internet
||public ip
||
modem
||192.168.5.1
hub
||===========||========= LAN ip Private
mikrotik proxy 192.168.5.3
192.168.5.2
[admin@Primadona.net] ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=Public action=masquerade
1 chain=dstnat protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.5.3 to-ports=8080
2 chain=dstnat protocol=tcp dst-port=8080 action=dst-nat to-addresses=192.168.5.3 to-ports=3128
3 chain=dstnat protocol=tcp dst-port=3128 action=dst-nat to-addresses=192.168.5.3 to-ports=8080
[admin@Primadona.net] ip address> print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 X 192.168.0.2/24 192.168.0.0 192.168.0.255 Public
1 192.168.5.2/29 192.168.5.0 192.168.5.7 Public
2 192.168.0.2/24 192.168.0.0 192.168.0.255 Local
[admin@Primadona.net] ip address>
[admin@Primadona.net] ip route> print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf
# DST-ADDRESS PREFSRC G GATEWAY DISTANCE INTERFACE
0 ADC 192.168.0.0/24 192.168.0.2 Local
1 ADC 192.168.5.0/29 192.168.5.2 Public
2 A S 0.0.0.0/0 r 192.168.5.1 Public
[admin@Primadona.net] ip route>
[admin@Primadona.net] ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Drop invalid connections
chain=input connection-state=invalid action=drop
1 ;;; Allow esatblished connections
chain=input connection-state=established action=accept
2 ;;; Allow related connections
chain=input connection-state=related action=accept
3 ;;; Allow UDP
chain=input protocol=udp action=accept
4 ;;; Allow ICMP
chain=input protocol=icmp action=accept
5 ;;; Allow connection to router from local network
chain=input in-interface=!Public action=accept
6 ;;; Drop everything else
chain=input action=drop
7 chain=input protocol=tcp dst-port=1337 action=add-src-to-address-list address-list=knock address-list-timeout=15s
8 chain=input protocol=tcp dst-port=7331 src-address-list=knock action=add-src-to-address-list address-list=safe
address-list-timeout=15m
9 ;;; accept established connection packets
chain=input connection-state=established action=accept
10 ;;; accept related connection packets
chain=input connection-state=related action=accept
11 ;;; drop invalid packets
chain=input connection-state=invalid action=drop
12 ;;; detect and drop port scan connections
chain=input protocol=tcp psd=21,3s,3,1 action=drop
13 ;;; suppress DoS attack
chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpit
14 ;;; detect DoS attack
chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list address-list=black_list
address-list-timeout=1d
15 ;;; jump to chain ICMP
chain=input protocol=icmp action=jump jump-target=ICMP
16 ;;; jump to chain services
chain=input action=jump jump-target=services
17 ;;; Allow Broadcast Traffic
chain=input dst-address-type=broadcast action=accept
18 chain=input action=log log-prefix=”Filter:”
19 ;;; Allow access to router from known network
chain=input action=accept
20 chain=input src-address=192.168.0.0/24 action=accept
21 chain=input src-address=192.168.5.0/26 action=accept
22 ;;; drop everything else
chain=input action=drop
23 ;;; 0:0 and limit for 5pac/s
chain=ICMP protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept
24 ;;; 3:3 and limit for 5pac/s
chain=ICMP protocol=icmp icmp-options=3:3 limit=5,5 action=accept
25 ;;; 3:4 and limit for 5pac/s
chain=ICMP protocol=icmp icmp-options=3:4 limit=5,5 action=accept
26 ;;; 8:0 and limit for 5pac/s
chain=ICMP protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept
27 ;;; 11:0 and limit for 5pac/s
chain=ICMP protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept
28 ;;; Drop everything else
chain=ICMP protocol=icmp action=drop
29 ;;; Port scanners to list
chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port scanners
address-list-timeout=2w
30 ;;; NMAP FIN Stealth scan
chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list
address-list=port scanners address-list-timeout=2w
31 ;;; SYN/FIN scan
chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list=port scanners
address-list-timeout=2w
32 ;;; SYN/RST scan
chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list=port scanners
address-list-timeout=2w
33 ;;; FIN/PSH/URG scan
chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list
address-list=port scanners address-list-timeout=2w
34 ;;; ALL/ALL scan
chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list=port scanners
address-list-timeout=2w
35 ;;; NMAP NULL scan
chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list
address-list=port scanners address-list-timeout=2w
36 ;;; dropping port scanners
chain=input src-address-list=port scanners action=drop
37 ;;; allow established connections
chain=forward connection-state=established action=accept
38 ;;; allow related connections
chain=forward connection-state=related action=accept
39 ;;; drop invalid connections
chain=forward connection-state=invalid action=drop
40 ;;; Drop Blaster Worm
chain=virus protocol=tcp dst-port=135-139 action=drop
41 ;;; Drop Messenger Worm
chain=virus protocol=udp dst-port=135-139 action=drop
42 ;;; Drop Blaster Worm
chain=virus protocol=tcp dst-port=445 action=drop
43 ;;; Drop Blaster Worm
chain=virus protocol=udp dst-port=445 action=drop
44 ;;; ________
chain=virus protocol=tcp dst-port=593 action=drop
45 ;;; ________
chain=virus protocol=tcp dst-port=1024-1030 action=drop
46 ;;; Drop MyDoom
chain=virus protocol=tcp dst-port=1080 action=drop
47 ;;; ________
chain=virus protocol=tcp dst-port=1214 action=drop
48 ;;; ndm requester
chain=virus protocol=tcp dst-port=1363 action=drop
49 ;;; ndm server
chain=virus protocol=tcp dst-port=1364 action=drop
50 ;;; screen cast
chain=virus protocol=tcp dst-port=1368 action=drop
51 ;;; hromgrafx
chain=virus protocol=tcp dst-port=1373 action=drop
52 ;;; cichlid
chain=virus protocol=tcp dst-port=1377 action=drop
53 ;;; Worm
chain=virus protocol=tcp dst-port=1433-1434 action=drop
54 ;;; Bagle Virus
chain=virus protocol=tcp dst-port=2745 action=drop
55 ;;; Drop Dumaru.Y
chain=virus protocol=tcp dst-port=2283 action=drop
56 ;;; Drop Beagle
chain=virus protocol=tcp dst-port=2535 action=drop
57 ;;; Drop Beagle.C-K
chain=virus protocol=tcp dst-port=2745 action=drop
58 ;;; Drop MyDoom
chain=virus protocol=tcp dst-port=3127 action=drop
59 ;;; Drop Backdoor OptixPro
chain=virus protocol=tcp dst-port=3410 action=drop
60 ;;; Worm
chain=virus protocol=tcp dst-port=4444 action=drop
61 ;;; Worm
chain=virus protocol=udp dst-port=4444 action=drop
62 ;;; Drop Sasser
chain=virus protocol=tcp dst-port=5554 action=drop
63 ;;; Drop Beagle.B
chain=virus protocol=tcp dst-port=8866 action=drop
64 ;;; Drop Dabber.A-B
chain=virus protocol=tcp dst-port=9898 action=drop
65 ;;; Drop Dumaru.Y
chain=virus protocol=tcp dst-port=10000 action=drop
66 ;;; Drop MyDoom.B
chain=virus protocol=tcp dst-port=10080 action=drop
67 ;;; Drop NetBus
chain=virus protocol=tcp dst-port=12345 action=drop
68 ;;; Drop Kuang2
chain=virus protocol=tcp dst-port=17300 action=drop
69 ;;; Drop SubSeven
chain=virus protocol=tcp dst-port=27374 action=drop
70 ;;; Drop PhatBot, Agobot, Gaobot
chain=virus protocol=tcp dst-port=65506 action=drop
71 ;;; jump to the virus chain
chain=forward action=jump jump-target=virus
Minggu, 20 April 2008
Speedy Buat Game + Internetan
Minggu, 09 Desember 2007
Mikrotik Firewall
Untuk mengamankan router mikrotik dari traffic virus dan excess ping dapat digunakan skrip firewall berikut
Pertama buat address-list "ournetwork" yang berisi alamat IP radio, IP LAN dan IP WAN atau IP lainnya yang dapat dipercaya
Dalam contoh berikut alamat IP radio adalah = 10.0.0.0/16, IP LAN = 192.168.2.0/24 dan IP WAN = 203.89.24.0/21 dan IP lainnya yang dapat dipercaya = 202.67.33.7
Untuk membuat address-list dapat menggunakan contoh skrip seperti berikut ini tinggal disesuaikan dengan konfigurasi jaringan Anda.
