sebenernya gak susah sih bikin N link load balancer
asal PCI slot di PC router linux-nya cukup buat di taro-in N ethernet card
yang saya pake di rumah cuma 2 link load balancer & NAT pake Ubuntu
bisa di kembangin jadi N link gak susah sama sekali sih
Saya gak bisa upload tu catatan ke forum ini
soalnya gede banget ini cuplikan load balancer-nya ..
/sbin/ip link set lo up
/sbin/ip link set eth0 up
/sbin/ip link set eth1 up
/sbin/ip link set eth2 up
/sbin/ip route flush table adsl
/sbin/ip route flush table rtrwnet
/sbin/ip route flush table internet
/sbin/ip addr add 127.0.0.1/8 brd 127.0.0.255 dev lo
/sbin/ip addr add 192.168.1.222/24 brd 192.168.1.255 dev eth2
# /sbin/ip addr add 10.0.148.48/24 brd 10.0.148.255 dev eth0
/sbin/ip addr add 192.168.0.222/24 brd 192.168.0.255 dev eth1
/sbin/ip route add 127.0.0.0/8 dev lo
/sbin/ip route add 10.5.148.0/24 via 10.0.148.254 dev eth0
/sbin/ip route add 192.168.0.0/24 dev eth1
/sbin/ip route add 44.132.33.0/24 via 192.168.0.10 dev eth1
/sbin/ip route add 192.168.11.0/24 via 192.168.0.10 dev eth1
/sbin/ip route add 125.160.6.0/24 via 192.168.1.1 dev eth2
/sbin/ip route add 202.159.32.0/24 via 192.168.1.1 dev eth2
/sbin/ip rule add prio 10 table main
/sbin/ip rule add prio 20 table adsl
/sbin/ip rule add prio 30 table rtrwnet
/sbin/ip rule add prio 40 table internet
/sbin/ip route del default table main
/sbin/ip route del default table adsl
/sbin/ip route del default table rtrwnet
/sbin/ip route del default table internet
/sbin/ip rule add prio 20 from 192.168.1.0/24 table adsl
/sbin/ip route add default via 192.168.1.1 dev eth2 src 192.168.1.222 proto static table adsl
/sbin/ip route append prohibit default table adsl metric 1 proto static
/sbin/ip rule add prio 30 from 10.0.148.0/24 table rtrwnet
/sbin/ip route add default via 10.0.148.254 dev eth0 src 10.0.148.48 proto static table rtrwnet
/sbin/ip route append prohibit default table rtrwnet metric 5 proto static
# Set up load balancing gateways
/sbin/ip rule add prio 40 table internet
/sbin/ip route add default proto static table internet \
nexthop via 192.168.1.1 dev eth2 weight 1 \
nexthop via 10.0.148.254 dev eth0 weight 10
# Setup routing to ISPs
/sbin/ip route add 202.138.236.0/24 proto static table internet \
nexthop via 192.168.1.1 dev eth2 weight 10 \
nexthop via 10.0.148.254 dev eth0 weight 1
Minggu, 20 April 2008
Rule Load Balancing Pak Ono
Install SNORT di Ubuntu
# apt-get install libpcre3 libpcre3-dev libpcrecpp0
# apt-get install libpcap0.8 libpcap0.8-dev
# apt-get install libmysqlclient15-dev
# apt-get install libphp-adodb
# apt-get install libgd2-xpm libgd2-xpm-dev
# apt-get install php5-mysql
# apt-get install php5-gd
# apt-get install php-image-graph php-image-canvas php-pear
# apt-get install libpcre3 libpcre3-dev libpcrecpp0
# apt-get install libpcap0.8 libpcap0.8-dev
# apt-get install libmysqlclient15-dev
# apt-get install libphp-adodb
# apt-get install libgd2-xpm libgd2-xpm-dev
# apt-get install php5-mysql
# apt-get install php5-gd
# apt-get install php-image-graph php-image-canvas php-pear
Web Access
http://localhost/base
Setup page
CREATE BASE AG
Install Snort in Ubuntu
By: Onno W. Purbo
Main page
Dasar-Dasar Sistem Operasi Linux (Direktori dan Sistem Berkas)
Di Linux dan Unix segala sesuatu adalah berkas. Direktori adalah berkas, berkas adalah berkas, dan peranti juga merupakan berkas. Peranti yang seringkali dirujuk sebagai node; tetap saja, mereka dianggap sebagai berkas.Sistem berkas di Linux dan Unix diorganisasikan secara hirarki, seperti struktur pohon. Leveltertinggi dari sistem berkas adalah direktori root atau /. Semua berkas dan direktori yang lain berada dibawah direktori root. Sebagai contoh, /home/jebediah/cheeses.odt menunjukkan path penuh ke berkas cheeses.odt yang berada di direktori jebediah, yang juga berada dibawah direktori home, dan semuanya berada dibawah direktori root (/).Dibawah direktori root (/) terdapat sejumlah direktori-direktori penting yang ada dalam distribusiLinux lainnya. Berikut ini adalah daftar direktori-direktori yang berada langsung dibawah direktori(/):
• /bin - lokasi perintah penting, yang biasanya adalah aplikasi biner, tetapi bisa juga skrip shell
• /boot - berkas konfigurasi boot, kernel, dan berkas lain yang dibutuhkan ketika sistem booting
• /dev - berkas peranti (device)• /etc - berkas konfigurasi, skrip startup, dll (etc).
• /home - direktori pangkal (home) bagi masing-masing pengguna
• /initrd - digunakan untuk meng-customize initial RAM Disk
• /lib - libraries yang diperlukan oleh sistem• /lost+found - menyediakan sistem lost+found untuk berkas yang berada dibawah direktori root(/)
• /media - lokasi me-mount removable media secara otomatis seperti CD, kamera digital, dll.
• /mnt - mounted sistem berkas secara manual pada harddisk
• /opt - lokasi untuk instalasi aplikasi dari pihak ketiga (optional); aplikasi ini biasanya di-compilesecara statik dan dapat digunakan pada distro Linux lainnya
• /proc - direktori dinamis khusus yang menangani informasi mengenai kondisi sistem, termasukproses-proses (processes) yang sedang berjalan
• /root - direktori pangkal (home) bagi pengguna root, diucapkan “slash-root”.
