You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
304 lines
12 KiB
304 lines
12 KiB
AUDIT INFRASTRUKTUR — MIKROTIK ROUTER |
|
====================================== |
|
Tanggal audit : 2026-06-13 |
|
Sumber : server/host.txt, config-check.rsc |
|
Metode : SSH langsung (key-based) |
|
|
|
IP/SSH : 10.100.1.1 | .\scripts\ssh-mikrotik.ps1 |
|
| ssh -i ~/.ssh/id_rsa_mikrotik -o IdentitiesOnly=yes -m hmac-sha1 admin@10.100.1.1 -p 255 |
|
Hostname : MikroTik |
|
Model : CCR2004-1G-12S+2XS (ARM64, serial HDD08647CP6) |
|
OS : RouterOS 7.5 (stable), build Aug/30/2022 |
|
Uptime : ~1 minggu 14 jam (saat audit) |
|
Resource : RAM 3811 MiB free / 4032 MiB | CPU load ~2% | Disk 8.6 MiB free / 129 MiB |
|
|
|
Peran host: gateway internet, firewall perimeter, NAT publik, DHCP office/VPN, |
|
segmentasi VLAN server/office, VPN remote (SSTP/PPTP), RADIUS ke AD. |
|
|
|
|
|
A. INTERFACE & SEGMENTASI JARINGAN |
|
----------------------------------- |
|
|
|
A1. WAN |
|
| Interface | Peran | Status | |
|
|-----------|--------------------|----------| |
|
| ether1 | WAN ke ISP utama | Running | |
|
| sfp-sfpplus1 | ISP kedua (DHCP) | Disabled | |
|
|
|
A2. Bridge utama |
|
| Bridge | Fungsi | IP gateway | |
|
|---------|--------------------------------|---------------| |
|
| server | Jaringan server/datacenter | 10.100.1.1/24 | |
|
| office | Jaringan user kantor + switch | 192.168.0.1/24 (juga di sfp-sfpplus10) | |
|
| vpn | Pool VPN remote dial-in | 100.100.1.1/32 | |
|
|
|
A3. Port fisik → bridge |
|
| Port | Keterangan | Bridge | Status | |
|
|----------------|---------------------|--------|-------------| |
|
| sfp-sfpplus2 | DELL-main-network | server | Running | |
|
| sfp-sfpplus3 | DELL | server | Running | |
|
| sfp-sfpplus4 | IBM | server | Inactive | |
|
| sfp-sfpplus5 | NAS | server | Running | |
|
| sfp-sfpplus6 | — | server | Inactive | |
|
| sfp-sfpplus10 | switch server | office | Running | |
|
| sfp-sfpplus11 | switch production | office | Running | |
|
| sfp-sfpplus12 | switch adm | office | Disabled | |
|
|
|
A4. VLAN |
|
| VLAN | VLAN-ID | Parent port | Bridge | Keterangan | |
|
|----------|---------|----------------|--------|-------------------| |
|
| vlan3 | 3 | sfp-sfpplus12 | server | Admin segment | |
|
| vlan10 | 10 | sfp-sfpplus10 | server | Server VLAN | |
|
| vlan11 | 11 | sfp-sfpplus11 | server | Production VLAN | |
|
| vlan12 | 12 | sfp-sfpplus12 | server | Admin VLAN | |
|
| vlan99 | 99 | sfp-sfpplus10 | server | — | |
|
| vlan2010 | 2010 | sfp-sfpplus10 | office | Office VLAN | |
|
| vlan2012 | 2012 | sfp-sfpplus12 | office | Office admin VLAN | |
|
| vlan2004 | 2001 | sfp-sfpplus4 | office | IBM (inactive) | |
|
|
|
Catatan interface: |
|
- sfp-sfpplus12 + vlan3/12/2012 sering link flap (100+ link-downs). |
|
- vlan2004 & sfp-sfpplus4 inactive — network IBM tidak aktif. |
|
- sfp-sfpplus1 (ISP 2) disabled; load-balance disiapkan tapi tidak aktif. |
|
|
|
|
|
B. IP ADDRESS |
|
------------- |
|
|
|
B1. IP publik (semua di ether1, blok ISP 117.102.73.96/29, gateway .97) |
|
| IP | Keterangan | Fungsi utama | |
|
