bagi rekan rekan yg ingin melakukan pengecekan proxy dengan melihat service squid dan test dari mikrotik berikut caranya di mesin proxy sudah ada web yg berjalan dan buat file test.txt di root webnya, terserah mau isi apa, tapi saran saya kasih text seminim mungkin di file tersebut

selanjutnya mari kita buat script beikut :

/system clock manual
set dst-delta=+07:00 dst-end="jan/01/1970 00:00:00" dst-start=\
"jan/01/1970 00:00:00" time-zone=+07:00
/system ntp client
set enabled=yes mode=unicast primary-ntp=202.134.1.10 secondary-ntp=\
152.118.24.8

/system scheduler
add comment="" disabled=no interval=10s name=Check_Proxy on-event=PROXY \
policy=reboot,read,write,policy,test,password,sniff,sensitive start-date=\
jan/01/1970 start-time=00:00:00
/system script
add name=Check-proxy policy=\
ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive source="\
{\r\
\n:local checkpage \"test.txt\";\r\
\n:local found \"0\" ;\r\
\n:foreach i in=[/file find] do={\r\
\n:local filename [/file get \$i name];\r\
\n:if ( \$filename = \$checkpage) do={ \r\
\n:set found \"1\" ; \r\
\n:log info \"found\"; \r\
\n}\r\
\n}\r\
\n:log warning \"\$found\";\r\
\n:if ( \$found = \"0\" ) do={ \r\
\n:log warning \"Disable rule, service down\"; \r\
\n/ip fire nat dis 3 ; \r\
\n/ip fire mang dis 14; \r\
\n} else={ \r\
\n:log info \"Enable rule, service up\"; \r\
\n/ip fire nat en 3; \r\
\n/ip fire mang en 14; \r\
\n}\r\
\n/file remove \$checkpage;\r\
\n}\r\
\n"
add name=Download policy=\
ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive source="\
{\r\
\n/tool fetch url=\"http://192.168.99.2/test.txt\" mode=http port=3128\r\
\n}"
add name=PROXY policy=\
ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive source="\
{\r\
\n/system script run Check-proxy;\r\
\n:delay delay-time=2\r\
\n/system script run Download \r\
\n}\r\
\n"

untuk yg saya bold dan warna merah itu sesuaikan dengan nat atau mangle yg ingin anda disable atau enable Source : http://www.forummikrotik.com/showthread.php/20546-Check-proxy-dari-mikrotik-%28melihat-service-squid%29

1. Ayo Dance : tcp 18901-18909
2. SealOnline : tcp 1818
3. PointBlank : tcp 39100,39110,39220,39190,49100, udp 40000-40010
4. Lineage2 : tcp 7777
5. GhostOnline : tcp 19101
6. RF-Elven : tcp 27780
7. Perfect world : tcp 29000
8. Rohan : tcp 22100
9. Zeus RO : tcp 5121
10. Dotta : tcp 6000-6152

Apabila clien menggunakan software download manager ternyata trafficnya bisa lolos dari PCQ .
Maka dari itu saya buatkan rule baru untuk mengatasi problem itu.

Bikin dulu IP list bypass untuk klien kita contoh :

• IP Klien 192.168.xx.xx
• IP modem
• IP Proxy external yang di pakai
• IP website/homepage kita
• Dll…

dengan maksud supaya tidak ikut terlimit, saya tandai dengan address-list bypass

Kali ini, saya akan mencoba membagi pengetahuan aku mengenai instalasi mikrotik. Setelah konsultasi ama mbah google, akhirnya sukses juga dalam melakukan installasi mikrotik. Ternyata instalasi mikrotik tidak sesulit yang aku kira, waktu yang diperlukan dalam penginstalannya pun cukup singkat, berlangsung 10 sampai 20 menit saja.

Menarik bukan.......?
Bagi yang belum punya sofware mikrotik, silahkan bisa langsung download dari situs resmisnya, anda bisa langsung download disini. Ukurannya lumayan kecil kog, sekitar 17 Mb.

1. Buat Conn Mark
WINBOX > IP > FIREWALL > MANGLE>
[+] ADD NEW
chain = Prerouting
protocol = TCP(6)
src Port = 21,80 ( umumnya download ambil dari port 80 dan 21 ( http dan ftp ) )
in interface = ETHER 1
(masuk ke TAB advance)
connection bytes = 262146-4294967295 ( artinya batas file ter kecil yang kena filter 256kb)
(masuk TAB action)
Action = mark connection
New Connection Mark = Download
Passtrough = [V] <- centang

bahan :
- RB750 VER 4.9
- 2 Line Speedy Paket Office
- Ubuntu Versi 10.04

SISI MIKROTIK :
/ip adrress
 
  - 172.19.196.1/24 interface proxy
  - 192.168.88.1/24 interface lan
  - 192.168.1.1/24  interface modem-1
  - 192.168.2.1/24  interface modem-2

catatan : - dial lewat mikrotik dgn modem sbg brigde
          - ip mesin ubuntu 172.19.196.100
             