• /sbin - sistem biner dan skrip penting, biasanya untuk dijalankan oleh pengguna root
• /srv - dapat berisi berkas yang served (melayani) sistem lain.• /sys - mirip dengan sistem berkas /proc tetapi memuat informasi system yang tidak berhubungandengan proses yang berjalan
• /tmp - berkas sementara (temporary)
• /usr - lokasi untuk aplikasi dan berkas read-only yang biasanya tersedia untuk diakses olehseluruh users
• /var - berkas variabel seperti log dan database
Apa Itu Kernel
Sebagai pengguna komputer, kadang kita pernah mengalami hal-hal yang membingungkan seperti komputer hank atau tidak berfungsi dengan baik, sebagai contohnya adalah ketika menggunakan OS Windows, ketika terjadi hank kadang-kadang mulcul layar biru atau di kenal dengan Blue Screen, dan biasanya ada informasi atau kata-kata KERNEL bla .. bla .. bla … sejauh ini sebagai orang awam maka jika terjadi hal tersebut maka pasti akan membooting ulang komputernya tanpa mengetahui apa yang sebenarnya terjadi. Nah berlandaskan hal tersebut maka ada artikel yang menarik menyangkut istilah KERNEL .. selamat membaca.
Dalam sains komputer, kernel merupakan inti dari sistem pengoperasian yang mengatur penggunaan ingatan/memori, peranti masukan dan keluaran, proses-proses, penggunaan fail pada sistem fail dan lain-lain. Kernel juga menyediakan sekumpulan layanan yang digunakan untuk mengakses kernel yang disebut system call. System call ini digunakan untuk mengimplementasikan berbagai layanan yang diberikan oleh sistem pengoperasian. Program sistem dan semua program-program lainnya yang dijalankan di atas kernel disebut user mode.Kernel Linux terdiri dari beberapa bagian penting, seperti: pengurusan proses, pengurusan ingatan, pemacu perkakasan, pemacu sistem fail, pengurusan jaringan dan lain-lain. Namun bahagian yang terpenting ialah pengurusan proses dan pengurusan ingatan. Pengurusan ingatan meliputi penggunaan ingatan, kawasan pertukaran, bahagian-bahagian kernel dan untuk cache penimbal (buffer cache). Pengurusan proses menangani penggunaan proses-proses dan penjadualan proses. Pada bahagian dasar kernel terdapat pemacu perkakasan untuk setiap jenis perkakasan komputer yang disokong.Fungsi-fungsi kernel
1. Pengurusan proses
Tugas utama sebuah system pengoperasian kernel ialah membenarkan aplikasi yang lain untuk berjalan dan menyokong mereka dengan ciri-ciri tambahan, seperti pengabstrakan perkakasan, untuk menjalan proses, kernel mesti memuat turun failnya kepada ingatan, menyediakan stack untuk program dan pergi ke lokasi yang diberikan di dalam program, ini memulakan perjalanan sesebuah program, cara ini dipanggil scheduling. Dalam sistem berbilang kerja, kernel secara asasnya akan memberikan setiap program sedikit masa dan menukarkan dari proses ke proses dengan cepat dengan itu ia akan muncul kepada pengguna jika proses ini dijalankan secara terus menerus. Kernel mesti juga menyediakan proses ini untuk berkomunikasi, ini dikenali sebagai inter-process communication. Ini kemungkinan ada multipemprosesan yang menyokong kernel tersebut.
2. Pengurusan ingatan
Kernel mempunyai akses penuh dalam ingatan sistem dan menyediakan cara-cara untuk membenarkan userland program untuk mengakses memori ini dengan selamat. Cara pertama untuk mengurus ingatan ialah virtual addressing, biasanya arkib dengan mukasurat atau segmentation. Virtual addressing membenarkan kernel untuk memberikan alamat fizikal yang muncul sebagai alamat yang lain iaitu virtual address, ini membenarkan setiap program mempercayai ia hanya satu program (sebahagian daripada kernel) yang berjalan, dan ini mengelakkan aplikasi daripada berlanggar antara satu sama lain.
3. Pengurusan peranti
Dalam arahan untuk melakukan sesuatu tugas, kernel perlu untuk mengakses perbagai peranti yang bersambungan di dalam komputer, sebagai contoh, dalam arahan untuk memaparkan pengguna apa-apa sahaja, pemacu monitor perlu untuk muncul, peranti ini boleh dikawal melalui pemacu, di mana ia mesti dibuat oleh pembangun dan/atau disediakan oleh pengilang sesuatu peranti tersebut.
Pengurus peranti pertamanya akan melakukan semakan keatas bas perkakasan yang berbeza (seperti USB, PCI), dalam arahan unruk mengesan semua peranti yang telah dipasang dan kemudiannya mencari pemacu yang bersesuaian, selepas ini, semuanya bergantung kepada jenis kernel dan rekaan kernel.
4. Sistem panggilan
Dalam arahan untuk menyediakan kerja yang berguna, program userland mesti mempunyai akses kepada semua perkhidmatan yang disediakan oleh kernel. Ini dilaksanakan secaar berbeza-beza oleh kernel yang berlainan, tetapi mesti disediakan oleh C library, dimana ia menukarkan kelemahan kesemua system panggilan, sama ada diberikan atau melalui memori yang dikongsi.
5. Shell
Shell adalah perisian atau aplikasi yang menjadi alat untuk perhubungan antara pangguna untuk berhubung dengan sistem operasi, shella akan membaca apa sahaja yang dimasukkan oleh pengguna dan memahaminya sebagai arahan untuk menjalankan perisian lain, memanipulasi fail, dan memberikan output. Shell juga turut dikenali sebagai command line interface
Terdapat pelbagai shell untuk Unix/Linux. Korn shell atau POSIX shell adalah shell yang biasa di kebanyakkan jenis unix atau linux.
Kedudukan kernel dalam sistem komputer
Kedudukkan kernel pada sistem komputer adalah pada root directory yang mengandungi kedua-dua boot program dan fail yang mengandungi kernel untuk sistem. Kernel biasanya menpunyai pelbagai nama, berbeza dari pengilang mesin antara satu sama lain, tetapi kebiasannya ia mempunyai perkataan nix supaya pengguna dapat mencarinya dengan wildcard characters.