|--------------------|------------------|---------------------------------------| |
|
| 117.102.73.102/29 | gisportal.id | IP utama — web, DB, mail, LDAP, Zabbix | |
|
| 117.102.73.101/32 | Not Set | Mail server (→ 10.100.1.76) | |
|
| 117.102.73.100/32 | dev.gisportal.id | Dev/K8s (.51, .57, .59) | |
|
| 117.102.73.98/32 | geonet.co.id | Domain geonet | |
|
| 117.102.73.99/32 | geonet.co.id | HTTP/HTTPS → reverse proxy | |
|
|
|
B2. IP internal |
|
| Network | Interface | Gateway | Pengguna | |
|
|-----------------|---------------|-------------|-----------------------------| |
|
| 10.100.1.0/24 | server | 10.100.1.1 | Server/infrastruktur | |
|
| 192.168.0.0/24 | office | 192.168.0.1 | User kantor (DHCP) | |
|
| 100.100.1.0/24 | vpn | 100.100.1.1 | User VPN remote (DHCP) | |
|
| 192.168.2.0/24 | vlan2004 | 192.168.2.1 | Network IBM (DHCP relay) | |
|
|
|
B3. Routing aktif |
|
Default route : 0.0.0.0/0 → 117.102.73.97 via ether1 (ISP utama) |
|
Backup route : 0.0.0.0/0 → 192.168.1.1 via routing-table "KE ISP 2" (load-balance disabled) |
|
|
|
|
|
C. INTERNET UNTUK USER |
|
---------------------- |
|
|
|
C1. User kantor (192.168.0.x) |
|
Alur: |
|
PC → DHCP Mikrotik (dhcp1, pool 192.168.0.2–254, lease 4 minggu) |
|
→ Gateway 192.168.0.1 |
|
→ DNS 203.142.82.222 / 203.142.84.222 |
|
→ NAT masquerade out-interface=ether1 |
|
→ Internet sebagai IP publik 117.102.73.x |
|
|
|
DHCP reservation (contoh): switch .8/.9, multimedia .4, WAVLINK .20, dll. |
|
|
|
Hairpin NAT: user kantor yang akses domain publik di-redirect ke server internal |
|
192.168.0.0/24 → 10.100.1.24:80/443 (tanpa keluar internet) |
|
|
|
C2. User VPN remote (100.100.1.x) |
|
Alur: |
|
User → SSTP (port 443) / PPTP |
|
→ Autentikasi RADIUS ke AD 10.100.1.40 (domain gisportal.id) |
|
→ IP 100.100.1.x via DHCP (dhcp2, lease 10 menit) |
|
→ NAT masquerade → internet |
|
|
|
SSTP : enabled (port 443, auth pap/chap/mschap) |
|
PPTP : enabled (tidak aman — disarankan nonaktifkan) |
|
|
|
C3. User PPP dengan IP server (10.100.1.2xx) |
|
Akun PPP lokal (rbsetiawan, asobari, uabdurrohman, trachman, test, dpradana, ataufik) |
|
mendapat IP tetap di jaringan server (10.100.1.220–229). |
|
|
|
Alur: |
|
VPN dial-in → IP 10.100.1.2xx (langsung di LAN server) |
|
→ Akses penuh ke 10.100.1.0/24 |
|
→ Internet via masquerade ether1 |
|
|
|
[KEAMANAN] Password PPP disimpan plain-text di /ppp secret — pertimbangkan |
|
migrasi ke RADIUS-only atau hapus akun tidak terpakai. |
|
|
|
|
|
D. NAT (PORT FORWARDING PUBLIK → INTERNAL) |
|
------------------------------------------ |
|
Total aturan NAT : 55 (dst-nat aktif: 27, forward filter: 21) |
|
|
|
D1. IP 117.102.73.102 (gisportal.id) — port forward aktif |
|
| Port | → Internal | Layanan | |
|
|-------|------------------|----------------------| |
|
| 21 | 10.100.1.10:21 | FTP | |
|
| 24 | 10.100.1.24:22 | SSH (disabled) | |
|
| 25 | 10.100.1.40:25 | SMTP | |
|
| 80 | 10.100.1.24:80 | HTTP reverse proxy | |
|
| 110 | 10.100.1.40:110 | POP3 | |
|
| 143 | 10.100.1.40:143 | IMAP | |
|
| 389 | 10.100.1.40:389 | LDAP | |
|
