modem 1
192.168.1.1
|
|
192.168.1.2
MIkrotik Load Balancing—–192.168.0.254–hub €”—-Client
192.168.2.1
|
|
modem 2
192.168.2.1
Pc-Router Speknya
PIII -1Ghz-Memory 256Mhz -Hardisk 40 Gb
Konfigurasinya
1. Interface Konfigurasi
/ interface ethernet
set Modem1 name=â€Modem1″ mtu=1500 mac-address=00:10:4B:0D:95:02 arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=â€" disabled=no
set Lan name=â€Lan†mtu=1500 mac-address=00:0D:88:B2:7D:50 arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=â€" disabled=no
set Modem2 name=â€Modem2″ mtu=1500 mac-address=00:13:46:2CE:13 arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=â€" disabled=no
2. Ip Address Konfigurasi
/ ip address
add address=192.168.0.254/24 network=192.168.0.0 broadcast=192.168.0.255 \
interface=Lan comment=â€" disabled=no
add address=192.168.1.2/24 network=192.168.1.0 broadcast=192.168.1.255 \
interface=Modem1 comment=â€" disabled=no
add address=192.168.2.2/24 network=192.168.2.0 broadcast=192.168.2.255 \
interface=Modem2 comment=â€" disabled=no
3. Routing IP
/ ip route
add dst-address=0.0.0.0/0 gateway=192.168.2.1 scope=255 target-scope=10 \
routing-mark=odd comment=â€" disabled=no
add dst-address=0.0.0.0/0 gateway=192.168.1.1 scope=255 target-scope=10 \
routing-mark=even comment=â€" disabled=no
add dst-address=0.0.0.0/0 gateway=192.168.1.1 scope=255 target-scope=10 \
comment=â€" disabled=no
4. Mangle Marking Paket
/ ip firewall mangle
a. Load Balancing
add chain=prerouting in-interface=Lan connection-state=new nth=1,1,0 \
action=mark-connection new-connection-mark=odd passthrough=yes \
comment=â€Load Balancing†disabled=no
add chain=prerouting in-interface=Lan connection-mark=odd action=mark-routing \
new-routing-mark=odd passthrough=no comment=â€" disabled=no
add chain=prerouting in-interface=Lan connection-state=new nth=1,1,1 \
action=mark-connection new-connection-mark=even passthrough=yes comment=â€" \
disabled=no
add chain=prerouting in-interface=Lan connection-mark=even action=mark-routing \
new-routing-mark=even passthrough=no comment=â€" disabled=no
b. Turunin latensy ( ping ke dns )
add chain=prerouting src-address=192.168.0.0/24 protocol=icmp \
action=mark-connection new-connection-mark=ICMP-CM passthrough=yes \
comment=â€ToS†disabled=no
add chain=prerouting connection-mark=ICMP-CM action=mark-packet \
new-packet-mark=ICMP-PM passthrough=yes comment=â€" disabled=no
add chain=prerouting packet-mark=ICMP-PM action=change-tos new-tos=min-delay \
comment=â€" disabled=no
add chain=prerouting src-address=192.168.0.0/24 protocol=tcp dst-port=53 \
action=mark-connection new-connection-mark=DNS-CM passthrough=yes \
comment=â€" disabled=no
add chain=prerouting src-address=192.168.0.0/24 protocol=udp dst-port=53 \
action=mark-connection new-connection-mark=DNS-CM passthrough=yes \
comment=â€" disabled=no
add chain=prerouting connection-mark=DNS-CM action=mark-packet \
new-packet-mark=DNS-PM passthrough=yes comment=â€" disabled=no
add chain=prerouting packet-mark=DNS-PM action=change-tos new-tos=min-delay \
comment=â€" disabled=no
c. Tandain Services Yang mau di prioritykan
add chain=prerouting protocol=tcp dst-port=80 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=â€Tandai Service†\
disabled=no
add chain=prerouting connection-mark=http_conn action=mark-packet \
new-packet-mark=http passthrough=no comment=â€" disabled=no
add chain=prerouting protocol=tcp dst-port=6000-7000 action=mark-connection \
new-connection-mark=irc_conn passthrough=yes comment=â€" disabled=no
add chain=prerouting connection-mark=irc_conn action=mark-packet \
new-packet-mark=irc passthrough=no comment=â€" disabled=no
add chain=prerouting protocol=tcp dst-port=5050-5061 action=mark-connection \
new-connection-mark=ym_conn passthrough=yes comment=â€" disabled=no
add chain=prerouting connection-mark=ym_conn action=mark-packet \
new-packet-mark=ym passthrough=no comment=â€" disabled=no
add chain=prerouting protocol=tcp dst-port=8291 action=mark-connection \
new-connection-mark=mt_conn passthrough=yes comment=â€" disabled=no
add chain=prerouting connection-mark=mt_conn action=mark-packet \
new-packet-mark=mt passthrough=no comment=â€" disabled=no
add chain=prerouting protocol=tcp dst-port=443 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=â€" disabled=no
d. Optimasi Proxy pada paket mark
add chain=prerouting src-address=192.168.0.0/24 action=mark-packet \
