Cara Memisahkan Browse, Download, Upload, Dan Game

Settingan ini Berjalan Pada Mikrotik RB750 OS ver.4.5 Dan percobaan Ini dilakukan pada mikrotik PC dengan Mikrotik Versi V2.9.27

Siapkan Perangkat PC dan Instal Mikrotik V2.9.27

• Lan Card 1 menuju ISP dalam settingan ini menggunakan Speedy "Jaringan Speedy"
• Lan Card 2 Menuju Jaringan Local dengan nama "Jaringan Local"
• Setting IP untuk Lan 1 (Baca Tutorial Instal Mikrotik)
• setting IP untuk Lan 2 (disini IP : 192.168.0.0/24

Settingan Yang akan Dilakukan :

• GAME Poin Blank
• Game Poker
• BROWSING
• UPLOAD
• LIMIT DOWNLOAD
• QUEUE

Tahapan atau teknik setting seperti berikut :

• Settingan Untuk GAME Poin Blank

contoh buat Point Blank, game lain sesuaikan aja port/ip nya

Untuk Perintah Dibawah buatkan Pada bagian IP-Firewall-Mangle

-------------------------------------------------------------------------------------------------
chain=game action=mark-connection new-connection-mark=Game passthrough=yes protocol=tcp dst-address=203.89.146.0/23 dst-port=39190 comment=”Point Blank”
-------------------------------------------------------------------------------------------------
chain=game action=mark-connection new-connection-mark=Game passthrough=yes protocol=udp dst-address=203.89.146.0/23 dst-port=40000-40010
-------------------------------------------------------------------------------------------------
chain=game action=mark-packet new-packet-mark=Game_pkt passthrough=no connection-mark=Game
-------------------------------------------------------------------------------------------------
chain=prerouting action=jump jump-target=game
-------------------------------------------------------------------------------------------------

• Settingan Untuk GAME Poker

Untuk Perintah Dibawah buatkan Pada bagian IP-Firewall-Mangle

-------------------------------------------------------------------------------------------------
chain=forward action=mark-connection new-connection-mark=Poker_con passthrough=yes protocol=tcp dst-address-list=LOAD POKER comment=”POKER”
-------------------------------------------------------------------------------------------------
chain=forward action=mark-connection new-connection-mark=Poker_con passthrough=yes protocol=tcp content=statics.poker.static.zynga.com
-------------------------------------------------------------------------------------------------
chain=forward action=mark-packet new-packet-mark=Poker passthrough=no connection-mark=Poker_con
-------------------------------------------------------------------------------------------------

• BROWSING

-------------------------------------------------------------------------------------------------
chain=forward action=mark-connection new-connection-mark=http passthrough=yes protocol=tcp in-interface=WAN out-interface=Lan packet-mark=!Game_pkt connection-mark=!Game connection-bytes=0-262146 comment=”BROWSE”
-------------------------------------------------------------------------------------------------
chain=forward action=mark-packet new-packet-mark=http_pkt passthrough=no protocol=tcp connection-mark=http
-------------------------------------------------------------------------------------------------
chain=forward action=mark-packet new-packet-mark=http_pkt passthrough=no protocol=tcp connection-mark=http
-------------------------------------------------------------------------------------------------

• UPLOAD

-------------------------------------------------------------------------------------------------
chain=prerouting action=mark-packet new-packet-mark=Upload passthrough=no protocol=tcp src-address=192.168.0.0/24 in-interface=Lan packet-mark=!icmp_pkt comment=”UPLOAD”
-------------------------------------------------------------------------------------------------

• LIMIT DOWNLOAD

-------------------------------------------------------------------------------------------------
chain=forward action=mark-connection new-connection-mark=Download passthrough=yes protocol=tcp in-interface=WAN out-interface=Lan packet-mark=!Game_pkt connection-mark=!Poker_con connection bytes=262146-4294967295 comment=”LIMIT DOWNLOAD”
-------------------------------------------------------------------------------------------------
chain=forward action=mark-packet new-packet-mark=Download_pkt passthrough=no packet-mark=!Game_pk> connection-mark=Download
-------------------------------------------------------------------------------------------------