Buat skrtip berikut menggunakan notepad kemudian copy-paste ke console mikrotik :
/ ip firewall address-list
add list=ournetwork address=203.89.24.0/21 comment="Datautama Network" \
disabled=no
add list=ournetwork address=10.0.0.0/16 comment="IP Radio" disabled=no
add list=ournetwork address=192.168.2.0/24 comment="LAN Network" disabled=no
Selanjutnya copy-paste skrip berikut pada console mikrotik
/ ip firewall filter
add chain=forward connection-state=established action=accept comment="allow \
established connections" disabled=no
add chain=forward connection-state=related action=accept comment="allow \
related connections" disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment="Drop \
Messenger Worm" disabled=no
add chain=forward connection-state=invalid action=drop comment="drop invalid \
connections" disabled=no
add chain=virus protocol=tcp dst-port=135-139 action=drop comment="Drop \
Blaster Worm" disabled=no
add chain=virus protocol=tcp dst-port=1433-1434 action=drop comment="Worm" \
disabled=no
add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster \
Worm" disabled=no
add chain=virus protocol=udp dst-port=445 action=drop comment="Drop Blaster \
Worm" disabled=no
add chain=virus protocol=tcp dst-port=593 action=drop comment="________" \
disabled=no
add chain=virus protocol=tcp dst-port=1024-1030 action=drop comment="________" \
disabled=no
add chain=virus protocol=tcp dst-port=1080 action=drop comment="Drop MyDoom" \
disabled=no
add chain=virus protocol=tcp dst-port=1214 action=drop comment="________" \
disabled=no
add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester" \
disabled=no
add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server" \
disabled=no
add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast" \
disabled=no
add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
disabled=no
add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" \
disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Bagle Virus" \
disabled=no
add chain=virus protocol=tcp dst-port=2283 action=drop comment="Drop Dumaru.Y" \
disabled=no
add chain=virus protocol=tcp dst-port=2535 action=drop comment="Drop Beagle" \
disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Drop \
Beagle.C-K" disabled=no
add chain=virus protocol=tcp dst-port=3127 action=drop comment="Drop MyDoom" \
disabled=no
add chain=virus protocol=tcp dst-port=3410 action=drop comment="Drop Backdoor \
OptixPro" disabled=no
add chain=virus protocol=tcp dst-port=4444 action=drop comment="Worm" \
disabled=no
add chain=virus protocol=udp dst-port=4444 action=drop comment="Worm" \
disabled=no
add chain=virus protocol=tcp dst-port=5554 action=drop comment="Drop Sasser" \
disabled=no
add chain=virus protocol=tcp dst-port=8866 action=drop comment="Drop Beagle.B" \
disabled=no
add chain=virus protocol=tcp dst-port=9898 action=drop comment="Drop \
Dabber.A-B" disabled=no
add chain=virus protocol=tcp dst-port=10000 action=drop comment="Drop \
Dumaru.Y, sebaiknya di didisable karena juga sering digunakan utk vpn atau \
webmin" disabled=yes
add chain=virus protocol=tcp dst-port=10080 action=drop comment="Drop \
MyDoom.B" disabled=no
add chain=virus protocol=tcp dst-port=12345 action=drop comment="Drop NetBus" \
disabled=no
add chain=virus protocol=tcp dst-port=17300 action=drop comment="Drop Kuang2" \
disabled=no
add chain=virus protocol=tcp dst-port=27374 action=drop comment="Drop \
SubSeven" disabled=no
add chain=virus protocol=tcp dst-port=65506 action=drop comment="Drop PhatBot, \
Agobot, Gaobot" disabled=no
add chain=forward action=jump jump-target=virus comment="jump to the virus \
chain" disabled=no
add chain=input connection-state=established action=accept comment="Accept \