new-packet-mark=Naik passthrough=no comment=â€Up Traffic†disabled=yes
add chain=forward src-address=192.168.0.0/24 action=mark-connection \
new-connection-mark=Koneksi passthrough=yes comment=â€Conn-Mark†\
disabled=yes
add chain=output out-interface=Lan dst-address=192.168.0.0/24 \
action=mark-packet new-packet-mark=Turun passthrough=no comment=â€Down-Via \
Proxy†disabled=yes
4. Filter Firewall
/ ip firewall filter
a. penentuan proteksi router
add chain=input connection-state=invalid action=drop comment=â€Drop invalid \
connections†disabled=no
add chain=input connection-state=established action=accept comment=â€Allow \
esatblished connections†disabled=no
add chain=input connection-state=related action=accept comment=â€Allow related \
connections†disabled=no
add chain=input protocol=udp action=accept comment=â€Allow UDP†disabled=no
add chain=input protocol=icmp action=accept comment=â€Allow ICMP†disabled=no
add chain=input in-interface=!Modem1 action=accept comment=â€Allow connection \
to router from local network†disabled=no
add chain=input in-interface=!Modem2 action=accept comment=â€" disabled=no
add chain=input action=accept comment=â€" disabled=no
add chain=forward in-interface=Lan protocol=tcp dst-port=6112 \
connection-limit=100,32 action=reject reject-with=icmp-network-unreachable \
comment=â€" disabled=no
b. penentuan proteksi dari akses gain ke router
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list \
address-list=â€port scanners†address-list-timeout=2w comment=â€Port \
scanners to list †disabled=no
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg \
action=add-src-to-address-list address-list=â€port scanners†\
address-list-timeout=2w comment=â€NMAP FIN Stealth scan†disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list \
address-list=â€port scanners†address-list-timeout=2w comment=â€SYN/FIN \
scan†disabled=no
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list \
address-list=â€port scanners†address-list-timeout=2w comment=â€SYN/RST \
scan†disabled=no
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack \
action=add-src-to-address-list address-list=â€port scanners†\
address-list-timeout=2w comment=â€FIN/PSH/URG scan†disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \
action=add-src-to-address-list address-list=â€port scanners†\
address-list-timeout=2w comment=â€ALL/ALL scan†disabled=no
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg \
action=add-src-to-address-list address-list=â€port scanners†\
address-list-timeout=2w comment=â€NMAP NULL scan†disabled=no
add chain=input src-address-list=â€port scanners†action=drop comment=â€dropping \ port scanners†disabled=no
c. Drop Port Aneh2
add chain=virus protocol=tcp dst-port=135-139 action=drop comment=â€Drop \
Blaster Worm†disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment=â€Drop \
Messenger Worm†disabled=no
add chain=virus protocol=tcp dst-port=445-3000 action=drop comment=â€Drop \
Blaster Worm†disabled=no
add chain=virus protocol=udp dst-port=445-3000 action=drop comment=â€Drop \
Blaster Worm†disabled=no
add chain=virus protocol=tcp dst-port=593 action=drop comment=â€________†\
disabled=no
add chain=virus protocol=udp dst-port=7000 action=drop comment=â€Setan1″ \
disabled=no
add chain=virus protocol=tcp dst-port=100-1000 action=drop comment=â€Setan1″ \
disabled=no
add chain=virus protocol=udp dst-port=100-1000 action=drop comment=â€Drop \
Messenger Worm†disabled=no
add chain=virus protocol=tcp dst-port=1000-3000 action=drop comment=â€Setan1″ \
disabled=no
add chain=virus protocol=udp dst-port=1000-3000 action=drop comment=â€Drop \
Messenger Worm†disabled=no
add chain=virus protocol=tcp dst-port=40000-50000 action=drop comment=â€Setan1″ \
disabled=no
add chain=virus protocol=udp dst-port=40000-50000 action=drop comment=â€Drop \
Messenger Worm†disabled=no
add chain=virus protocol=tcp dst-port=7000 action=drop comment=â€Setan1″ \
disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment=â€Drop \
Messenger Worm†disabled=no
add chain=virus protocol=tcp dst-port=7000 action=drop comment=â€Setan1″ \
disabled=no
add chain=virus protocol=tcp dst-port=25 action=drop comment=â€Drop Blaster \
Worm†disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment=â€Drop \
Messenger Worm†disabled=no
add chain=virus action=return comment=â€" disabled=no
add chain=virus protocol=tcp dst-port=110 action=drop comment=â€Drop Blaster \
Worm†disabled=no
bersambung