"] |
|
enable mangle [find comment~"hybrid vpn PCC ISP1"] |
|
enable mangle [find comment~"hybrid route ISP1"] |
|
log: "HYBRID: mode ISP2-DOWN — ISP1 only" |
|
|
|
Scheduler cadangan (setiap 1 menit): hybrid-sync-mode |
|
Deteksi GW pakai :len [/ping ...] — bukan packet-loss=0 (bug Fase 2 pertama). |
|
|
|
|
|
5. APA YANG DI-HYBRID — APA YANG TIDAK |
|
-------------------------------------- |
|
|
|
LOAD BALANCE (PCC, saat both up): |
|
[x] Internet user kantor 192.168.0.x (~50/50 per koneksi) |
|
[x] Internet user VPN 100.100.1.x (~50/50 per koneksi) |
|
|
|
FAILOVER (saat salah satu ISP down): |
|
[x] User kantor & VPN → ISP yang masih hidup (100%) |
|
[x] Office ↔ server 10.100.1.x (bypass rule, tidak terpengaruh PCC) |
|
|
|
TIDAK DI-HYBRID: |
|
[ ] Satu koneksi/download = gabungan kecepatan ISP1+ISP2 |
|
[ ] dst-nat inbound 117.102.73.x (tetap ether1; mati jika ISP1 down) |
|
[ ] Server 10.100.1.x internet keluar (tetap ISP1; mati jika ISP1 down) |
|
[ ] Hairpin NAT berbasis ether1 saat ISP1 down |
|
|
|
|
|
6. MENGAPA PERLU TIGA LAPIS (PCC + check-gateway + Netwatch) |
|
------------------------------------------------------------ |
|
|
|
| Lapisan | Fungsi | |
|
|------------------|-----------------------------------------------------| |
|
| PCC | Bagi koneksi user ke ISP1/ISP2 saat keduanya sehat | |
|
| check-gateway | Route per tabel ISP inactive jika GW tidak pingable | |
|
| Netwatch | Disable PCC saat ISP down — cegah mark ke tabel mati | |
|
|
|
check-gateway saja TIDAK cukup: koneksi sudah ter-mark PCC ISP2 tetap |
|
diarahkan ke tabel KE ISP 2 meski route inactive → blackhole. |
|
|
|
Netwatch saja TIDAK cukup: perlu check-gateway agar route failover |
|
main table akurat. |
|
|
|
PCC saja TIDAK cukup: sudah terbukti merusak internet kantor (Jun 2026). |
|
|
|
|
|
7. PRA-SYARAT EKSEKUSI |
|
---------------------- |
|
|
|
Wajib selesai SEBELUM hybrid: |
|
[ ] Failover dasar (mikrotik-failover-design) sudah dites — ISP2 backup OK |
|
[ ] sfp-sfpplus1 link UP, DHCP bound (mis. 192.168.1.52/24) |
|
[ ] Ping 117.102.73.97 dan 192.168.1.1 dari Mikrotik OK |
|
[ ] Internet via masing-masing ISP terbukti (tes terpisah) |
|
[ ] Export backup: /export file=pre-hybrid-backup |
|
[ ] Restore Fase 1 siap: restore-failover-phase1-mikrotik.ps1 |
|
[ ] Backup Fase 1: server/mikrotik-failover-phase1-backup.txt |
|
[ ] Buka 2 sesi SSH ke 192.168.0.1:255 (cadangan) |
|
[ ] Aktifkan Safe Mode Winbox/SSH (disarankan) |
|
[ ] IP laptop admin di hybrid.rsc: 192.168.0.33 |
|
[ ] Checklist lengkap: server/mikrotik-hybrid-apply-checklist.txt |
|
|
|
Jangan lompat langsung ke hybrid dari baseline single-ISP. |
|
|
|
|
|
8. TAHAP EKSEKUSI (BERURUTAN) |
|
----------------------------- |
|
|
|
Fase 0 — Backup baseline |
|
/export file=pre-hybrid-backup |
|
|
|
Fase 1 — Failover dasar (dokumen terpisah) |
|
Aktifkan ISP2, route main check-gateway distance 1+2 |
|
Tes: cabut ISP1 → user internet via ISP2 → restore |
|
|
|
Fase 2 — Routing table + rules hybrid |
|
Tambah route KE ISP 1/2 dengan check-gateway |
|
Tambah routing rules hybrid ISP1/ISP2 |
|
Belum enable PCC |
|
|
|
Fase 3 — Mangle bypass + server force |
|
Rule server force ISP1 + office-to-server-bypass |
|
Tes: office→10.100.1.x tetap OK |