Sebagai contoh:
ls /*nix*
-rwxr—– 1 root 1558734 Sep 24 1992 /vmunix
Kesimpulan
Kernel adalah inti OS (Operating System)
Load Balancing TPLINK 2 WAN
Hardware
1. 2 modem adsl
modem a 192.168.5.1/24
modem b 192.168.4.1/24
2. Load Balancing 2 wan and 4 lan (192.168.1.1/24)
wan ip modem a 192.168.5.2/24
wan ip modem b 192.168.4.2/24
3. Mikrotik with pc using 2 etnertnet
Local –>> 192.168.0.30/27
Public ->> 192.168.1.2/24
4. linux proxy using 1 ethernet ( 192.168.1.3/24)
Detail Configuration
1. Loadbalancing Machine Using TPLINK
Router Status
Firmware Version: 3.5.0 Build 070423 Rel.31354s
Hardware Version: R480T+ v2
LAN
MAC Address: 00-19-E0-A3-24-3C
IP Address: 192.168.1.1
Subnet Mask: 255.255.255.0
WAN 1
Status: Link Up
MAC Address: 00-19-E0-A3-24-3D
IP Address: 192.168.5.2 Static IP
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.5.1
DNS Server: 203.130.193.74, 202.134.0.155
WAN 2
Status: Link Up
MAC Address: 00-19-E0-A3-24-3E
IP Address: 192.168.4.2 Static IP
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.4.1
DNS Server: 203.130.193.74, 202.134.0.155
Traffic Statistics
Received (Bytes) Sent (Bytes) Received (Packets) Sent (Packets)
Total 7429303 1853471 22800 21923
WAN 1 7248061 1671933 20351 19470
WAN 2 181242 181538 2449 2453
Load Balancing Flow
ID WAN Port Address Type protocol IP address(es) Port(s) Status Modify
1 prior to W2 source IP from LAN ALL 0.0.0.0-255.255.255.255 1-1000 Enabled
2 prior to W1 source IP from LAN ALL 0.0.0.0-255.255.255.255 1001-3127 Enabled
3 prior to W2 source IP from LAN ALL 0.0.0.0-255.255.255.255 3128 Enabled
4 prior to W1 source IP from LAN ALL 0.0.0.0-255.255.255.255 3129-8079 Enabled
5 prior to W2 source IP from LAN ALL 0.0.0.0-255.255.255.255 8080 Enabled
6 prior to W1 source IP from LAN ALL 0.0.0.0-255.255.255.255 8081-65000 Enabled
7 prior to W2 source IP from LAN ALL 0.0.0.0-255.255.255.255 5050-5061 Enabled
8 prior to W2 source IP from LAN ALL 0.0.0.0-255.255.255.255 6667-7000 Enabled
B. Mikrotik Configuration
/ interface ethernet
set Public name=”Public” mtu=1500 mac-address=00:15:E9:EF:86:FE arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=”" disabled=no
set Local name=”Local” mtu=1500 mac-address=00:01:02:97:D0:BE arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=”" disabled=no
set Proxy name=”Proxy” mtu=1500 mac-address=00:01:02:97:CE:C5 arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=”" disabled=no
/ interface wireless security-profiles
set default name=”default” mode=none authentication-types=”" \
unicast-ciphers=”" group-ciphers=”" wpa-pre-shared-key=”" \
wpa2-pre-shared-key=”" eap-methods=passthrough tls-mode=no-certificates \
tls-certificate=none static-algo-0=none static-key-0=”" static-algo-1=none \
static-key-1=”" static-algo-2=none static-key-2=”" static-algo-3=none \
static-key-3=”" static-transmit-key=key-0 static-sta-private-algo=none \
static-sta-private-key=”" radius-mac-authentication=no group-key-update=5m
/ interface wireless align
set frame-size=300 active-mode=yes receive-all=no \
audio-monitor=00:00:00:00:00:00 filter-mac=00:00:00:00:00:00 ssid-all=no \
frames-per-second=25 audio-min=-100 audio-max=-20
/ interface wireless snooper
set multiple-channels=yes channel-time=200ms receive-errors=no
/ interface wireless sniffer
set multiple-channels=no channel-time=200ms only-headers=no receive-errors=no \
memory-limit=10 file-name=”" file-limit=10 streaming-enabled=no \
streaming-server=0.0.0.0 streaming-max-rate=0
/ interface l2tp-server server
set enabled=no max-mtu=1460 max-mru=1460 \
authentication=pap,chap,mschap1,mschap2 default-profile=default-encryption
/ interface pptp-server server
set enabled=no max-mtu=1460 max-mru=1460 authentication=mschap1,mschap2 \
keepalive-timeout=30 default-profile=default-encryption
/ ip pool
add name=”dhcp_pool1″ ranges=192.168.0.1-192.168.0.29
/ ip telephony region
/ ip telephony gatekeeper
set gatekeeper=none remote-id=”" remote-address=0.0.0.0
/ ip telephony aaa
set use-radius-accounting=no interim-update=0s
/ ip telephony codec
move G.711-uLaw-64k/sw
move G.711-ALaw-64k/sw
move G.729A-8k/sw
move G.729-8k/sw
move G.723.1-6.3k/sw
move GSM-06.10-13.2k/sw
move LPC-10-2.5k/sw
/ ip accounting
set enabled=no account-local-traffic=no threshold=256
/ ip accounting web-access
set accessible-via-web=no address=0.0.0.0/0
/ ip service
set telnet port=23 address=0.0.0.0/0 disabled=no
set ftp port=21 address=0.0.0.0/0 disabled=no
set www port=80 address=0.0.0.0/0 disabled=no
set ssh port=22 address=0.0.0.0/0 disabled=no
set www-ssl port=443 address=0.0.0.0/0 certificate=none disabled=yes
/ ip upnp
set enabled=no allow-disable-external-interface=yes show-dummy-rule=yes
/ ip arp
/ ip socks
set enabled=no port=1080 connection-idle-timeout=2m max-connections=200
/ ip dns
set primary-dns=192.168.1.3 secondary-dns=202.134.0.155 \
allow-remote-requests=yes cache-size=2048KiB cache-max-ttl=1w
/ ip traffic-flow
set enabled=no interfaces=all cache-entries=4k active-flow-timeout=30m \
inactive-flow-timeout=15s
/ ip address
add address=192.168.1.2/24 network=192.168.1.0 broadcast=192.168.1.255 \
interface=Public comment=”" disabled=no
add address=192.168.0.30/27 network=192.168.0.0 broadcast=192.168.0.31 \
interface=Local comment=”" disabled=no
add address=192.168.2.1/30 network=192.168.2.0 broadcast=192.168.2.3 \
interface=Proxy comment=”" disabled=no
/ ip proxy
set enabled=no port=8080 parent-proxy=0.0.0.0:1 maximal-client-connecions=1000 \
maximal-server-connectons=1000
/ ip proxy access
add dst-port=23-25 action=deny comment=”block telnet & spam e-mail relaying” \
disabled=yes
/ ip neighbor discovery
set Public discover=yes
set Local discover=yes
set Proxy discover=yes
/ ip route
add dst-address=0.0.0.0/0 gateway=192.168.1.1 scope=255 target-scope=10 \
comment=”" disabled=no
/ ip firewall mangle
add chain=prerouting src-address=192.168.0.0/27 protocol=icmp \
action=mark-connection new-connection-mark=ICMP-CM passthrough=yes \
comment=”ToS” disabled=no
add chain=prerouting connection-mark=ICMP-CM action=mark-packet \
new-packet-mark=ICMP-PM passthrough=yes comment=”" disabled=no
add chain=prerouting packet-mark=ICMP-PM action=change-tos new-tos=min-delay \