established connections" disabled=no
add chain=input connection-state=related action=accept comment="Accept related \
connections" disabled=no
add chain=input connection-state=invalid action=drop comment="Drop invalid \
connections" disabled=no
add chain=input protocol=udp action=accept comment="UDP" disabled=no
add chain=input protocol=icmp limit=50/5s,2 action=accept comment="Allow \
limited pings" disabled=no
add chain=input protocol=icmp action=drop comment="Drop excess pings" \
disabled=no
add chain=input protocol=tcp dst-port=21 src-address-list=ournetwork \
action=accept comment="FTP" disabled=no
add chain=input protocol=tcp dst-port=22 src-address-list=ournetwork \
action=accept comment="SSH for secure shell" disabled=no
add chain=input protocol=tcp dst-port=23 src-address-list=ournetwork \
action=accept comment="Telnet" disabled=no
add chain=input protocol=tcp dst-port=80 src-address-list=ournetwork \
action=accept comment="Web" disabled=no
add chain=input protocol=tcp dst-port=8291 src-address-list=ournetwork \
action=accept comment="winbox" disabled=no
add chain=input protocol=tcp dst-port=1723 action=accept comment="pptp-server" \
disabled=no
add chain=input src-address-list=ournetwork action=accept comment="From \
Datautama network" disabled=no
add chain=input action=log log-prefix="DROP INPUT" comment="Log everything \
else" disabled=no
add chain=input action=drop comment="Drop everything else" disabled=no
Efek dari skrip diatas adalah:
- router mikrotik hanya dapat diakses FTP, SSH, Web dan Winbox dari IP yang didefinisikan dalam address-list "ournetwork" sehingga tidak bisa diakses dari sembarang tempat.
- Port-port yang sering dimanfaatkan virus di blok sehingga traffic virus tidak dapat dilewatkan, tetapi perlu diperhatikan jika ada user yang kesulitan mengakses service tertentu harus dicek pada chain="virus" apakah port yang dibutuhkan user tersebut terblok oleh firewall.
Packet ping dibatasi untuk menghindari excess ping.
Selain itu yang perlu diperhatikan adalah: sebaiknya buat user baru dan password dengan group full kemudian disable user admin, hal ini untuk meminimasi resiko mikrotik Anda di hack orang.
Selamat mencoba
Kenalan Dengan Mikrotik RouterOS
MikroTik RouterOS adalah sistem operasi dan perangkat lunak yang dapat digunakan untuk menjadikan komputer manjadi router network yang handal, mencakup berbagai fitur yang dibuat untuk ip network dan jaringan wireless, cocok digunakan oleh ISP dan provider hostspot.
Sebelumnya bisa gambarkan dulu skema jaringannya sbb:
LAN —> Mikrotik RouterOS —> Modem ADSL —> INTERNET
Untuk LAN, kita pake kelas C, dengan network 192.168.0.0/24. Untuk Mikrotik RouterOS, kita perlu dua ethernet card. Satu (ether1 - 192.168.1.2/24) untuk sambungan ke Modem ADSL dan satu lagi (ether2 - 192.168.0.1/24) untuk sambungan ke LAN. Untuk Modem ADSL, IP kita set 192.168.1.1/24.
Sebelum mengetikkan apapun, pastikan Anda telah berada pada root menu dengan mengetikkan “/”
1. Set IP untuk masing² ethernet card
ip address add address=192.168.1.2/24 interface=ether1
ip address add address=192.168.0.1/24 interface=ether2
Untuk menampilkan hasil perintah di atas ketikkan perintah berikut:
ip address print
Kemudian lakukan testing dengan mencoba nge-ping ke gateway atau ke komputer yg ada pada LAN. Jika hasilnya sukses, maka konfigurasi IP Anda sudah benar 8)
ping 192.168.1.1
ping 192.168.0.10
2. Menambahkan Routing
ip route add gateway=192.168.1.1
3. Setting DNS
ip dns set primary-dns=202.134.1.10 allow-remote-requests=yes
ip dns set secondary-dns=202.134.0.155 allow-remote-requests=yes
Karena koneksi ini menggunakan Speedy dari Telkom, maka DNS yg aq pake ya punya Telkom. Silahkan sesuaikan dengan DNS provider Anda.