| 443 | 10.100.1.24:443 | HTTPS reverse proxy | |
|
| 587 | 10.100.1.40:587 | SMTP submission | |
|
| 995 | 10.100.1.40:995 | POP3S | |
|
| 1433 | 10.100.1.25:1433 | SQL Server utama | |
|
| 1434 | 10.100.1.75:1433 | SQL Server RND 2016 | |
|
| 1436 | 10.100.1.76:1433 | SQL Server RND 2016 | |
|
| 1437 | 10.100.1.77:1433 | SQL Server RND 2022 | |
|
| 5432 | 10.100.1.25:5432 | PostgreSQL | |
|
| 5433 | 10.100.1.27:5432 | PostgreSQL alt | |
|
| 5434 | 10.100.1.27:5434 | PostgreSQL alt | |
|
| 10051 | 10.100.1.42:10051| Zabbix active checks | |
|
|
|
D2. IP 117.102.73.99 (geonet.co.id) |
|
| Port | → Internal | |
|
|-------|------------------| |
|
| 80 | 10.100.1.24:80 | |
|
| 443 | 10.100.1.24:443 | |
|
| 8080 | 10.100.1.27:8080 | (disabled) | |
|
|
|
D3. IP 117.102.73.100 (dev.gisportal.id) |
|
| Port | → Internal | |
|
|--------|--------------------| |
|
| 443 | 10.100.1.51:443 | |
|
| 2443 | 10.100.1.51:2443 | |
|
| 6443 | 10.100.1.51:6443 | |
|
| 7443 | 10.100.1.51:7443 | |
|
| 6143 | 10.100.1.59:6143 | |
|
| 13443 | 10.100.1.57:13443 | |
|
| 30443 | 10.100.1.59:30443 | (disabled) | |
|
|
|
D4. IP 117.102.73.101 (Not Set — mail) |
|
| Port | → Internal | |
|
|-------|------------------| |
|
| 25 | 10.100.1.76:25 | |
|
| 80 | 10.100.1.76:80 | |
|
| 143 | 10.100.1.76:143 | |
|
| 465 | 10.100.1.76:465 | |
|
| 587 | 10.100.1.76:587 | |
|
| 993 | 10.100.1.76:993 | |
|
| 995 | 10.100.1.76:995 | |
|
|
|
D5. Source NAT (keluar) |
|
| Aturan | Fungsi | |
|
|-------------------------------------|---------------------------------| |
|
| masquerade out-interface=ether1 | Semua traffic keluar → IP publik | |
|
| masquerade out-interface=sfp-sfpplus1 | ISP kedua (siap, belum aktif) | |
|
| masquerade (tanpa out-interface) | Catch-all — perlu review | |
|
| Hairpin NAT ×3 | Loopback 192.168.0.x → 10.100.1.24/100 | |
|
|
|
|
|
E. FIREWALL & KEAMANAN |
|
---------------------- |
|
|
|
E1. Server diblokir akses langsung ke internet (out-interface=ether1) |
|
| IP server | Status rule | |
|
|--------------|-------------| |
|
| 10.100.1.100 | DROP aktif | |
|
| 10.100.1.88 | DROP aktif | |
|
| 10.100.1.84 | DROP aktif | |
|
| 10.100.1.91 | DROP aktif | |
|
| 10.100.1.61 | DROP aktif | |
|
| 10.100.1.72 | DROP aktif | |
|
| 10.100.1.80 | DROP aktif | |
|
|
|
E2. Server dengan rule DROP disabled (boleh keluar langsung saat ini) |
|
10.100.1.24 (reverse proxy), .25 (DB), .40 (AD), .51 (dev), .53/.55/.56/.58 |
|
|
|
E3. User kantor diisolasi |
|
192.168.0.57 — DROP forward (total) |
|
192.168.0.64 — DROP forward (total) |
|
|
|
E4. DDoS detection |
|
Chain detect-ddos: rate-limit 32/s per src+dst, auto-block 10 menit |
|
|
|
E5. Layanan management |
|
| Layanan | Port | Akses dibatasi ke | |
|
|----------|------|--------------------------------------| |
|
| SSH | 255 | 10.100.1.0/24, 192.168.0.0/24 | |
|
| Winbox | — | 10.100.1.0/24, 192.168.0.0/24 | |
|
| Telnet | — | Disabled | |
|
| FTP/WWW/API | — | Disabled | |
|
|
|
E6. SSH key |
|
User admin: key RSA terdaftar (admin@DESKTOP-RRJ9G01-mikrotik) |
|
Login: .\scripts\ssh-mikrotik.ps1 (key-based, IdentitiesOnly=yes) |