comment=”" disabled=no
add chain=prerouting src-address=192.168.0.0/27 protocol=tcp dst-port=53 \
action=mark-connection new-connection-mark=DNS-CM passthrough=yes \
comment=”" disabled=no
add chain=prerouting src-address=192.168.0.0/27 protocol=udp dst-port=53 \
action=mark-connection new-connection-mark=DNS-CM passthrough=yes \
comment=”" disabled=no
add chain=prerouting connection-mark=DNS-CM action=mark-packet \
new-packet-mark=DNS-PM passthrough=yes comment=”" disabled=no
add chain=prerouting packet-mark=DNS-PM action=change-tos new-tos=min-delay \
comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=80 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=”Services” \
disabled=no
add chain=prerouting protocol=tcp dst-port=443 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=8080 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=3128 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=21 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=”" disabled=no
add chain=prerouting connection-mark=http_conn action=mark-packet \
new-packet-mark=http passthrough=no comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=5050-5061 action=mark-connection \
new-connection-mark=ym_conn passthrough=yes comment=”" disabled=no
add chain=prerouting connection-mark=ym_conn action=mark-packet \
new-packet-mark=ym passthrough=no comment=”" disabled=no
add chain=prerouting protocol=udp dst-port=27015 action=mark-connection \
new-connection-mark=cs_conn passthrough=yes comment=”" disabled=no
add chain=prerouting connection-mark=cs_conn action=mark-packet \
new-packet-mark=cs passthrough=no comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=6661-7000 action=mark-connection \
new-connection-mark=irc_conn passthrough=yes comment=”" disabled=no
add chain=prerouting connection-mark=irc_conn action=mark-packet \
new-packet-mark=irc passthrough=no comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=8291 action=mark-connection \
new-connection-mark=mt_conn passthrough=yes comment=”" disabled=no
add chain=prerouting connection-mark=mt_conn action=mark-packet \
new-packet-mark=mt passthrough=no comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=110 action=mark-connection \
new-connection-mark=email_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=25 action=mark-connection \
new-connection-mark=email_conn passthrough=yes comment=”" disabled=no
add chain=prerouting connection-mark=email_conn action=mark-packet \
new-packet-mark=email passthrough=no comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=22 action=mark-connection \
new-connection-mark=ssh_conn passthrough=yes comment=”" disabled=no
add chain=prerouting connection-mark=ssh_conn action=mark-packet \
new-packet-mark=ssh passthrough=no comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=500-3127 action=mark-connection \
new-connection-mark=games_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=3129-6665 action=mark-connection \
new-connection-mark=games_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=tcp dst-port=7001-65535 action=mark-connection \
new-connection-mark=games_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=udp dst-port=500-3127 action=mark-connection \
new-connection-mark=games_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=udp dst-port=3129-6660 action=mark-connection \
new-connection-mark=games_conn passthrough=yes comment=”" disabled=no
add chain=prerouting protocol=udp dst-port=7001-65535 action=mark-connection \
new-connection-mark=games_conn passthrough=yes comment=”" disabled=no
add chain=prerouting connection-mark=games_conn action=mark-packet \
new-packet-mark=games passthrough=no comment=”" disabled=no
add chain=prerouting src-address=192.168.0.0/27 action=mark-packet \
new-packet-mark=Naik passthrough=no comment=”Up Traffic” disabled=no
add chain=forward src-address=192.168.0.0/27 action=mark-connection \
new-connection-mark=Koneksi passthrough=yes comment=”Conn-Mark” \
disabled=no
add chain=forward in-interface=Public connection-mark=Koneksi \
action=mark-packet new-packet-mark=Turun passthrough=no \
comment=”Down-Direct Connection” disabled=no
add chain=output out-interface=Local dst-address=192.168.0.0/27 \
action=mark-packet new-packet-mark=Turun passthrough=no comment=”Down-Via \
Proxy” disabled=no
/ ip firewall nat
add chain=srcnat out-interface=Public action=masquerade comment=”Masquerading \
ke IP Public \[modem\]” disabled=no
add chain=dstnat protocol=tcp dst-port=80 dst-address-list=!servergames \
action=dst-nat to-addresses=192.168.1.3 to-ports=8080 comment=”" \
disabled=no
add chain=dstnat protocol=tcp dst-port=3128 dst-address-list=!servergames \
action=dst-nat to-addresses=192.168.1.3 to-ports=8080 comment=”" \
disabled=no
add chain=dstnat protocol=tcp dst-port=8000 dst-address-list=!servergames \
action=dst-nat to-addresses=192.168.1.3 to-ports=8080 comment=”" \
disabled=no
add chain=dstnat protocol=tcp dst-port=8080 dst-address-list=!servergames \
action=dst-nat to-addresses=192.168.1.3 to-ports=8080 comment=”" \
disabled=no
/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=5s tcp-syn-received-timeout=5s \
tcp-established-timeout=1d tcp-fin-wait-timeout=10s \
tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \
tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \
udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m \
tcp-syncookie=no
/ ip firewall filter
add chain=input connection-state=invalid action=drop comment=”Drop Invalid \
connections” disabled=no
add chain=input src-address=!192.168.0.0/27 protocol=tcp src-port=1024-65535 \
dst-port=8080 action=drop comment=”Block to Proxy” disabled=no
add chain=input protocol=udp dst-port=12667 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=udp dst-port=27665 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=udp dst-port=31335 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=udp dst-port=27444 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=udp dst-port=34555 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=udp dst-port=35555 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=tcp dst-port=27444 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=tcp dst-port=27665 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=tcp dst-port=31335 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=tcp dst-port=31846 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=tcp dst-port=34555 action=drop comment=”Trinoo” \