Langkah demi langkah

MASUKKAN CD UBUNTU KE CDROM DAN REBOOT KOMPUTERNYA " hehehe.....
‘- Pilih language english (enter)
‘- Pilih instal ubuntu server (enter)
‘ -Tekan enter pada choose langguage english
‘- Pilih united states
‘- Klik no pada detect keyboard layout?
‘- Klik USA pada ubuntu installer main menu
‘- Klik USA pada keyboard layout
‘- Klik continue pada configure the network
‘- Pilih configure network manually isi ip address dg 172.19.196.100 pilih continue enter
‘- Netmask 255.255.255.0 pilih continue enter
‘- Gateway 172.19.196.1 terus klik continue
‘- Name server addresses 172.19.196.1 pilih continue enter
‘- Hotsnama : isi dg proxyku terus pilih continue enter
‘- Domain name: di kosongin saja, pilih continue enter
‘- Pada configure the clok pilih select from worldwide list terus cari jakarta terus enter

Connection-byte : membaca byte yg telah tercapai dari suatu connection yg terjadi
Connection-rate : membaca bit / speed yg telah terjadi dari suatu connection


Seumber : Semua situs yang saya jelajahi - special www.forummikrotik.com

Berdasarkan tutorial2 yang sudah ada di internet tentang setting queue tree mikrotik, maka saya ambil kesimpulan untuk rule yang baik dan efektif menurut saya dan mungkin bisa anda terapkan juga.

Contoh Kasus :

Warnet
Bandwidth  Total= 512k
Jumlah Client = 8
ip router Mikrotik = 192.168.1.1
ip client = 192.168.1.2-192.168.1.9

Queue Simple Mikrotik Referency...

Suorce : All my Loock Site...

How to Setting Mikrotik Limit Bandwidht

After you install Mikrotik As Gateway ,mikrotik As DHCP server, and Now, To Control Traffic internet you can make Limit Bandwidht uses Queue Simple Or Queue Tree

A. Uses Simple Queue

1. Log in From Winbox

2. If you success, you can enter to Winbox configuration setting

3. Click Queue and add new Simple Queue

in General Tab

- Set name = Client 1

- Target address = Ip that would in the Limit bandwidht. example: 123.123.123.0/24

- Max-Limit = Maximum bandwidht you can give for Download and Upload

example: 64k/64k

4. In Simple Queue setting, Click Advance

- set interface = Local

- set Limita-at = 32k/32k

5. Apply and Ok

A great number of IP that entered to server, could that client that want to enter. just direct block ip and mac address him from firewall configuration

1. Login to mikrotik used Winbox

2. then from winbox block ip

/ip firewall filter add chain=forward src-address=123.123.123.10 action=drop

3. Block ip and Mac address

from winbox

ip firewall filter add chain=forward src-address=123.123.123.10 src-mac-address= oe:09:j8:kl:9a

And don’t forget to be given the sign (! ) nearby left this MAC OK

4. To Tab Action chose Action: drop

5. click “apply” and “ok”

Source : http://mikrotik.unimedcenter.org/?p=18

Server Mikrotik least had 3 NIC

1. ether1 —>Astinet
2. ether2 —>Jardiknas
3. ether3 —>Lan

Steps:

After we install mikrotik router os, and afterwards tried browsing from the client’s computer, we felt that router that already finish. afterwards I was opened winbox from the client’s computer, evidently ip mikrotik router property of all the offices could be seen . this meant to give the gap to the person that to test hack the route.

Now you as the network administrator could prevent it, with configuration firewall in mikrotik

1. setting this configuration

admin@mikrotik] interface bridge> filter print
Flags: X – disabled, I – invalid, D – dynamic
0 ;;; block discovery mikrotik
chain=forward in-interface=ether1 mac-protocol=ip dst-port=5678
ip-protocol=udp action=drop
1 ;;; block discovery mikrotik
chain=input in-interface=ether1 mac-protocol=ip dst-port=5678
ip-protocol=udp action=drop
2 ;;; block discovery mikrotik
chain=output mac-protocol=ip dst-port=5678 ip-protocol=udp action=drop
3 ;;; block discovery mikrotik
chain=input in-interface=ether1 mac-protocol=ip dst-port=8291
ip-protocol=tcp action=drop
4 ;;; block winbox mikrotik
chain=forward in-interface=ether1 mac-protocol=ip dst-port=8291
ip-protocol=tcp action=drop
5 ;;; block request DHCP
chain=input mac-protocol=ip dst-port=68 ip-protocol=udp action=drop
6 ;;; block request DHCP
chain=forward mac-protocol=ip dst-port=68 ip-protocol=udp action=drop
7 ;;; block request DHCP
chain=output mac-protocol=ip dst-port=68 ip-protocol=udp action=drop

