You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
112 lines
7.8 KiB
112 lines
7.8 KiB
# Hybrid Fase 2 — Failover + PCC + Netwatch + check-gateway |
|
# Import: /import file=hybrid.rsc |
|
# Restore Fase 1: scripts/restore-failover-phase1-mikrotik.ps1 |
|
# SSH saat apply: admin@192.168.0.1 port 255 (bukan 10.100.1.1) |
|
|
|
# --- Cleanup hybrid lama (idempotent, termasuk prep) --- |
|
/tool netwatch remove [find comment~"hybrid"] |
|
/system scheduler remove [find name~"hybrid"] |
|
/system script remove [find name~"hybrid"] |
|
/ip firewall mangle remove [find comment~"hybrid"] |
|
/routing rule remove [find comment~"hybrid"] |
|
/ip route remove [find comment~"hybrid ISP1"] |
|
|
|
# --- Routes per routing-table (PCC) --- |
|
/ip route add dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table="KE ISP 1" check-gateway=ping distance=1 comment="hybrid ISP1" disabled=no |
|
/ip route set [find dst-address=0.0.0.0/0 routing-table="KE ISP 2"] check-gateway=ping distance=1 comment="hybrid ISP2" |
|
|
|
# Connected routes di policy table (wajib agar PCC office/VPN bisa reach gateway) |
|
/ip route add dst-address=117.102.73.96/29 gateway=ether1 routing-table="KE ISP 1" distance=1 comment="hybrid ISP1 WAN lan" |
|
/ip route add dst-address=192.168.1.0/24 gateway=sfp-sfpplus1 routing-table="KE ISP 2" distance=1 comment="hybrid ISP2 WAN lan" |
|
/ip route add dst-address=192.168.0.0/24 gateway=office routing-table="KE ISP 1" distance=1 comment="hybrid office lan ISP1" |
|
/ip route add dst-address=192.168.0.0/24 gateway=office routing-table="KE ISP 2" distance=1 comment="hybrid office lan ISP2" |
|
|
|
# Main table failover (saat PCC off) |
|
/ip route set [find dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table=main] comment="hybrid failover ISP1 primary" |
|
/ip route set [find dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main] comment="hybrid failover ISP2 backup" |
|
|
|
# --- Routing rules --- |
|
/routing rule add action=lookup-only-in-table table="KE ISP 1" routing-mark="KE ISP 1" comment="hybrid ISP1" |
|
/routing rule add action=lookup-only-in-table table="KE ISP 2" routing-mark="KE ISP 2" comment="hybrid ISP2" |
|
|
|
# --- Mangle (urutan: server bypass → mgmt → server force → office bypass → PCC) --- |
|
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.1.0/24 dst-address=10.100.1.0/24 comment="hybrid server-local-bypass" place-before=0 |
|
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.1.0/24 dst-address=192.168.0.0/24 comment="hybrid server-to-office-bypass" place-before=0 |
|
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.1.0/24 dst-address=100.100.1.0/24 comment="hybrid server-to-vpn-bypass" place-before=0 |
|
/ip firewall mangle add chain=prerouting action=accept src-address=10.100.1.0/24 dst-address=117.102.73.96/29 comment="hybrid server hairpin bypass" place-before=0 |
|
/ip firewall mangle add chain=prerouting action=accept src-address=192.168.0.33 comment="hybrid mgmt bypass laptop" place-before=0 |
|
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark="KE ISP 1" passthrough=no src-address=10.100.1.0/24 comment="hybrid server force ISP1" place-before=0 |
|
/ip firewall mangle add chain=prerouting action=accept dst-address=10.100.1.0/24 in-interface=office comment="hybrid office-to-server-bypass" |
|
/ip firewall mangle add chain=prerouting action=accept dst-address=117.102.73.96/29 in-interface=office comment="hybrid office hairpin bypass" |
|
/ip firewall mangle add chain=prerouting action=accept src-address=100.100.1.0/24 dst-address=117.102.73.96/29 comment="hybrid vpn hairpin bypass" |
|
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark="ISP 1" passthrough=yes connection-mark=no-mark in-interface=office per-connection-classifier=both-addresses-and-ports:2/0 comment="hybrid office PCC ISP1" |
|
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark="ISP 2" passthrough=yes connection-mark=no-mark in-interface=office per-connection-classifier=both-addresses-and-ports:2/1 comment="hybrid office PCC ISP2" |
|
