Tampilkan postingan dengan label Mikrotik. Tampilkan semua postingan

setting mikrotik untuk warnet dengan external proxy Jilid 2  

setting mikrotik seperti tuneup/service motor di bengkel", setiap montir beda-beda cara kerjanya. dan yang  terpenting sesuai dengan kebutuhan.di warnet juragan-jurangan.

nat


chain=srcnat action=masquerade out-interface=pppoe-speedy1
chain=srcnat action=masquerade out-interface=Modem



;;; Proxy
     chain=dstnat action=dst-nat to-addresses=192.168.3.1 to-ports=3128
     protocol=tcp in-interface=Lan dst-port=80,3128,8080

     chain=dstnat action=redirect to-ports=80 protocol=tcp
     in-interface=pppoe-speedy1 dst-port=81




mangle
 ;;; HIT

 chain=forward action=mark-packet new-packet-mark=HIT passthrough=no dscp=12

Game


 ;;; Lost Saga TCP
     chain=forward action=mark-connection
     new-connection-mark=game-online-indonesia passthrough=no protocol=tcp
     dst-port=14009,14010
 ;;; Lost Saga TCP
     chain=forward action=mark-connection 
     new-connection-mark=game-online-indonesia passthrough=no protocol=tcp 
     dst-port=14009,14010 
   dan seterusnya..........

 chain=forward action=mark-packet new-packet-mark=Game-Online 
     passthrough=no connection-mark=game-online-indonesia 


 ;;; Ping
     chain=forward action=mark-connection new-connection-mark=Ping 
     passthrough=yes protocol=icmp 

  chain=forward action=mark-packet new-packet-mark=Ping passthrough=no 
     connection-mark=Ping 

 ;;; Client Download
     chain=forward action=mark-packet new-packet-mark=IP-02 passthrough=no 
     dst-address=192.168.1.2 
  dan seterusnya..........

 ;;; Client upload
chain=prerouting action=mark-packet new-packet-mark=upload passthrough=no 
     src-address=192.168.1.0/24 


queue tree
 0  name="A. HIT" parent=Lan packet-mark=HIT limit-at=0 queue=default 
     priority=1 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s 

 1   name="B. HIT Hotspot" parent=Hotspot packet-mark=HIT limit-at=0 
     queue=default priority=8 max-limit=0 burst-limit=0 burst-threshold=0 
     burst-time=0s 

 2   name="D. Client" parent=Lan packet-mark="" limit-at=0 priority=8 
     max-limit=2M burst-limit=0 burst-threshold=0 burst-time=0s 

 3 name="Billing" parent=D. Client packet-mark=IP-02 limit-at=0 
     queue=PCQ_Client priority=8 max-limit=500k burst-limit=0 
     burst-threshold=0 burst-time=0s 

 4  name="upload" parent=global-in packet-mark=upload limit-at=0 queue=upload 
     priority=8 max-limit=1M burst-limit=0 burst-threshold=0 burst-time=0s 

 5  name="F. Down Prox" parent=Proxy packet-mark=down-pr limit-at=0 
     queue=PCQ_Parent priority=8 max-limit=1800k burst-limit=0 
     burst-threshold=0 burst-time=0s 

queue type
0 * name="default" kind=pfifo pfifo-limit=50 

 1 * name="ethernet-default" kind=pfifo pfifo-limit=50 

 2 * name="wireless-default" kind=sfq sfq-perturb=5 sfq-allot=1514 

 3 * name="synchronous-default" kind=red red-limit=60 red-min-threshold=10 
     red-max-threshold=50 red-burst=20 red-avg-packet=1000 

 4 * name="hotspot-default" kind=sfq sfq-perturb=5 sfq-allot=1514 

 5   name="PCQ_Client" kind=pcq pcq-rate=500k pcq-limit=50 
     pcq-classifier=dst-address pcq-total-limit=2000 pcq-burst-rate=0 
     pcq-burst-threshold=0 pcq-burst-time=10s pcq-src-address-mask=32 
     pcq-dst-address-mask=32 pcq-src-address6-mask=64 
     pcq-dst-address6-mask=64 

 6   name="PCQ_Parent" kind=pcq pcq-rate=0 pcq-limit=50 
     pcq-classifier=dst-address pcq-total-limit=2000 pcq-burst-rate=0 
     pcq-burst-threshold=0 pcq-burst-time=10s pcq-src-address-mask=32 
     pcq-dst-address-mask=32 pcq-src-address6-mask=64 
     pcq-dst-address6-mask=64 











Filed under 0 komentar

Block IDM dengan mikrotik berdasarkan content  

sudah lama tidak ngeblog, alasannya sih sederhana cuman lupa email dan password doank,  ha ha ha ha. gak sengaja ini jg ketemu email dan passwordnya di kompi temen waktu mau install dan mau mindahin data.

