System Overview — MikroTik Gateway

Last updated: 2026-07-06
Source: Live SSH audit + backups/mikrotik-export-2026-07-06.rsc

Perangkat

Item	Nilai
Hostname	MikroTik
Model	CCR2004-1G-12S+2XS (ARM64, 4 CPU)
RouterOS	7.5 stable
RAM	4032 MiB (~3820 free)
Serial	HDD08647CP6

Diagram tingkat tinggi

                    Internet
                        │
         ┌──────────────┴──────────────┐
         │ ISP1 Biznet (ether1)        │ ISP2 IDBiz (sfp-sfpplus1, DHCP)
         │ GW 117.102.73.97            │ GW 192.168.1.1
         └──────────────┬──────────────┘
                        │
              ┌─────────▼─────────┐
              │  MikroTik .1    │
              │  hybrid failover │
              │  + PCC office    │
              └─────────┬─────────┘
        ┌───────────────┼───────────────┐
        │               │               │
   bridge:server   bridge:office    bridge:vpn
   10.100.1.0/24   192.168.0.0/24   100.100.1.0/24
        │               │               │
   Proxmox, DB,     User kantor,     SSTP/PPTP
   Mailcow .28,     MULTIMEDIA .14   RADIUS→AD .40
   nginx .24, ...

Segment jaringan

Segment	Gateway	Bridge / IF	DHCP
Server LAN	`10.100.1.1`	`server`	—
Office	`192.168.0.1`	`office` (sfp-sfpplus10)	dhcp1, lease 4w3d
VPN remote	`100.100.1.0`	`vpn`	dhcp2
IBM (legacy)	`192.168.2.1`	vlan2004	relay (inactive)

WAN publik (blok `117.102.73.96/29`)

IP	Komentar	Fungsi utama
`.102`	gisportal.id	Web/API/mail NAT → internal
`.99`	geonet.co.id	HTTP/S → `.24`; beberapa mail rule legacy
`.98`	geonet.co.id	—
`.100`	dev.gisportal.id	Dev/ArcGIS NAT
`.101`	Not Set	Mail legacy → `.76`

Routing (aktif 2026-07-06)

Route	Tabel	Gateway	Catatan
`0.0.0.0/0`	main	`117.102.73.97`	Primary, `check-gateway=ping`
`0.0.0.0/0`	KE ISP 1/2	hybrid tables	PCC / failover scripts
ISP2 WAN	sfp-sfpplus1	`192.168.1.4/24`	DHCP dynamic — UP

Scheduler hybrid-sync-mode + netwatch ping ISP1/ISP2 menyesuaikan mangle PCC.

NAT penting (publik → internal)

Publik	Port	Internal	Service
`.102`	80, 443	`10.100.1.24`	nginx reverse proxy
`.102`	25, 587, 993, 465	`10.100.1.28`	Mailcow
`.102`	5432, 1433, …	`.25`, `.75`, …	DB / SQL (hati-hati expose)
`.99`	80, 443	`10.100.1.24`	geonet web
`.100`	443, 6443, …	`.51`, `.57`, `.59`	ArcGIS dev

Mail geonet.co.id masih ada rule ke .76 / .40 (legacy cPanel/AD) — beberapa disabled.

VPN & auth

Protokol	Status	Auth
SSTP	enabled (:443)	RADIUS → `10.100.1.40`
PPTP	enabled ⚠️	Legacy — disarankan matikan
PPP secrets	lokal + RADIUS	IP tetap `10.100.1.220–230`

DNS

Forwarder: 203.142.82.222, 203.142.84.222
Split-DNS static: *.gisportal.id → 10.100.1.24 (user office/VPN resolve internal)

Layanan management

Service	Port	Akses
SSH	255	Key RSA
Winbox	default	`10.100.1.0/24`, `192.168.0.0/24`
WWW/API	disabled	—

Backup otomatis

Target	Jadwal
QNAP `10.100.1.10:mainpve/mikrotik/`	Daily 03:00 (scheduler)
Repo `Mikrotik/backups/`	Manual / sesi audit

3.9 KiB Raw Blame History Unescape Escape