Settingan Mikrotik untuk Warnet (PC Router)

sebelum saya menginjakkan kaki dari dunia perwarnetan dan saya serius kuliah saya pengen tulis ini dulu :D, menurut saya ini adalah settingan terbaik mikrotik untuk warnet baik small dan large (up to 200) client.

saya pake mikrotik di 19 client warnet (termasuk server dan client), dimana 8 PC games, dan 10 PC internet biasa.

saya anggap Anda sudah mengerti script mikrotik dan interface sudah jelas serta sudah connect internet (masquarade) jadi tinggal lewat winbox saja.

sebelumnya saya pake router PC dengan mikrotik generate an v3.22. dengan spesifikasi processor dual core dan bisa dilihat digambar:

mikrotik saya bekerja pada jaringan internet speedy 3 Mbps.

berikut interface saya:

# NAME TYPE MTU

0 R SPEEDY ether 1500

1 R LAN ether 1500

2 X OnBoard ether 1500

dan menganut topologi jaringan untuk port 80 seperti ini:

Internet -> Mikrotik -> Web Proxy -> Client.

dan untuk port lain contoh 443, dan 21, direct tanpa ke web proxy

Internet -> Mikrotik -> Client.

baik mari kita mulai set up.

1. enable kan proxy server internal mikrotik.

enabled: yes

src-address: 0.0.0.0

port: 8080

parent-proxy: 0.0.0.0

parent-proxy-port: 0

cache-administrator: “deenet@bulak”

max-cache-size: unlimited

cache-on-disk: yes

max-client-connections: 950

max-server-connections: 950

max-fresh-time: 2w5d19m

serialize-connections: no

always-from-cache: yes

cache-hit-dscp: 4

cache-drive: secondary-master

lanjut ke step ke 2

2. route semua request 80 dari client di interface LAN (192.168.1.0/24) jadi redirect ke 8080 (proxy) dari NAT FIREWALL

chain=dstnat

action=redirect

to-ports=8080

protocol=tcp

src-address=192.168.1.0/24

in-interface=LAN

dst-port=80

oke proxy secara penuh sudah berjalan untuk semua client kemudian lanjut ke no 3 kita set up MANGLE

3. pada set up mangle ini langkah harus diperhatikan ! dan peletakan rules harus sesuai! gak boleh keliru.

a. mangle pertama

0 ;;; HIT TRAFFIC FROM PROXY

chain=output out-interface=lan

dscp=4 action=mark-packet

new-packet-mark=proxy-hit passthrough=no

b. mangle kedua, ketiga dan keempat, berurutan

1 ;;; UP TRAFFIC

chain=prerouting in-interface=lan

src-address=192.168.1.0/24 action=mark-packet

new-packet-mark=test-up passthrough=no

2 ;;; CONN-MARK

chain=forward src-address=192.168.1.0/24

action=mark-connection

new-connection-mark=test-conn passthrough=yes

3 ;;; DOWN-DIRECT CONNECTION

chain=forward in-interface=public

connection-mark=test-conn action=mark-packet

new-packet-mark=test-down passthrough=no

4 ;;; DOWN-VIA PROXY

chain=output out-interface=lan

dst-address=192.168.1.0/24 action=mark-packet

new-packet-mark=test-down passthrough=no

view source

print?

1	/ip firewall mangle add chain=output out-interface=lan dscp=4 action=mark-packet new-packet-mark=proxy-hit passthrough=no comment="HIT TRAFFIC FROM PROXY";
2	/ip firewall mangle add chain=prerouting in-interface=lan src-address=192.168.1.0/24 action=mark-packet new-packet-mark=test-up passthrough=no comment="UP TRAFFIC";

3	/ip firewall mangle add chain=forward src-address=192.168.1.0/24 action=mark-connection new-connection-mark=test-conn passthrough=yes comment="CONN-MARK";
4	/ip firewall mangle add chain=forward in-interface=speedy connection-mark=test-conn action=mark-packet new-packet-mark=test-down passthrough=no comment="DOWN DIRECT CONNECTION";

5	/ip firewall mangle add chain=output out-interface=lan dst-address=192.168.1.0/24 action=mark-packet new-packet-mark=test-down passthrough=no comment="DOWN VIA PROXY";

oke dah selesai dari sini kita tinggal atur bandwith per client dari simple queues biar gak ada yang nyedot bandwith.