|
|
|
Fase 4 — PCC (awal disabled ISP2 half) |
|
Enable PCC ISP1 only → tes internet office |
|
Enable PCC ISP2 + route marks → tes both ISP |
|
|
|
Fase 5 — Netwatch + script mode |
|
Pasang monitor GW + script enable/disable PCC |
|
Tes failover: ISP1 down → PCC off → ISP2 100% |
|
Tes failover: ISP2 down → PCC ISP2 off → ISP1 100% |
|
Tes recovery: kedua ISP up → PCC on lagi |
|
|
|
Fase 6 — Dokumentasi produksi |
|
Update existing-network-geonet.txt jika diterima sebagai standar baru |
|
|
|
|
|
9. ROLLBACK |
|
----------- |
|
|
|
Restore ke Failover Fase 1 (RECOMMENDED jika Hybrid gagal): |
|
.\scripts\restore-failover-phase1-mikrotik.ps1 |
|
Acuan: server/mikrotik-failover-phase1-backup.txt |
|
|
|
Rollback ke single-ISP (hanya jika perlu hapus failover sepenuhnya): |
|
.\scripts\rollback-single-wan-mikrotik.ps1 |
|
|
|
Manual restore Fase 1: |
|
/import file=restore-failover-phase1.rsc |
|
|
|
|
|
10. RISIKO & MITIGASI |
|
--------------------- |
|
|
|
| Risiko | Dampak | Mitigasi | |
|
|--------------------------------|---------------------------|---------------------------------| |
|
| Flapping ISP1/ISP2 | Internet putus-nyambung | Netwatch timeout+interval; hysteresis scheduler | |
|
| PCC on saat ISP2 down | ~50% koneksi gagal | Netwatch WAJIB disable PCC ISP2 | |
|
| Office tidak bisa ke server | Produksi terganggu | Rule bypass place-before PCC | |
|
| dst-nat mati ISP1 down | Layanan publik down | Komunikasi ke stakeholder; monitor | |
|
| Config terlalu kompleks | Sulit troubleshoot | Comment prefix "hybrid"; dokumentasi mode | |
|
| Script RouterOS error | Mode salah | Scheduler koreksi + log | |
|
|
|
|
|
11. VERIFIKASI SETELAH IMPLEMENTASI |
|
----------------------------------- |
|
|
|
# Mode & route |
|
/ip route print detail where comment~"hybrid" |
|
/routing rule print |
|
/ip firewall mangle print |
|
|
|
# Netwatch |
|
/tool netwatch print |
|
|
|
# Tes dari Mikrotik |
|
/ping 8.8.8.8 count=5 |
|
/ping 192.168.0.1 count=2 |
|
/ping 10.100.1.10 count=2 |
|
|
|
# Tes dari laptop kantor (192.168.0.x) |
|
ping 8.8.8.8 |
|
ping 10.100.1.1 |
|
ping 10.100.1.10 |
|
tracert 8.8.8.8 (lihat keluar ISP1 atau ISP2) |
|
|
|
# Tes failover manual |
|
- Simulasi ISP1 down → semua user via ISP2, PCC off |
|
- Simulasi ISP2 down → semua user via ISP1, PCC ISP2 off |
|
- Restore → PCC 50/50 kembali |
|
|
|
|
|
12. FILE YANG AKAN DIBUAT SAAT EKSEKUSI (BELUM ADA) |
|
--------------------------------------------------- |
|
|
|
server/mikrotik-hybrid.rsc — config + script (mgmt bypass + sync fix) |
|
server/mikrotik-hybrid-apply-checklist.txt — checklist apply aman |
|
scripts/apply-hybrid-mikrotik.ps1 — deploy (default SSH 192.168.0.1) |
|
|
|
Rollback tetap: |
|
scripts/rollback-single-wan-mikrotik.ps1 |
|
server/mikrotik-rollback-single-wan.rsc |
|
|
|
|
|
13. REFERENSI |
|
------------- |
|
|
|
server/mikrotik-hybrid-design.txt — dokumen ini |
|
server/existing-network-geonet.txt — baseline produksi (single-ISP) |
|
server/mikrotik-failover-design.txt — Fase 1 failover (prasyarat) |
|
server/mikrotik-dual-wan.rsc — PCC lama TANPA Netwatch (JANGAN pakai langsung) |
|
server/mikrotik-audit.txt — audit perimeter lengkap |
|
scripts/rollback-single-wan-mikrotik.ps1
|
|
|