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark="ISP 1" passthrough=yes connection-mark=no-mark in-interface=vpn per-connection-classifier=both-addresses-and-ports:2/0 comment="hybrid vpn PCC ISP1" |
|
/ip firewall mangle add chain=prerouting action=mark-connection new-connection-mark="ISP 2" passthrough=yes connection-mark=no-mark in-interface=vpn per-connection-classifier=both-addresses-and-ports:2/1 comment="hybrid vpn PCC ISP2" |
|
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark="KE ISP 1" passthrough=yes connection-mark="ISP 1" comment="hybrid route ISP1" |
|
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark="KE ISP 2" passthrough=yes connection-mark="ISP 2" comment="hybrid route ISP2" |
|
|
|
# --- System scripts (hybrid-sync: ping gagal = return kosong, bukan packet-loss) --- |
|
/system script add name=hybrid-set-mode-both-up dont-require-permissions=yes policy=read,write,test source={ |
|
/ip firewall mangle enable [find comment="hybrid office PCC ISP1"] |
|
/ip firewall mangle enable [find comment="hybrid office PCC ISP2"] |
|
/ip firewall mangle enable [find comment="hybrid vpn PCC ISP1"] |
|
/ip firewall mangle enable [find comment="hybrid vpn PCC ISP2"] |
|
/ip firewall mangle enable [find comment="hybrid route ISP1"] |
|
/ip firewall mangle enable [find comment="hybrid route ISP2"] |
|
:log info "HYBRID: mode BOTH-UP" |
|
} |
|
|
|
/system script add name=hybrid-set-mode-isp1-down dont-require-permissions=yes policy=read,write,test source={ |
|
/ip firewall mangle disable [find comment="hybrid office PCC ISP1"] |
|
/ip firewall mangle disable [find comment="hybrid office PCC ISP2"] |
|
/ip firewall mangle disable [find comment="hybrid vpn PCC ISP1"] |
|
/ip firewall mangle disable [find comment="hybrid vpn PCC ISP2"] |
|
/ip firewall mangle disable [find comment="hybrid route ISP1"] |
|
/ip firewall mangle disable [find comment="hybrid route ISP2"] |
|
:log info "HYBRID: mode ISP1-DOWN" |
|
} |
|
|
|
/system script add name=hybrid-set-mode-isp2-down dont-require-permissions=yes policy=read,write,test source={ |
|
/ip firewall mangle disable [find comment="hybrid office PCC ISP2"] |
|
/ip firewall mangle disable [find comment="hybrid vpn PCC ISP2"] |
|
/ip firewall mangle disable [find comment="hybrid route ISP2"] |
|
/ip firewall mangle enable [find comment="hybrid office PCC ISP1"] |
|
/ip firewall mangle enable [find comment="hybrid vpn PCC ISP1"] |
|
/ip firewall mangle enable [find comment="hybrid route ISP1"] |
|
:log info "HYBRID: mode ISP2-DOWN" |
|
} |
|
|
|
/system script add name=hybrid-sync-mode dont-require-permissions=yes policy=read,write,test,sniff source={ |
|
:local r1 [/ping 117.102.73.97 count=2 as-value] |
|
:local r2 [/ping 192.168.1.1 count=2 as-value] |
|
:local loss1 ($r1->"packet-loss") |
|
:local loss2 ($r2->"packet-loss") |
|
:if ($loss1=0 && $loss2=0) do={ |
|
/system script run hybrid-set-mode-both-up |
|
} else={ |
|
:if ($loss1>0) do={ |
|
/system script run hybrid-set-mode-isp1-down |
|
} else={ |
|
:if ($loss2>0) do={ |
|
/system script run hybrid-set-mode-isp2-down |
|
} |
|
} |
|
} |
|
} |
|
|
|
# --- Netwatch --- |
|
/tool netwatch add comment="hybrid monitor ISP1" host=117.102.73.97 interval=10s timeout=3s up-script="hybrid-sync-mode" down-script="hybrid-set-mode-isp1-down" |
|
/tool netwatch add comment="hybrid monitor ISP2" host=192.168.1.1 interval=10s timeout=3s up-script="hybrid-sync-mode" down-script="hybrid-set-mode-isp2-down" |
|
|
|
# --- Scheduler cadangan --- |
|
/system scheduler add name=hybrid-sync-mode comment="hybrid scheduler" interval=1m on-event=hybrid-sync-mode |
|
|
|
# Set mode awal sesuai kesehatan GW |
|
/system script run hybrid-sync-mode |
|
|
|
# --- DNS internal: gisportal → reverse proxy; geonet hanya iguf (nginx) --- |
|
/ip dns static remove [find comment~"hybrid dns geonet"] |
|
/ip dns static add name=iguf.geonet.co.id address=10.100.1.24 ttl=1d comment="split-dns iguf" |
|
/ip dhcp-server network set [find address=192.168.0.0/24] dns-server=192.168.0.1,203.142.82.222,203.142.84.222 |
|
/ip dhcp-server network set [find address=100.100.1.0/24] dns-server=10.100.1.1,203.142.82.222,203.142.84.222
|
|
|