Setelah itu coba Anda lakukan ping ke yahoo.com misalnya:
ping yahoo.com
Jika hasilnya sukses, maka settingan DNS sudah benar
4. Source NAT (Network Address Translation) / Masquerading
Agar semua komputer yg ada di LAN bisa terhubung ke internet juga, maka Anda perlu menambahkan NAT (Masquerade) pada Mikrotik.
ip firewall nat add chain=srcnat action=masquerade out-interface=ether1
Sekarang coba lakukan ping ke yahoo.com dari komputer yang ada di LAN:
ping yahoo.com
Jika hasilnya sukses, maka setting masquerade sudah benar
5. DHCP (DynamicHost Configuration Protocol)
Karena alasan supaya praktis, temenku pengin pake DHCP Server. Biar klo tiap ada klien yang konek, dia ga perlu setting IP secara manual. Tinggal obtain aja dari DHCP Server, beres dah. Untungnya Mikrotik ini juga ada fitur DHCP Servernya. Jadi ya ga ada masalah...
* Membuat IP Address Pool
ip pool add name=dhcp-pool ranges=192.168.0.2-192.168.0.254
* Menambahkan DHCP Network
ip dhcp-server network add address=192.168.0.0/24 gateway=192.168.0.1 dns-server=202.134.1.10,202.134.0.155
* Menambahkan Server DHCP
ip dhcp-server add name=DHCP_LAN disabled=no interface=ether2 address-pool=dhcp-pool
Sekarang coba lakukan testing dari komputer klien, untuk me-request IP Address dari Server DHCP. Jika sukses, maka sekali lagi, settingannya udah bener :)
6. Bandwidth Control
Agar semua komputer klien pada LAN tidak saling berebut bandwidth, maka perlu dilakukan yg namanya bandwidth management atau bandwidth control :idea:
Model yg digunakan adalah queue trees. Untuk lebih jelas apa itu, silahkan merujuk ke situsnya Mikrotik.
Kondisinya seperti ini:
Koneksi Speedy kan katanya speednya sampe 384/64 Kbps (Download/Upload), nah kondisi itu sangat jarang tercapai. Jadi kita harus cari estimasi rata²nya. Maka saya ambil minimalnya untuk download bisa dapet sekitar 300 Kbps dan untuk upload aq alokasikan 50 Kbps. Sedangkan untuk yg maksimumnya, untuk download kira² 380 Kbps dan upload 60 Kbps.
Lalu, jumlah komputer klien yang ada saat ini adalah 10 buah. Jadi harus disiapkan bandwidth itu untuk dibagikan kepada 10 klien tersebut.
Perhitungan untuk masing² klien seperti ini:
* Minimal Download: 300 / 10 * 1024 = 30720 bps
Maximal Download: 380 / 10 * 1024 = 38912 bps
* Minimal Upload: 50 / 10 * 1024 = 5120 bps
Maximal Upload: 60 / 10 * 1024 = 6144 bps
Selanjutnya kita mulai konfigurasinya:
* Tandai semua paket yg asalnya dari LAN:
ip firewall mangle add src-address=192.168.0.0/24 action=mark-connection new-connection-mark=Clients-con chain=prerouting
ip firewall mangle add connection-mark=Clients-con action=mark-packet new-packet-mark=Clients chain=prerouting
* Menambahkan rule yg akan membatasi kecepatan download dan upload:
queue tree add name=Clients-Download parent=ether2 packet-mark=Clients limit-at=30720 max-limit=38912
queue tree add name=Clients-Upload parent=ether1 packet-mark=Clients limit-at=5120 max-limit=6144
Sekarang coba lakukan test download dari beberapa klien, mestinya sekarang tiap2 klien akan berbagi bandwidthnya. Jika jumlah klien yg online tidak sampai 10, maka sisa bandwidth yang nganggur itu akan dibagikan kepada klien yg online.
7. Graphing
Mikrotik ini juga dilengkapi dengan fungsi monitoring traffic layaknya MRTG biasa. Jadi kita bisa melihat berapa banyak paket yg dilewatkan pada PC Mikrotik kita.
tool graphing set store-every=5min
Berikutnya yang akan kita monitor adalah paket² yg lewat semua interface yg ada di PC Mikrotik kita, klo di komputerku ada ether1 dan ether2.
tool graphing interface add-interface=all store-on-disk=yes
Sekarang coba arahkan browser anda ke IP Router Mikrotik. Klo aq di sini:
http://192.168.0.1/graphs/
Nanti akan ada pilihan interface apa aja yg ada di router Anda. Coba klik salah satu, maka Anda akan bisa melihat grafik dari paket2 yg lewat pada interface tersebut.