• QUEUE

Queue Type
-------------------------------------------------------------------------------------------------
name=”Download” kind=pcq pcq-rate=256000 pcq-limit=50 pcq-classifier=dst-address pcq-total-limit=2000

name=”Http” kind=pcq pcq-rate=1M pcq-limit=50 pcq-classifier=dst-address pcq-total-limit=2000

name=”Game” kind=pcq pcq-rate=0 pcq-limit=50 pcq-classifier=src-address,dst-address,src-port,dst-port pcq-total-limit=2000

name=”Upload” kind=pcq pcq-rate=0 pcq-limit=50 pcq-classifier=src-address pcq-total-limit=2000
-------------------------------------------------------------------------------------------------

Queue Tree
-------------------------------------------------------------------------------------------------
name=”Main Browse” parent=Lan limit-at=0 priority=8 max-limit=1M burst-limit=0 burst-threshold=0 burst-time=0s

name=”Browse” parent=Main Browse packet-mark=http_pkt limit-at=0 queue=Http priority=8 max-limit=1M burst-limit=0 burst-threshold=0 burst-time=0s

name=”Game” parent=global-total packet-mark=Game_pkt limit-at=0 queue=Game priority=1 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s

name=”Poker” parent=global-out packet-mark=Poker limit-at=0 queue=Game priority=3 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s

name=”Download” parent=global-out packet-mark=Download_pkt limit-at=0 queue=Download priority=8 max-limit=256k burst-limit=0 burst-threshold=0 burst-time=0s

name=”Main Upload” parent=global-in limit-at=0 priority=8 max-limit=256k burst-limit=0 burst-threshold=0 burst-time=0s

name=”Upload” parent=Main Upload packet-mark=Upload limit-at=0 queue=Upload priority=8 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s

cara memisahkan bandwidth siang dan malam hari dengan mikrotik

Contoh kasus sederhana ,Anda memiliki 3 jenis pengguna:
- 256k/256k pada siang hari, 1M/1M di malam hari
- 512k/512k pada siang  hari, 2M/2M di sore hari
- 1M/1M pada siang hari, 4M/4M di malam hari
pertama yang kita lakukan adalah Pengaturan NTP Client dengan menggunakan perintah berikut :

/system ntp client
set enabled=yes mode=unicast primary-ntp=213.239.154.12 secondary-ntp=213.249.66.35

setelah itu instal queues  nya , dengan perintah :

/queue simple
 add comment="CAT1" direction=both disabled=no dst-address=192.168.4.15/32 \
 max-limit=256000/256000 name="George_CAT1" parent=none priority=8 \
 queue=default-small/default-small
 add comment="CAT1" direction=both disabled=no dst-address=192.168.4.16/32 \
 max-limit=256000/256000 name="Robinson_CAT1" parent=none priority=8 \
 queue=default-small/default-small
 add comment="CAT2" direction=both disabled=no dst-address=192.168.4.17/32 \
 max-limit=512000/512000 name="Crusoe_CAT2" parent=none priority=8 \
 queue=default-small/default-small
 add comment="CAT3" direction=both disabled=no dst-address=192.168.4.18/32 \
 max-limit=1024000/1024000 name="Momma_CAT3" parent=none priority=8 \
 queue=default-small/default-small

setelah itu barulah kita pisahkan limit bandwidth siang dan malam nya :
untuk “siang” limits:

/system scheduler
add comment="" disabled=no interval=1d name="Day" on-event="/queue simple\r\nset [find \
    comment=CAT1] max-limit=256000/256000\r\nset [find comment=CAT2] \
    max-limit=512000/512000\r\nset [find comment=CAT3] max-limit=1024000/1024000\r\n" \
    start-date=jan/01/1970 start-time=06:00:00

untuk “malam” limits:

/system scheduler
 add comment="" disabled=no interval=1d name="Night" on-event="/queue simple\r\nset [find \
 comment=CAT1] max-limit=1024000/1024000\r\nset [find comment=CAT2] \
 max-limit=2048000/2048000\r\nset [find comment=CAT3] max-limit=4096000/4096000\r\n" \
 start-date=jan/01/1970 start-time=18:00:00

Nah, dalam teks yang jelas, mereka terlihat seperti ini:
Siang:

/queue simple
set [find comment=CAT1] max-limit=256000/256000
set [find comment=CAT2] max-limit=512000/512000
set [find comment=CAT3] max-limit=1024000/1024000

Malam:

/queue simple
set [find comment=CAT1] max-limit=1024000/1024000
set [find comment=CAT2] max-limit=2048000/2048000
set [find comment=CAT3] max-limit=4096000/4096000

Setiap script diletakkan untuk berjalan pada interval 1 hari, “Siang” Script dimulai pukul 06.00, “Malam” Script dimulai pukul 18.00.

Cara Pengamanan Mikrotik dari Scan Winbox dan Neighbour

Kadang kala para ISP atau penyedia jasa layanan tidak terlalu jeli untuk melindungi customernya. Terutama ketika melindungi router pelanggan yang menggunakan Mikrotik RouterOS(tm). Dengan menjalankan IP >> Neighbor kita bisa melihat router mikrotik lainnya yang secara fisik terhubung dengan router kita melalui jaringan di provider kita.
Untuk itu kita bisa melindunginya dengan berbagai cara misalnya memblok scan dari winbox dan neighbor kita. Berikut adalah cara yang paling mudah :

Code:

admin@mikrotik] interface bridge> filter print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; block discovery mikrotik
chain=forward in-interface=ether1 mac-protocol=ip dst-port=5678
ip-protocol=udp action=drop
1 ;;; block discovery mikrotik
chain=input in-interface=ether1 mac-protocol=ip dst-port=5678
ip-protocol=udp action=drop
2 ;;; block discovery mikrotik
chain=output mac-protocol=ip dst-port=5678 ip-protocol=udp action=drop
3 ;;; block discovery mikrotik
chain=input in-interface=ether1 mac-protocol=ip dst-port=8291
ip-protocol=tcp action=drop
4 ;;; block winbox mikrotik
chain=forward in-interface=ether1 mac-protocol=ip dst-port=8291
ip-protocol=tcp action=drop
5 ;;; block request DHCP
chain=input mac-protocol=ip dst-port=68 ip-protocol=udp action=drop
6 ;;; block request DHCP
chain=forward mac-protocol=ip dst-port=68 ip-protocol=udp action=drop
7 ;;; block request DHCP
chain=output mac-protocol=ip dst-port=68 ip-protocol=udp action=drop

Dengan perintah tersebut kita bisa menutup beberapa scan terutama yang menggunakan winbox dan ip neighbor. Port diatas adalah bagian dari share Mikrotik RouterOS yang memang di perlukan untuk monitoring.

Sumber: http://tutorial.multisolusi.com


Untuk bisa router mencatat semua IP para scanner dan kemudian dimasukkan kedalam daftar IP Address dan dinamakan dalam group "port scanner", berikut rule pada firewall-nya :

Code:

add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w comment=”Port scanners to list ” disabled=no

Untuk menindaklajuti rule diatas, berikut rule utk mendropkannya :

Code:

add chain=input src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no

Otomatis Mikrotik akan memainkan rule tsb.

Tambahan rule sebelum menggunakan aturan 2 :

Code:

add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”NMAP FIN Stealth scan”

add chain=input protocol=tcp tcp-flags=fin,syn
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”SYN/FIN scan”

add chain=input protocol=tcp tcp-flags=syn,rst
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”SYN/RST scan”

add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”FIN/PSH/URG scan”

add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”ALL/ALL scan”

add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”NMAP NULL scan”