kita lanjutkan sesuai judul blok idm, ternyata byk cara kita blok program idm dan sebangsanya salah satunya via mikrotik. cekidot gan buka winboxnya.
ketik di terminal tepatnya dimangle

 add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.mp3

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.zip

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.rar

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.rar

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.flv

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.mp4

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.exe

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.iso

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.nrg

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.avi

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.3gp

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.mov

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.mpeg

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.mpg

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.wav

add chain=forward action=mark-connection new-connection-mark=koneksi_idm \
     passthrough=yes in-interface=Lan content=.aac

untuk hotspot juga sama sesuaikan aja interfacenya.
karena saiah pake queue tree maka disimpan sebelum pembagian ke tiap client






selanjutnya buat rule di filter

add chain=forward action=drop protocol=tcp src-address-list=semua_ip_lan_anda connection-mark=koneksi_idm connection-limit=2,32

ingat penempatannya klo salah kagak jalan, simpan di rules paling atas, klo ada rule hotspot yach brarti dibawahnya rule hotspot dunk

di coba aja yach pake idm terbaru yang full crack skalian.
kelemahan :
- namanya juga conten jd kita browsing jg disanka download, solusi ganti sama rule L7 (tp rb750 ku termehek")
- klo dilimit 2 kayaknya kita download di crom ato firefox misalnya tanpa idm jg, ternyata di batasi jadi 2 he he he, kesannya pelit bandwith. solusi ganti jadi 5


credit to nitaufan

Filed under 2 komentar

Settingan Mikrotik dan External Proxy  

to de poin cekidot

diketahui :
Di Mikrotik
ip ke modem = 192.168.2.2
ip ke lan = 192.168.1.1
ip ke proxy = 192.168.3.3

Di proxy ip cop
ip green = 192.168.3.1
gateway = 192.168.3.3
port = 800
ngertikan topologi nya seperti apa bila diketahui seperti diatas

1. address list
add list=net60 address=192.168.1.2
add list=net60 address=192.168.1.3
add list=net60 address=192.168.1.4
add list=net60 address=192.168.1.5
add list=net60 address=192.168.1.6
add list=net60 address=192.168.1.7
add list=proxy address=192.168.3.1

2. NAT
add chain=dstnat action=dst-nat to-ports=53
protocol=udp in-interface=Lan dst-port=53

add chain=dstnat action=dst-nat to-ports=53
protocol=tcp in-interface=Lan dst-port=53

add chain=dstnat action=dst-nat to-ports=53
protocol=tcp in-interface=Proxy dst-port=53

add chain=dstnat action=dst-nat to-ports=53
protocol=udp in-interface=Proxy dst-port=53

add chain=dstnat action=dst-nat to-addresses=192.168.3.1
to-ports=800 protocol=tcp src-address-list=!proxy
in-interface=Lan dst-port=80,8080,3128,800

add chain=srcnat action=masquerade out-interface=Modem

3. MANGLE
proxy hit
add chain=forward action=mark-packet new-packet-mark=hit_12 passthrough=no dscp=12

tandai paket yg keluar masuk
add chain=prerouting action=mark-connection new-connection-mark=all_pre_con
passthrough=yes dst-address-list=!net60 in-interface=Lan
add chain=prerouting action=mark-connection new-connection-mark=all_pre_con
passthrough=yes dst-address-list=!net60 in-interface=Lan

add chain=forward action=mark-connection new-connection-mark=all_post_con
passthrough=yes src-address-list=!net60 out-interface=Lan
add chain=forward action=mark-packet new-packet-mark=all_post_pkt
passthrough=yes connection-mark=all_post_con

game.... masukin port" game yg sering dimaikan diwarnet mu
add chain=prerouting action=mark-connection new-connection-mark=games_conn
passthrough=yes protocol=tcp dst-address=203.89.146.0/23
dst-port=39190 connection-mark=all_pre_con
add chain=prerouting action=mark-connection new-connection-mark=games_conn
passthrough=yes protocol=udp dst-address=203.89.146.0/23
dst-port=40000-40010 connection-mark=all_pre_con
add chain=prerouting action=mark-connection new-connection-mark=games_conn
passthrough=yes protocol=tcp dst-address=203.89.147.12 dst-port=4300
add chain=prerouting action=mark-packet new-packet-mark=games_pkt
passthrough=no connection-mark=games_conn

http user
add chain=prerouting action=mark-connection
new-connection-mark=browsing_conn passthrough=yes tcp-flags=ack
protocol=tcp connection-mark=all_pre_con packet-size=0-64
add chain=prerouting action=mark-connection new-connection-mark=browsing_conn
passthrough=yes protocol=tcp dst-port=80,443
connection-mark=all_pre_con
add chain=forward action=mark-packet new-packet-mark=browsing_pkt
passthrough=no protocol=tcp connection-mark=browsing_conn
connection-bytes=0-131072

http proxy
add chain=prerouting action=mark-connection new-connection-mark=proxy_conn
passthrough=yes protocol=tcp src-address-list=net60
dst-address-list=!net60 dst-port=80,443
add chain=forward action=mark-packet new-packet-mark=proxy_pkt passthrough=no
connection-mark=proxy_conn

tranfer file
add chain=prerouting action=mark-connection
new-connection-mark=communication_conn passthrough=yes protocol=tcp
dst-port=20,21,23 connection-mark=all_pre_con
chain=forward action=mark-packet new-packet-mark=communication_pkt
passthrough=no connection-mark=trans_conn

normal traffik
add chain=prerouting action=mark-connection new-connection-mark=normal_conn
passthrough=yes dst-address-list=!proxy connection-mark=all_pre_con
add chain=forward action=mark-packet new-packet-mark=normal_pkt
passthrough=no connection-mark=normal_conn

