You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
270 lines
11 KiB
270 lines
11 KiB
JARINGAN GEONET — ACUAN STANDAR KONEKSI (BASELINE) |
|
================================================== |
|
Tanggal snapshot : 2026-06-13 |
|
Status : AKTIF — Failover Fase 1 (ISP1 primary + ISP2 backup, check-gateway) |
|
Router : MikroTik CCR2004-1G-12S+2XS, RouterOS 7.5, hostname MikroTik |
|
Sumber data : Live SSH 10.100.1.1, apply-failover-mikrotik.ps1, tes ping 2026-06-13 |
|
|
|
Dokumen ini adalah BACKUP ACUAN untuk: |
|
1. Internet user kantor & VPN (failover ISP1→ISP2) |
|
2. Komunikasi user (office/VPN) ↔ server (10.100.1.0/24) |
|
3. Restore jika perubahan routing merusak koneksi |
|
|
|
Detail audit lengkap (NAT publik, firewall, VPN): server/mikrotik-audit.txt |
|
Desain failover: server/mikrotik-failover-design.txt |
|
Script deploy failover: scripts/apply-failover-mikrotik.ps1 |
|
Rollback ke single-ISP: scripts/rollback-single-wan-mikrotik.ps1 |
|
Backup Fase 1 (restore setelah Hybrid gagal): server/mikrotik-failover-phase1-backup.txt |
|
|
|
|
|
A. PRINSIP KONEKSI STANDAR |
|
-------------------------- |
|
|
|
Internet keluar ISP1 utama (ether1); ISP2 standby failover otomatis. |
|
Route primary : 0.0.0.0/0 → 117.102.73.97 distance=1 check-gateway=ping [failover ISP1 primary] |
|
Route backup : 0.0.0.0/0 → 192.168.1.1 distance=2 check-gateway=ping [failover ISP2 backup] |
|
ISP2 interface: sfp-sfpplus1 ENABLED, DHCP bound (192.168.1.52/24) |
|
Saat ISP1 GW down → traffic user otomatis ke ISP2; recovery otomatis ke ISP1 |
|
|
|
User kantor dan server saling routing lewat Mikrotik tanpa policy routing khusus: |
|
Office 192.168.0.0/24 ──► Mikrotik ──► Server 10.100.1.0/24 (langsung, bridge) |
|
Server 10.100.1.0/24 ──► Mikrotik ──► Office / Internet |
|
|
|
NAT keluar internet: |
|
masquerade out-interface=ether1 (utama) |
|
masquerade out-interface=sfp-sfpplus1 (siap ISP2, tidak aktif) |
|
masquerade tanpa out-interface (catch-all, rule #2 — AKTIF) |
|
|
|
Hairpin NAT: user kantor akses domain publik diarahkan ke server internal |
|
192.168.0.0/24 → 10.100.1.24:80/443 dan 10.100.1.100:443 |
|
|
|
|
|
B. SEGMEN JARINGAN & GATEWAY |
|
---------------------------- |
|
|
|
| Segment | Network | Gateway Mikrotik | Bridge/Interface | DHCP | |
|
|------------------|-----------------|------------------|-----------------------|-------------| |
|
| Server LAN | 10.100.1.0/24 | 10.100.1.1 | server | — | |
|
| Office kantor | 192.168.0.0/24 | 192.168.0.1 | office / sfp-sfpplus10| dhcp1 (4w3d)| |
|
| VPN remote | 100.100.1.0/24 | 100.100.1.0 | vpn | dhcp2 (10m) | |
|
| IBM (inactive) | 192.168.2.0/24 | 192.168.2.1 | vlan2004 | relay (off) | |
|
| WAN publik | 117.102.73.96/29| 117.102.73.97 | ether1 | — | |
|
|
|
DNS DHCP office & VPN : 203.142.82.222, 203.142.84.222 |
|
|
|
|
|
C. ALUR KONEKSI USER → INTERNET |
|
------------------------------- |
|
|
|
C1. User kantor (192.168.0.x) |
|
PC |
|
→ DHCP Mikrotik (pool 192.168.0.2–254, gateway 192.168.0.1) |
|
→ Forward Mikrotik (tanpa mangle PCC — semua rule dual-wan DIHAPUS) |
|
→ NAT masquerade out-interface=ether1 |
|
→ Internet sebagai IP publik 117.102.73.x |
|
|
|
C2. User VPN remote (100.100.1.x) |
|
Client SSTP/PPTP (port 443) |
|
→ Autentikasi RADIUS → AD 10.100.1.40 (domain gisportal.id) |
|
→ IP dari dhcp2 |
|
→ NAT masquerade → ether1 → Internet |
|
|
|
C3. User PPP dengan IP server (10.100.1.2xx) |
|
VPN dial-in → IP tetap di LAN server → Internet via masquerade ether1 |
|
|
|
|
|
D. ALUR KONEKSI USER → SERVER |
|
----------------------------- |
|
|
|
D1. User kantor → server internal (langsung) |
|
192.168.0.x → 10.100.1.x |
|