disabled=no
add chain=input protocol=tcp dst-port=35555 action=drop comment=”Trinoo” \
disabled=no
add chain=input connection-state=established action=accept comment=”Allow \
Established connections” disabled=no
add chain=input protocol=udp action=accept comment=”Allow UDP” disabled=no
add chain=input protocol=icmp action=accept comment=”Allow ICMP” disabled=no
add chain=input src-address=192.168.0.0/27 action=accept comment=”Allow access \
to router from known network” disabled=no
add chain=input src-address=192.168.1.0/24 action=accept comment=”" \
disabled=no
add chain=input action=drop comment=”Drop anything else” disabled=no
add chain=forward protocol=tcp connection-state=invalid action=drop \
comment=”drop invalid connections” disabled=no
add chain=forward connection-state=established action=accept comment=”allow \
already established connections” disabled=no
add chain=forward connection-state=related action=accept comment=”allow \
related connections” disabled=no
add chain=forward src-address=0.0.0.0/8 action=drop comment=”" disabled=no
add chain=forward dst-address=0.0.0.0/8 action=drop comment=”" disabled=no
add chain=forward src-address=127.0.0.0/8 action=drop comment=”" disabled=no
add chain=forward dst-address=127.0.0.0/8 action=drop comment=”" disabled=no
add chain=forward src-address=224.0.0.0/3 action=drop comment=”" disabled=no
add chain=forward dst-address=224.0.0.0/3 action=drop comment=”" disabled=no
add chain=forward protocol=tcp action=jump jump-target=tcp comment=”" \
disabled=no
add chain=forward protocol=udp action=jump jump-target=udp comment=”" \
disabled=no
add chain=forward protocol=icmp action=jump jump-target=icmp comment=”" \
disabled=no
add chain=tcp protocol=tcp dst-port=69 action=drop comment=”deny TFTP” \
disabled=no
add chain=tcp protocol=tcp dst-port=111 action=drop comment=”deny RPC \
portmapper” disabled=no
add chain=tcp protocol=tcp dst-port=135 action=drop comment=”deny RPC \
portmapper” disabled=no
add chain=tcp protocol=tcp dst-port=137-139 action=drop comment=”deny NBT” \
disabled=no
add chain=tcp protocol=tcp dst-port=445 action=drop comment=”deny cifs” \
disabled=no
add chain=tcp protocol=tcp dst-port=2049 action=drop comment=”deny NFS” \
disabled=no
add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment=”deny \
NetBus” disabled=no
add chain=tcp protocol=tcp dst-port=20034 action=drop comment=”deny NetBus” \
disabled=no
add chain=tcp protocol=tcp dst-port=3133 action=drop comment=”deny \
BackOriffice” disabled=no
add chain=tcp protocol=tcp dst-port=67-68 action=drop comment=”deny DHCP” \
disabled=no
add chain=udp protocol=udp dst-port=69 action=drop comment=”deny TFTP” \
disabled=no
add chain=udp protocol=udp dst-port=111 action=drop comment=”deny PRC \
portmapper” disabled=no
add chain=udp protocol=udp dst-port=135 action=drop comment=”deny PRC \
portmapper” disabled=no
add chain=udp protocol=udp dst-port=137-139 action=drop comment=”deny NBT” \
disabled=no
add chain=udp protocol=udp dst-port=2049 action=drop comment=”deny NFS” \
disabled=no
add chain=udp protocol=udp dst-port=3133 action=drop comment=”deny \
BackOriffice” disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list \
address-list=”port scanners” address-list-timeout=2w comment=”Port \
scanners to list ” disabled=no
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg \
action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w comment=”NMAP FIN Stealth scan” disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list \
address-list=”port scanners” address-list-timeout=2w comment=”SYN/FIN \
scan” disabled=no
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list \
address-list=”port scanners” address-list-timeout=2w comment=”SYN/RST \
scan” disabled=no
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack \
action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w comment=”FIN/PSH/URG scan” disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \
action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w comment=”ALL/ALL scan” disabled=no
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg \
action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w comment=”NMAP NULL scan” disabled=no
add chain=input src-address-list=”port scanners” action=drop comment=”dropping \
port scanners” disabled=no
add chain=icmp protocol=icmp icmp-options=0:0 action=accept comment=”drop \
invalid connections” disabled=no
add chain=icmp protocol=icmp icmp-options=3:0 action=accept comment=”allow \
established connections” disabled=no
add chain=icmp protocol=icmp icmp-options=3:1 action=accept comment=”allow \
already established connections” disabled=no
add chain=icmp protocol=icmp icmp-options=4:0 action=accept comment=”allow \
source quench” disabled=no
add chain=icmp protocol=icmp icmp-options=8:0 action=accept comment=”allow \
echo request” disabled=no
add chain=icmp protocol=icmp icmp-options=11:0 action=accept comment=”allow \
time exceed” disabled=no
add chain=icmp protocol=icmp icmp-options=12:0 action=accept comment=”allow \
parameter bad” disabled=no
add chain=icmp action=drop comment=”deny all other types” disabled=no
add chain=tcp protocol=tcp dst-port=25 action=reject \
reject-with=icmp-network-unreachable comment=”Smtp” disabled=no
add chain=tcp protocol=udp dst-port=25 action=reject \
reject-with=icmp-network-unreachable comment=”Smtp” disabled=no
add chain=tcp protocol=tcp dst-port=110 action=reject \
reject-with=icmp-network-unreachable comment=”Smtp” disabled=no
add chain=tcp protocol=udp dst-port=110 action=reject \
reject-with=icmp-network-unreachable comment=”Smtp” disabled=no
add chain=tcp protocol=udp dst-port=110 action=reject \
reject-with=icmp-network-unreachable comment=”Smtp” disabled=no
/ ip firewall address-list
add list=servergames address=202.93.20.214 comment=”" disabled=no
add list=servergames address=202.93.20.201 comment=”Rf” disabled=no