DOWNLOAD TIAP USER
add chain=forward action=mark-packet new-packet-mark=bil_pkt passthrough=no
protocol=tcp dst-address=192.168.1.2 connection-mark=all_post_con
connection-bytes=200000-4294967295

add chain=forward action=mark-packet new-packet-mark=net1_pkt passthrough=no
protocol=tcp dst-address=192.168.1.3 connection-mark=all_post_con
connection-bytes=200000-4294967295

add chain=forward action=mark-packet new-packet-mark=net2_pkt passthrough=no
protocol=tcp dst-address=192.168.1.4 connection-mark=all_post_con
connection-bytes=200000-4294967295

add chain=forward action=mark-packet new-packet-mark=net3_pkt passthrough=no
protocol=tcp dst-address=192.168.1.5 connection-mark=all_post_con
connection-bytes=200000-4294967295

add chain=forward action=mark-packet new-packet-mark=net4_pkt passthrough=no
protocol=tcp dst-address=192.168.1.6 connection-mark=all_post_con
connection-bytes=200000-4294967295

add chain=forward action=mark-packet new-packet-mark=net5_pkt passthrough=no
protocol=tcp dst-address=192.168.1.7 connection-mark=all_post_con
connection-bytes=200000-4294967295 

4. firewall
cari sendiri dah, di blog ini jg ada

5 query type

6.queue tree


ntar ditrusin deh, lagi malezzz

Filed under 0 komentar

menentukan subnetmask kelas C sehingga optimal  

Subnetmask kelas C
-------------------
255.255.255.0 = 24 -> 254 mesin
.. .128 = 25 -> 128 mesin
.. .192 = 26 -> 64 mesin
.. .224 = 27 -> 32 mesin
.. .240 = 28 -> 16 mesin
.. .248 = 29 -> 8 mesin
.. .252 = 30 -> 4 mesin
.. .254 = 31 -> 2 mesin
.. .255 = 32 -> 1 mesin

Filed under 0 komentar

Firewall > Menghindari Port Scanner dari Hacker  

/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list \
address-list="port scanners" address-list-timeout=2w comment="ip hacker to list" \
disabled=no

add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg \
action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w comment="NMAP FIN Stealth scan"

add chain=input protocol=tcp tcp-flags=fin,syn \
action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w comment="SYN/FIN scan"

add chain=input protocol=tcp tcp-flags=syn,rst \
action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w comment="SYN/RST scan"

add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack \
action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w comment="FIN/PSH/URG scan"

add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \
action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w comment="ALL/ALL scan"

add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg \
action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w comment="NMAP NULL scan"

add chain=input src-address-list="port scanners" action=drop \
comment="dropping port scanners" disabled=no

SUMBER : http://wiki.mikrotik.com/wiki/Drop_port_scanners

Filed under 0 komentar

Firewall > Handle Virus Trojan Port with Mikrotik  

Ringkasan ini tidak tersedia. Harap klik di sini untuk melihat postingan.

Filed under 0 komentar

Akses Winbox hanya untuk Komputer Billing/Admin  

Adakalanya kita ingin menyetting server mikrotik di komputer klien, namun bila kita sudah selesai dan lupa untuk menghapus program Winbox , takutnya ini disalahgunakan oleh orang yang tidak bertanggung jawab, emang orang tersebut bisa mendowload dulu baru menjalankan di komputer klien, namun itu dapat kita cegah dengan menggunakan scrip sebagai berikut :

/ip firewall filter
add chain=input src-address=(isi dg IP billing) src-mac-address=(isi dg mac billing) \ action=accept
add chain=input src-address=0.0.0.0 action=drop
 dgn script ini berarti hanya bisa ip billing aja yg bisa akses server mikrotik.

Filed under 0 komentar

Membatasi sharing koneksi internet pada tetangga  

Adakalanya kita ingin menshare jaringan kita ke tetangga dengab 1 ip yang telah kita tetapkan, namun bagaimana bila si tetangga tersebut ternyata mensharing jaringan yang kita beri lebih dari 1 komputer, nah dengan mikrotik kita bisa menyiasatinya dengan skrip berikut :

/ip firewall mangle
add chain=forward action=change-ttl new-ttl=set:1 \
dst-address=192.168.5.0/24

atau kita bisa membuat ip penyederhanaan untuk 1 ip tersebut.
semoga membantu. 








		Filed under 
          



0
komentar










Postingan Lama