Routing: connected route 10.100.1.0/24 via bridge server |
|
Tidak ada firewall block umum office→server (kecuali host terisolasi) |
|
Contoh host: .24 reverse proxy, .25 DB, .40 AD, .41 web, .42 Zabbix, .10 NAS |
|
|
|
D2. User kantor → layanan publik (hairpin) |
|
Browser ke gisportal.id / geonet.co.id |
|
→ dst-nat inbound tetap ke ether1 (tidak diubah) |
|
→ Hairpin NAT mengarahkan 192.168.0.x ke 10.100.1.24 tanpa keluar WAN |
|
|
|
D3. User VPN → server |
|
100.100.1.x → 10.100.1.0/24 (full access server LAN) |
|
|
|
D4. Akses management Mikrotik dari user |
|
SSH : port 255, subnet 10.100.1.0/24 dan 192.168.0.0/24 |
|
Winbox: port 8291, subnet yang sama |
|
|
|
|
|
E. HOST PENTING (USER ↔ SERVER) |
|
------------------------------- |
|
|
|
| Host | IP server | IP office (jika ada) | Akses user kantor | |
|
|-------------------|----------------|----------------------|--------------------------| |
|
| Mikrotik | 10.100.1.1 | 192.168.0.1 | SSH/Winbox | |
|
| NAS QNAP | 10.100.1.10 | 192.168.0.10 | https://192.168.0.10 | |
|
| SwOS CRS326 | 10.100.1.2 | — | http://10.100.1.2 | |
|
| SwOS CSS610 | 10.100.1.3 | — | http://10.100.1.3 | |
|
| Reverse proxy | 10.100.1.24 | — | Hairpin / internal | |
|
| Main Database | 10.100.1.25 | — | Port app (1433/5432) | |
|
| AD-LDAP | 10.100.1.40 | — | LDAP/RADIUS | |
|
| Main Webserver | 10.100.1.41 | — | IIS internal | |
|
| Zabbix | 10.100.1.42 | — | Monitoring | |
|
|
|
SSH ke server: lihat server/host.txt |
|
|
|
|
|
F. KONFIGURASI MIKROTIK SAAT INI (ELEMEN KRITIS) |
|
------------------------------------------------ |
|
|
|
F1. WAN — failover Fase 1 |
|
ether1 : RUNNING — ISP utama, IP publik 117.102.73.96/29 |
|
sfp-sfpplus1 : RUNNING — ISP kedua standby failover |
|
dhcp-client sfp-sfpplus1 : ENABLED, bound 192.168.1.52/24, add-default-route=no |
|
|
|
F2. Routing |
|
Main table: |
|
failover ISP1 primary : 0.0.0.0/0 → 117.102.73.97 distance=1 check-gateway=ping [ACTIVE] |
|
failover ISP2 backup : 0.0.0.0/0 → 192.168.1.1 distance=2 check-gateway=ping [STANDBY] |
|
Connected (otomatis): |
|
10.100.1.0/24 → server |
|
192.168.0.0/24 → office |
|
100.100.1.0/32 → vpn |
|
117.102.73.x → ether1 |
|
Legacy (tidak dipakai failover user): |
|
0.0.0.0/0 → 192.168.1.1 routing-table=KE ISP 2 [ada, bukan main failover] |
|
Routing rules dual-wan : TIDAK ADA |
|
|
|
F3. Mangle — tidak ada policy routing dual-WAN |
|
Rule dual-wan (PCC, route mark, server force ISP1) : DIHAPUS |
|
Rule office-to-server-bypass : DIHAPUS |
|
Rule load-balance lama (pra dual-WAN) : ADA, semua DISABLED (X) |
|
— tidak mempengaruhi traffic; jangan di-enable tanpa review |
|
|
|
F4. NAT srcnat (baseline) |
|
#0 masquerade out-interface=ether1 — enabled |
|
#1 masquerade out-interface=sfp-sfpplus1 — enabled (ISP2 mati, tidak terpakai) |
|
#2 masquerade (catch-all) — enabled |
|
#3–#5 Hairpin NAT — enabled |
|
|
|
F5. Port fisik → bridge (ringkas) |
|
server bridge : sfp-sfpplus2,3,5 + vlan3,10,11,12,99 |
|
office bridge : sfp-sfpplus10,11 + vlan2010,2012 |
|
NAS : sfp-sfpplus5 → server |
|
Switch kantor : sfp-sfpplus10,11 → office |
|
|
|
|
|
G. VERIFIKASI KONEKTIVITAS (2026-06-13) |
|
--------------------------------------- |
|
|
|
Tes dari laptop 192.168.0.33 (Ethernet) dan Mikrotik 10.100.1.1: |
|
|
|
| Target | Laptop | Mikrotik | Catatan | |
|
|---------------|:------:|:--------:|----------------------------------| |
|
| 10.100.1.1 | OK | OK | Gateway server | |
|
| 10.100.1.10 | OK | OK | NAS 10GbE | |
|
| 10.100.1.2 | OK | OK | SwOS switch | |
|
| 10.100.1.3 | OK | OK | SwOS switch | |
|
| 10.100.1.24 | timeout| timeout | ICMP diblokir host (bukan routing)| |
|
| 192.168.0.1 | OK | OK | Gateway office | |