/ ip firewall service-port
set ftp ports=21 disabled=no
set tftp ports=69 disabled=yes
set irc ports=6667 disabled=no
set h323 disabled=yes
set quake3 disabled=yes
set gre disabled=yes
set pptp disabled=yes
/ ip hotspot service-port
set ftp ports=21 disabled=no
/ ip hotspot profile
set default name=”default” hotspot-address=0.0.0.0 dns-name=”" \
html-directory=hotspot rate-limit=”" http-proxy=0.0.0.0:0 \
smtp-server=0.0.0.0 login-by=cookie,http-chap http-cookie-lifetime=3d \
split-user-domain=no use-radius=no
/ ip hotspot user profile
set default name=”default” idle-timeout=none keepalive-timeout=2m \
status-autorefresh=1m shared-users=1 transparent-proxy=yes \
open-status-page=always advertise=no
/ ip dhcp-server
add name=”dhcp1″ interface=Local lease-time=3d address-pool=dhcp_pool1 \
bootp-support=static authoritative=after-2sec-delay disabled=no
/ ip dhcp-server config
set store-leases-disk=5m
/ ip dhcp-server lease
add address=192.168.0.1 mac-address=00:13:D3:E4:FA:52 \
client-id=”1:0:13:d3:e4:fa:52″ server=dhcp1 comment=”" disabled=no
add address=192.168.0.2 mac-address=00:13:D3:FD:36:98 \
client-id=”1:0:13:d3:fd:36:98″ server=dhcp1 comment=”" disabled=no
add address=192.168.0.3 mac-address=00:13:D3:E4:FA:9D \
client-id=”1:0:13:d3:e4:fa:9d” server=dhcp1 comment=”" disabled=no
add address=192.168.0.4 mac-address=00:13:D3:FD:02:7E \
client-id=”1:0:13:d3:fd:2:7e” server=dhcp1 always-broadcast=yes comment=”" \
disabled=no
add address=192.168.0.5 mac-address=00:13:D3:E4:FA:30 \
client-id=”1:0:13:d3:e4:fa:30″ server=dhcp1 comment=”" disabled=no
add address=192.168.0.6 mac-address=00:13:D3:FD:36:61 \
client-id=”1:0:13:d3:fd:36:61″ server=dhcp1 comment=”" disabled=no
add address=192.168.0.11 mac-address=00:18:F3:43:D4:66 \
client-id=”1:0:18:f3:43:d4:66″ server=dhcp1 comment=”" disabled=no
add address=192.168.0.10 mac-address=00:13:D3:FD:37:BA \
client-id=”1:0:13:d3:fd:37:ba” server=dhcp1 comment=”" disabled=no
add address=192.168.0.9 mac-address=00:13:D3:C9:E7:C1 \
client-id=”1:0:13:d3:c9:e7:c1″ server=dhcp1 comment=”" disabled=no
add address=192.168.0.8 mac-address=00:13:D3:FD:36:6A \
client-id=”1:0:13:d3:fd:36:6a” server=dhcp1 comment=”" disabled=no
add address=192.168.0.7 mac-address=00:13:D3:E4:FA:2A \
client-id=”1:0:13:d3:e4:fa:2a” server=dhcp1 comment=”" disabled=no
add address=192.168.0.18 mac-address=00:15:F2:93:B1:53 \
client-id=”1:0:15:f2:93:b1:53″ server=dhcp1 comment=”" disabled=no
add address=192.168.0.12 mac-address=00:18:F3:43:D4:7D \
client-id=”1:0:18:f3:43:d4:7d” server=dhcp1 comment=”" disabled=no
/ ip dhcp-server network
add address=192.168.0.0/27 gateway=192.168.0.30 \
dns-server=192.168.0.30,203.130.193.74,202.134.0.155 comment=”"
/ ip ipsec proposal
add name=”default” auth-algorithms=sha1 enc-algorithms=3des lifetime=30m \
lifebytes=0 pfs-group=modp1024 disabled=no
/ ip web-proxy
set enabled=no src-address=0.0.0.0 port=8080 hostname=”proxy” \
transparent-proxy=yes parent-proxy=0.0.0.0:0 \
cache-administrator=”webmaster” max-object-size=4096KiB cache-drive=system \
max-cache-size=unlimited max-ram-cache-size=unlimited
/ ip web-proxy access
add action=allow comment=”" disabled=yes
/ ip web-proxy cache
add url=”:cgi-bin \\?” action=deny comment=”don’t cache dynamic http pages” \
disabled=yes
/ ip web-proxy direct
add action=allow comment=”" disabled=yes
/ system logging
add topics=info prefix=”" action=disk disabled=no
add topics=error prefix=”" action=disk disabled=no
add topics=warning prefix=”" action=disk disabled=no
add topics=critical prefix=”" action=echo disabled=no
add topics=watchdog prefix=”" action=disk disabled=no
add topics=web-proxy prefix=”" action=disk disabled=no
add topics=debug prefix=”" action=disk disabled=no
add topics=firewall prefix=”" action=disk disabled=no
add topics=route prefix=”" action=disk disabled=no
/ system logging action
set memory name=”memory” target=memory memory-lines=100 memory-stop-on-full=no
set disk name=”disk” target=disk disk-lines=100 disk-stop-on-full=no
set echo name=”echo” target=echo remember=yes
set remote name=”remote” target=remote remote=0.0.0.0:514
/ system upgrade mirror
set enabled=no primary-server=0.0.0.0 secondary-server=0.0.0.0 \
check-interval=1d user=”"
/ system clock dst
set dst-delta=+00:00 dst-start=”jan/01/1970 00:00:00″ dst-end=”jan/01/1970 \
00:00:00″
/ system watchdog
set reboot-on-failure=yes watch-address=none watchdog-timer=yes \
no-ping-delay=5m automatic-supout=yes auto-send-supout=no
/ system console
add port=serial0 term=”" disabled=no
set FIXME term=”linux” disabled=no
set FIXME term=”linux” disabled=no
set FIXME term=”linux” disabled=no
set FIXME term=”linux” disabled=no
set FIXME term=”linux” disabled=no
set FIXME term=”linux” disabled=no
set FIXME term=”linux” disabled=no
set FIXME term=”linux” disabled=no
/ system console screen
set line-count=25
/ system identity
set name=”Oasis.war.net.id”
/ system note
set show-at-login=yes note=”"
/ system gps
set enabled=no set-system-time=yes
/ system lcd
set enabled=no type=24×4 port=parallel contrast=0
/ system lcd page
set time display-time=5s disabled=yes
set resources display-time=5s disabled=yes
set uptime display-time=5s disabled=yes
set packets display-time=5s disabled=yes
set bits display-time=5s disabled=yes
set version display-time=5s disabled=yes
set Public display-time=5s disabled=yes
set Local display-time=5s disabled=yes
set Proxy display-time=5s disabled=yes
/ system ntp server
set enabled=no broadcast=no multicast=no manycast=yes
/ system ntp client
set enabled=no mode=unicast primary-ntp=0.0.0.0 secondary-ntp=0.0.0.0
/ system routerboard bios
set
/ system health
set state-after-reboot=enabled
/ port
set serial0 name=”serial0″ baud-rate=9600 data-bits=8 parity=none stop-bits=1 \
flow-control=hardware
set serial1 name=”serial1″ baud-rate=9600 data-bits=8 parity=none stop-bits=1 \
flow-control=hardware
/ ppp profile
set default name=”default” use-compression=default use-vj-compression=default \
use-encryption=default only-one=default change-tcp-mss=yes comment=”"
set default-encryption name=”default-encryption” use-compression=default \
use-vj-compression=default use-encryption=yes only-one=default \