|
|
|
|
|
F. HUBUNGAN DENGAN HOST LAIN (dari repo server-connection) |
|
---------------------------------------------------------- |
|
| Host internal | IP | Keterangan NAT/firewall | |
|
|-----------------|--------------|------------------------------------------| |
|
| Reverse_proxy | 10.100.1.24 | dst-nat :80/:443 dari .102/.99 | |
|
| Main_Database | 10.100.1.25 | dst-nat :1433/:5432 dari .102 | |
|
| AD-LDAP | 10.100.1.40 | dst-nat mail/LDAP; RADIUS untuk VPN | |
|
| Zabbix | 10.100.1.42 | dst-nat :10051 dari .102 | |
|
| Main_Webserver | 10.100.1.41 | Tidak ada dst-nat langsung ke .41 | |
|
|
|
Diagram: |
|
Internet/User |
|
| |
|
v |
|
[ Mikrotik 10.100.1.1 ] ← audit ini |
|
| |
|
+---> 192.168.0.0/24 (user kantor, DHCP) |
|
+---> 100.100.1.0/24 (VPN remote, RADIUS→AD) |
|
+---> 10.100.1.0/24 (server LAN) |
|
| |
|
+---> .24 reverse proxy (pintu masuk HTTPS publik) |
|
+---> .25 database |
|
+---> .40 AD/LDAP/mail |
|
+---> .41 webserver |
|
+---> .42 Zabbix |
|
|
|
|
|
G. ANALISA & REKOMENDASI |
|
------------------------ |
|
|
|
Yang berjalan baik: |
|
1. Segmentasi jelas: server / office / VPN / VLAN. |
|
2. Multi-IP publik per layanan/domain. |
|
3. Hairpin NAT untuk user kantor akses domain internal. |
|
4. VPN terintegrasi RADIUS AD (domain gisportal.id). |
|
5. DDoS detection aktif. |
|
6. SSH key-based auth untuk admin (port 255, subnet terbatas). |
|
|
|
Perlu perhatian: |
|
1. [KRITIS] Banyak port sensitif expose publik (1433, 5432, 25, 389, 143). |
|
Pastikan service-level auth kuat; pertimbangkan batasi source IP. |
|
2. [KRITIS] Password PPP plain-text di router — migrasi ke RADIUS-only. |
|
3. [KEAMANAN] PPTP masih enabled — nonaktifkan, gunakan SSTP saja. |
|
4. [STABILITAS] sfp-sfpplus12 + VLAN admin sering flap — cek kabel/SFP/switch. |
|
5. [STABILITAS] IBM vlan2004 inactive — DHCP relay invalid. |
|
6. [ROUTING] Load-balance ISP 2 disiapkan tapi semua rule disabled. |
|
7. [NAT] Rule masquerade tanpa out-interface — review dampaknya. |
|
8. [DISK] Free HDD hanya 8.6 MiB / 129 MiB — monitor, backup config rutin. |
|
9. [FIREWALL] Rule DROP server utama (.24/.25/.40) saat ini disabled — |
|
server infra bisa keluar internet langsung. |
|
|
|
|
|
PERINTAH VERIFIKASI ULANG |
|
------------------------- |
|
# SSH ke Mikrotik |
|
.\scripts\ssh-mikrotik.ps1 |
|
.\scripts\ssh-mikrotik.ps1 -Command "/system resource print" |
|
|
|
# Interface & address |
|
.\scripts\ssh-mikrotik.ps1 -Command "/interface print stats" |
|
.\scripts\ssh-mikrotik.ps1 -Command "/ip address print" |
|
|
|
# Routing & NAT |
|
.\scripts\ssh-mikrotik.ps1 -Command "/ip route print where active=yes" |
|
.\scripts\ssh-mikrotik.ps1 -Command "/ip firewall nat print where disabled=no" |
|
|
|
# DHCP & VPN |
|
.\scripts\ssh-mikrotik.ps1 -Command "/ip dhcp-server lease print" |
|
.\scripts\ssh-mikrotik.ps1 -Command "/ppp active print" |
|
|
|
# Firewall |
|
.\scripts\ssh-mikrotik.ps1 -Command "/ip firewall filter print where chain=forward" |
|
|
|
# Export config (backup) |
|
.\scripts\ssh-mikrotik.ps1 -Command "/export file=backup-audit"
|
|
|