|
| 192.168.0.10 | OK | OK | NAS 1GbE | |
|
| 100.100.1.0 | OK | OK | Gateway VPN (bukan .1) | |
|
| 8.8.8.8 | OK | OK | Internet ~14 ms | |
|
|
|
Kesimpulan verifikasi: routing office↔server dan internet NORMAL pada baseline ini. |
|
|
|
|
|
H. RESTORE KE BASELINE (JIKA KONEKSI RUSAK) |
|
------------------------------------------- |
|
|
|
Gejala umum setelah eksperimen dual-WAN: |
|
- User kantor tidak bisa internet (~50% packet loss) |
|
- User kantor tidak bisa akses 10.100.1.x |
|
- Server traffic ter-mark ke routing table KE ISP 1/2 |
|
|
|
Langkah restore: |
|
|
|
1. SSH ke Mikrotik: |
|
.\scripts\ssh-mikrotik.ps1 |
|
# dari office: admin@192.168.0.1 port 255 |
|
|
|
2. Jalankan rollback otomatis: |
|
.\scripts\rollback-single-wan-mikrotik.ps1 |
|
|
|
3. Verifikasi: |
|
/ip route print where dst-address=0.0.0.0/0 |
|
/routing rule print |
|
/ip firewall mangle print |
|
/ping 8.8.8.8 count=3 |
|
/ping 192.168.0.1 count=2 |
|
|
|
4. Tes dari laptop kantor: |
|
ping 192.168.0.1 |
|
ping 10.100.1.1 |
|
ping 10.100.1.10 |
|
ping 8.8.8.8 |
|
|
|
File rollback : server/mikrotik-rollback-single-wan.rsc |
|
|
|
Perintah manual (jika script tidak bisa): |
|
/interface ethernet set sfp-sfpplus1 disabled=yes |
|
/ip dhcp-client set [find interface=sfp-sfpplus1] disabled=yes |
|
/ip firewall mangle remove [find comment~"dual-wan"] |
|
/ip firewall mangle remove [find comment="office-to-server-bypass"] |
|
/routing rule remove [find comment~"dual-wan"] |
|
/ip route remove [find comment~"dual-wan ISP1"] |
|
/ip firewall nat set 2 disabled=no |
|
|
|
|
|
I. BACKUP CONFIG ROUTER |
|
----------------------- |
|
|
|
Export config periodik (disarankan sebelum perubahan besar): |
|
|
|
.\scripts\ssh-mikrotik.ps1 -Command "/export file=backup-existing-network-geonet" |
|
|
|
Download backup: |
|
scp -P 255 -m hmac-sha1 -i %USERPROFILE%\.ssh\id_rsa_mikrotik \ |
|
admin@10.100.1.1:backup-existing-network-geonet.rsc server/ |
|
|
|
|
|
J. YANG TIDAK BOLEH DIUBAH TANPA REVIEW |
|
--------------------------------------- |
|
|
|
- dst-nat rules ke 10.100.1.x (layanan publik gisportal.id / geonet.co.id) |
|
- Hairpin NAT office → 10.100.1.24 |
|
- DHCP pool & gateway office (192.168.0.1) |
|
- Firewall DROP server tertentu ke internet langsung |
|
- RADIUS VPN → 10.100.1.40 |
|
|
|
Eksperimen Hybrid Fase 2: lihat server/mikrotik-hybrid-design.txt. |
|
Restore ke Fase 1 jika gagal: scripts/restore-failover-phase1-mikrotik.ps1 |
|
Acuan backup Fase 1: server/mikrotik-failover-phase1-backup.txt |
|
|
|
|
|
L. RESTORE FASE 1 (SETELAH HYBRID FASE 2 GAGAL) |
|
----------------------------------------------- |
|
|
|
.\scripts\restore-failover-phase1-mikrotik.ps1 |
|
|
|
Menghapus: mangle/routing/netwatch hybrid |
|
Mengembalikan: route failover ISP1+ISP2 dengan check-gateway |
|
BUKAN menghapus failover — tetap dual-WAN failover mode. |
|
|
|
|
|
K. REFERENSI FILE TERKAIT |
|
------------------------- |
|
|
|
server/existing-network-geonet.txt ← dokumen ini (acuan koneksi) |
|
server/mikrotik-failover-phase1-backup.txt ← BACKUP Fase 1 terverifikasi |
|
server/backup-failover-phase1.rsc ← export penuh dari router |
|
server/mikrotik-failover-design.txt ← desain failover |
|
server/mikrotik-hybrid-design.txt ← Fase 2 Hybrid (rencana) |
|
server/mikrotik-audit.txt ← audit perimeter |
|
server/host.txt ← SSH ke semua host |
|
server/mikrotik-failover.rsc |
|
server/mikrotik-restore-failover-phase1.rsc |
|
server/mikrotik-rollback-single-wan.rsc |
|
scripts/ssh-mikrotik.ps1 |
|
scripts/apply-failover-mikrotik.ps1 |
|
scripts/restore-failover-phase1-mikrotik.ps1 |
|
scripts/rollback-single-wan-mikrotik.ps1
|
|
|