change-tcp-mss=yes comment=”"
/ ppp aaa
set use-radius=no accounting=yes interim-update=0s
/ queue type
set default name=”default” kind=pfifo pfifo-limit=50
set ethernet-default name=”ethernet-default” kind=pfifo pfifo-limit=50
set wireless-default name=”wireless-default” kind=sfq sfq-perturb=5 \
sfq-allot=1514
set synchronous-default name=”synchronous-default” kind=red red-limit=60 \
red-min-threshold=10 red-max-threshold=50 red-burst=20 red-avg-packet=1000
set hotspot-default name=”hotspot-default” kind=sfq sfq-perturb=5 \
sfq-allot=1514
add name=”pcq-download” kind=pcq pcq-rate=0 pcq-limit=50 \
pcq-classifier=dst-address pcq-total-limit=2000
add name=”pcq-upload” kind=pcq pcq-rate=0 pcq-limit=50 \
pcq-classifier=src-address pcq-total-limit=2000
add name=”PFIFO-64″ kind=pfifo pfifo-limit=64
add name=”default-small” kind=pfifo pfifo-limit=10
add name=”default-small” kind=pfifo pfifo-limit=10
/ queue simple
add name=”Q.war.net” target-addresses=192.168.0.0/24 dst-address=0.0.0.0/0 \
interface=Local parent=none packet-marks=http direction=both priority=1 \
queue=ethernet-default/ethernet-default limit-at=0/768000 \
max-limit=0/768000 total-queue=default disabled=no
add name=”Operator” target-addresses=192.168.0.18/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/64000 total-queue=default disabled=yes
add name=”Meja-1″ target-addresses=192.168.0.1/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-2″ target-addresses=192.168.0.2/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-3″ target-addresses=192.168.0.3/32 dst-address=0.0.0.0/0 \
interface=all parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-4″ target-addresses=192.168.0.4/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-5″ target-addresses=192.168.0.5/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-6″ target-addresses=192.168.0.6/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-7″ target-addresses=192.168.0.7/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-8″ target-addresses=192.168.0.8/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-9″ target-addresses=192.168.0.9/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
add name=”Meja-10″ target-addresses=192.168.0.10/32 dst-address=0.0.0.0/0 \
interface=Local parent=Q.war.net packet-marks=http direction=both \
priority=8 queue=ethernet-default/ethernet-default limit-at=0/8000 \
max-limit=16000/48000 total-queue=default disabled=no
/ queue tree
add name=”ICMP” parent=global-in packet-mark=ICMP-PM limit-at=8000 \
queue=PFIFO-64 priority=1 max-limit=16000 burst-limit=0 burst-threshold=0 \
burst-time=0s disabled=no
add name=”DNS” parent=global-in packet-mark=DNS-PM limit-at=8000 \
queue=PFIFO-64 priority=1 max-limit=16000 burst-limit=0 burst-threshold=0 \
burst-time=0s disabled=no
add name=”downstream” parent=Local packet-mark=Turun limit-at=0 \
queue=pcq-download priority=1 max-limit=0 burst-limit=0 burst-threshold=0 \
burst-time=0s disabled=no
add name=”upstream” parent=global-in packet-mark=Naik limit-at=0 \
queue=pcq-upload priority=1 max-limit=0 burst-limit=0 burst-threshold=0 \
burst-time=0s disabled=no
/ user
add name=”admin” group=full address=0.0.0.0/0 comment=”system default user” \
disabled=no
/ user group
add name=”read” policy=local,telnet,ssh,reboot,read,test,winbox,password,web,!f\
tp,!write,!policy
add name=”write” policy=local,telnet,ssh,reboot,read,write,test,winbox,password\
,web,!ftp,!policy
add name=”full” policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbo\
x,password,web
/ user aaa
set use-radius=no accounting=yes interim-update=0s default-group=read
/ radius incoming
set accept=yes port=1700
/ driver
/ snmp
set enabled=yes contact=”admin” location=”admin”
/ snmp community
set public name=”public” address=0.0.0.0/0 read-access=yes
/ tool bandwidth-server
set enabled=yes authenticate=yes allocate-udp-ports-from=2000 max-sessions=10
/ tool mac-server ping
set enabled=yes
/ tool e-mail
set server=0.0.0.0 from=”<>”
/ tool sniffer
set interface=all only-headers=no memory-limit=10 file-name=”" file-limit=10 streaming-enabled=no streaming-server=0.0.0.0 \
filter-stream=yes filter-protocol=ip-only filter-address1=0.0.0.0/0:0-65535 filter-address2=0.0.0.0/0:0-65535
/ tool graphing
set store-every=5min
/ tool graphing queue
add simple-queue=all allow-address=0.0.0.0/0 store-on-disk=yes allow-target=yes disabled=no
/ tool graphing resource
add allow-address=0.0.0.0/0 store-on-disk=yes disabled=no
/ tool graphing interface
add interface=all allow-address=0.0.0.0/0 store-on-disk=yes disabled=no
/ routing ospf
set router-id=0.0.0.0 distribute-default=never redistribute-connected=no redistribute-static=no redistribute-rip=no \
redistribute-bgp=no metric-default=1 metric-connected=20 metric-static=20 metric-rip=20 metric-bgp=20
/ routing ospf area
set backbone area-id=0.0.0.0 type=default translator-role=translate-candidate authentication=none prefix-list-import=”" \
prefix-list-export=”" disabled=no
/ routing bgp
set enabled=no as=1 router-id=0.0.0.0 redistribute-static=no redistribute-connected=no redistribute-rip=no \
redistribute-ospf=no
/ routing rip
set redistribute-static=no redistribute-connected=no redistribute-ospf=no redistribute-bgp=no metric-static=1 \
metric-connected=1 metric-ospf=1 metric-bgp=1 update-timer=30s timeout-timer=3m garbage-timer=2m
C. proxy server setting
[root@proxy ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0
]DEVICE=eth0
BOOTPROTO=static
BROADCAST=192.168.1.255
HWADDR=00:02:B3:30:64:CD
IPADDR=192.168.1.3
NETMASK=225.255.255.0
NETWORK=192.168.1.0
ONBOOT=yes
TYPE=Ethernet
[root@proxy ~]# route -v
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
169.254.0.0 * 255.255.0.0 U 0 0 0 eth0
default 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
[root@proxy ~]# cat /etc/resolv.conf
search oasis.war.net.id
nameserver 192.168.1.1
nameserver 203.130.193.74
nameserver 202.134.0.155
[root@proxy ~]#
insert in /etc/named
forwarders {
192.168.1.1;
203.130.193.74;
202.134.0.155;
202.134.2.5;
};
[root@proxy ~]# cat /etc/squid/squid.conf
http_port 8080
#icp_port 3130
icp_query_timeout 0
maximum_icp_query_timeout 5000
mcast_icp_query_timeout 2000
dead_peer_timeout 10 seconds