Source : http://mikrotik.unimedcenter.org/?p=53

Apart from an administrator could arrange the limit bandwidth per clinet, a person admin could arrange bandwidth in accordance with extension that in download him, Along With was the method that most was easy:

Block Traceroute

You could arrange him in firewall mikrotik, to avoid Traceroute and ping, Along With was the method that most was easy:

/ip firewall filter add chain=forward protocol=icmp icmp-options=11:0 action=drop comment=”Drop Traceroute”
/ip firewall filter add chain=forward protocol=icmp icmp-options=3:3 action=drop comment=”Drop Traceroute”

next you can block ping

/ip firewall filter add chain=input action=accept protocol=icmp limit=50/5s,2

Source : http://mikrotik.unimedcenter.org/?p=91

1. Block Scan Winbox and Neighbour Mikrotik

Apart from Protected router from the virus with configuration in firewall mikrotik , the network administrator also could protect router from scan winbox and neighbor. this was the matter that was important in the network, Along With was the method that most was easy:

copy and paste this script in console mikrotik

admin@mikrotik] interface bridge> filter print
Flags: X – disabled, I – invalid, D – dynamic
0 ;;; block discovery mikrotik
chain=forward in-interface=ether1 mac-protocol=ip dst-port=5678
ip-protocol=udp action=drop
1 ;;; block discovery mikrotik
chain=input in-interface=ether1 mac-protocol=ip dst-port=5678
ip-protocol=udp action=drop
2 ;;; block discovery mikrotik
chain=output mac-protocol=ip dst-port=5678 ip-protocol=udp action=drop
3 ;;; block discovery mikrotik
chain=input in-interface=ether1 mac-protocol=ip dst-port=8291
ip-protocol=tcp action=drop
4 ;;; block winbox mikrotik
chain=forward in-interface=ether1 mac-protocol=ip dst-port=8291
ip-protocol=tcp action=drop
5 ;;; block request DHCP
chain=input mac-protocol=ip dst-port=68 ip-protocol=udp action=drop
6 ;;; block request DHCP
chain=forward mac-protocol=ip dst-port=68 ip-protocol=udp action=drop
7 ;;; block request DHCP
chain=output mac-protocol=ip dst-port=68 ip-protocol=udp action=drop

To avoid the Port Scanner action from Hacker, then we could arrange in firewall mikrotik, by means of :

1. Make Filter

/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w comment=”Port scanners to list ” disabled=no

2. Make Chain

add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”NMAP FIN Stealth scan”

add chain=input protocol=tcp tcp-flags=fin,syn
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”SYN/FIN scan”

add chain=input protocol=tcp tcp-flags=syn,rst
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”SYN/RST scan”

add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”FIN/PSH/URG scan”

add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”ALL/ALL scan”

add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
action=add-src-to-address-list address-list=”port scanners”
address-list-timeout=2w comment=”NMAP NULL scan”

3. Drop Ip scanning

add chain=input src-address-list=”port scanners” action=drop comment=”dropping port scanners” disabled=no

Source : http://mikrotik.unimedcenter.org/?p=93

1. install mikrotik

2. set ip address

/ip address
add address=192.168.12.22/24 network=192.168.12.0 broadcast=192.168.12.255 interface=lan comment="" disabled=no
add address=192.168.2.3/24 network=192.168.2.0 broadcast=192.168.2.255 interface=line1 comment="" disabled=no
add address=192.168.3.11/24 network=192.168.3.0 broadcast=192.168.3.255 interface=line2 comment="" disabled=no

3. set mangel
/ip firewall mangle
add chain=prerouting in-interface=lan connection-state=new nth=1,2,0 action=mark-connection new-connection-mark=one passthrough=yes comment="" disabled=no
add chain=prerouting in-interface=lan connection-mark=satu action=mark-routing new-routing-mark=one passthrough=no comment="" disabled=no
add chain=prerouting in-interface=lan connection-state=new nth=1,2,1 action=mark-connection new-connection-mark=two passthrough=yes comment="" disabled=no
add chain=prerouting in-interface=lan connection-mark=dua action=mark-routing new-routing-mark=two passthrough=no comment="" disabled=no

4. set Nat
/ip firewall nat
add chain=srcnat connection-mark=one action=src-nat to-addresses=192.168.2.3 to-ports=0-65535 comment="" disabled=no
add chain=srcnat connection-mark=two action=src-nat to-addresses=192.168.3.11 to-ports=0-65535 comment="" disabled=no

5. Set Route
/ ip route
add dst-address=0.0.0.0/0 gateway=192.168.2.1 scope=255 target-scope=10 routing-mark=one comment="" disabled=no
add dst-address=0.0.0.0/0 gateway=192.168.3.2 scope=255 target-scope=10 routing-mark=two comment="" disabled=no
add dst-address=0.0.0.0/0 gateway=192.168.3.2 scope=255 target-scope=10 comment="" disabled=no <<--default route

Source : http://mikrotik.unimedcenter.org/?p=112