hierarchy_stoplist cgi-bin ? localhost
acl QUERY urlpath_regex cgi-bin \? localhost
### Opsi Cache
cache_mem 6 MB
cache_swap_low 98
cache_swap_high 99
maximum_object_size 128 MB
minimum_object_size 0 KB
maximum_object_size_in_memory 32 KB
ipcache_size 10240
ipcache_low 98
ipcache_high 99
fqdncache_size 256
cache_replacement_policy heap LFUDA
memory_replacement_policy heap GDSF
### Opsi Tuning Squid
refresh_pattern -i \.(swf|png|jpg|jpeg|bmp|tiff|png|gif) 43200 90% 129600 reload-into-ims override-lastmod
refresh_pattern -i \.(mov|mpg|mpeg|flv|avi|mp3|3gp|sis|wma) 43200 90% 129600 reload-into-ims override-lastmod
refresh_pattern -i \.(zip|rar|ace|bz|bz2|tar|gz|exe) 43200 90% 129600 reload-into-ims override-lastmod
refresh_pattern -i (.*html$|.*htm|.*shtml|.*aspx|.*asp) 43200 90% 1440 reload-into-ims override-lastmod
refresh_pattern ^http://*.google.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*korea.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.akamai.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.windowsmedia.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.googlesyndication.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.plasa.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.telkom.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://www.friendster.com/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://mail.yahoo.com/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.yahoo.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.yimg.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.gmail.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^http://*.detik.*/.* 720 100% 4320 reload-into-ims override-lastmod
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern ^ftp: 43200 90% 129600 reload-into-ims override-expire
refresh_pattern . 180 95% 120960 reload-into-ims override-lastmod
### Direktori cache
#cache_dir aufs /cache 20000 16 256
#cache_dir diskd /squid/cache 70000 16 256 Q1=72 Q2=88
cache_dir aufs /cache 30000 16 256
### Log
cache_access_log /var/log/squid/access.log
logfile_rotate 1
cache_log none
cache_store_log none
emulate_httpd_log off
log_ip_on_direct on
log_fqdn off
log_icp_queries off
### DNS server
dns_nameservers 127.0.0.1
quick_abort_min 0
quick_abort_max 0
quick_abort_pct 98%
negative_ttl 15 minute
positive_dns_ttl 24 hours
negative_dns_ttl 5 minutes
range_offset_limit 0 KB
### Opsi Timeout
connect_timeout 1 minute
peer_connect_timeout 5 seconds
read_timeout 30 minute
request_timeout 1 minute
#client_lifetime 10 hour
half_closed_clients off
pconn_timeout 15 second
shutdown_lifetime 15 second
### Opsi ACL
acl manager proto cache_object
acl all src 0.0.0.0/0.0.0.0
acl client src 192.168.0.0/24 192.168.1.0/29
acl file_terlarang url_regex -i hot_indonesia.exe
acl file_terlarang url_regex -i hotsurprise_id.exe
acl file_terlarang url_regex -i best-mp3-download.exe
acl file_terlarang url_regex -i R32.exe
acl file_terlarang url_regex -i rb32.exe
acl file_terlarang url_regex -i mp3.exe
acl file_terlarang url_regex -i HOTSEX.exe
acl file_terlarang url_regex -i Browser_Plugin.exe
acl file_terlarang url_regex -i DDialer.exe
acl file_terlarang url_regex -i od-teen
acl file_terlarang url_regex -i URLDownload.exe
acl file_terlarang url_regex -i od-stnd67.exe
acl file_terlarang url_regex -i Download_Plugin.exe
acl file_terlarang url_regex -i od-teen52.exe
acl file_terlarang url_regex -i malaysex
acl file_terlarang url_regex -i edita.html
acl file_terlarang url_regex -i info.exe
acl file_terlarang url_regex -i run.exe
acl file_terlarang url_regex -i Lovers2Go
acl file_terlarang url_regex -i GlobalDialer
acl file_terlarang url_regex -i WebDialer
acl file_terlarang url_regex -i britneynude
acl file_terlarang url_regex -i download.exe
acl file_terlarang url_regex -i backup.exe
acl file_terlarang url_regex -i GnoOS2003
acl file_terlarang url_regex -i wintrim.exe
acl file_terlarang url_regex -i MPREXE.EXE
acl file_terlarang url_regex -i exengd.EXE
acl file_terlarang url_regex -i xxxvideo.exe
acl file_terlarang url_regex -i Save.exe
acl file_terlarang url_regex -i ATLBROWSER.DLL
acl file_terlarang url_regex -i NawaL_rm
acl file_terlarang url_regex -i Socks32.dll
acl file_terlarang url_regex -i Sc32Lnch.exe
acl file_terlarang url_regex -i dat0.exe
acl IIX dst_as 7713 4622 4795 7597 4787 4795 4800
#acl block url_regex -i \.(aiff|asf|avi|dif|divx|mov|movie|mp3|mpe?g?|mpv2|ogg|ra?m|snd|qt|wav|wmf|wmv)$
acl local-domain dstdomain localhost
acl Bad_ports port 7 9 11 19 22 23 25 53 110 119 513 514
acl Safe_ports port 21 70 80 210 443 488 563 591 777 1025-65535
acl Virus urlpath_regex winnt/system32/cmd.exe?
acl connect method CONNECT
acl post method POST
acl ssl method CONNECT
acl purge method PURGE
acl IpAddrProbeUA browser ^Mozilla/4.0.\(compatible;.MSIE.5.5;.Windows.98\)$
acl IpAddrProbeURL url_regex //[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/$
no_cache deny QUERY manager
http_access allow manager IIX Safe_ports
http_access allow client
http_access deny Bad_ports Virus IpAddrProbeUA IpAddrProbeURL
http_access deny file_terlarang
http_access deny all
### Paramater Administratif
cache_mgr support@oasis.war.net.id
cache_effective_user squid
cache_effective_group squid
visible_hostname proxy.oasis.war.net.id
### Opsi Akselerator
memory_pools off
forwarded_for on
log_icp_queries off
icp_hit_stale on
minimum_direct_hops 4
minimum_direct_rtt 400
store_avg_object_size 13 KB
store_objects_per_bucket 20
client_db on
netdb_low 9900
netdb_high 10000
netdb_ping_period 30 seconds
query_icmp off
pipeline_prefetch on
reload_into_ims on
pipeline_prefetch on
vary_ignore_expire on
max_open_disk_fds 100
nonhierarchical_direct on
prefer_direct off
### Pendukung Transparan Proxy
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
### Membatasi Besar File untuk download
#reply_body_max_size 3512000 deny !client
### SNMP
#snmp_port 3401
#acl snmppublic snmp_community public
#snmp_access allow all
header_access User-Agent deny all
header_replace User-Agent Mozilla/5.0 (compatible; MSIE 6.0)
header_access Accept deny all
header_replace Accept */*
header_access Accept-Language deny all
header_replace Accept-Language id, en