4. buat simple queues dengan packet mark “test-down”

name=”Client 1″

target-addresses=192.168.1.221/32

dst-address=0.0.0.0/0

interface=all

parent=none

packet-marks=test-down

direction=both

priority=8

queue=default-small/default-small

limit-at=0/0

max-limit=384000/384000

burst-limit=0/0

burst-threshold=0/0

burst-time=0s/0s

total-queue=default-small

ingat yang di mark packet nya itu ‘test-down’ karena tadi di Mangle atas kita sudah tandai bahwa packet ‘test-down’ ialah packet request dan upload dari client ke internet (modem).

sementara queues akan meng loss bandwith dari proxy server (ROS) ke client.

oke now done, logika settingan diatas ialah untuk membedakan koneksi antara koneksi ke proxy dan ke internet.

sebagai contoh saya setting koneksi per client ialah 384/384 sehingga tidak ada rebutan bandwith, tentu saja maximal download client walaupun pake IDM ialah 40 – 50 KBps.

tapi jika mereka download pertama kali kemudian melakukan cache di proxy server MT untuk koneksi kedua dari client lain koneksi tidak akan ke internet melainkan ke proxy server MT dan LOSS tidak terkena queues 384/384.

ibarat kata ’supaya proxy server tidak terkena queues’ ini contoh settingan simple queues saya.

view source

02	:local strPC

03	:set strPC "Client"
04	:local interfacenya

05	:set interfacenya "lan"
06		:local ipnya

07	:set ipnya "192.168.1."
08		:local iprouternya

09	:set iprouternya 1
10		:local limitnya

11	:set limitnya "256000/256000"
12		:local maxlimitnya

13	:set maxlimitnya "384000/384000"
14		:local startipnya

15	:set startipnya 2
16		:local endipnya

17		:set endipnya 50
18	:for i from=$startipnya to=$endipnya do={

19		:if ($i < 10) do={ :set strPC "Client0" } else={ :set strPC "Client" }
20	/queue simple add packet-marks=test-down target-addresses=($ipnya . $i) limit-at=$limitnya max-limit=$maxlimitnya interface=$interfacenya name=($strPC . $i)}

21	/queue simple remove [/queue simple find target-addresses=($ipnya . $iprouternya . "/32")]
22		}

dan ini screenshot untuk koneksi ke dua download dari client alias dari proxy yang gak kena queues

ini juga setelah tercache oleh proxy,Good Luck!

Sumber: http://ray16.info

Cara kedua

 mikrotik untuk router warnet

ini konfigurasi bagi teman-teman yang mungkin agak kesulitan setting mikrotik.

tinggal di copy trus paste aja di terminal. jadi deh ….

step-step

1. instal pake cd mikrotik

a. boot dg cd mikrotik

b. setelah bisa boot pake iso linux, pilih beberapa paket yang dibutuhkan. (kalo bingung centang aja semua)

c ikuti aja langkahnya tekan (Yes) (Yes)

setelah restart, login : admin pass : (kosong)

trus copy paste aja tulisan berikut ;

DASAR_______________
system identity set name=warnet.beenet
user set admin password=sukasukalu

ethernet____________________
interface ethernet enable ether1
interface ethernet enable ether2
interface Ethernet set ether1 name=intranet
interface Ethernet set ether2 name=internet

IP ADDRESS_______________
ip address add interface=internet address=XXXXX (dari ISP)
ip address add interface=intranet address=192.168.0.1/24

route_______________
ip route add gateway=XXXXX (dari ISP)

dns___________
ip dns set primary-dns=XXXXX (dari ISP) 2 secondary-dns=XXXXX (dari ISP)

nat & filter firewall standar_______________
ip firewall nat add action=masquerade chain=srcnat
ip firewall filter add chain=input connection-state=invalid action=drop
ip firewall filter add chain=input protocol=udp action=accept
ip firewall filter add chain=input protocol=icmp action=accept
ip firewall filter add chain=input in-interface=intranet action=accept
ip firewall filter add chain=input in-interface=internet action=accept

dhcp server______________________________________
ip dhcp-server setup
dhcp server interface: intranet
dhcp address space: 192.168.0.0/24
gateway for dhcp network: 192.168.0.1
addresses to give out: 192.168.0.2-192.168.0.254
dns servers: XXXXX (dari ISP),XXXXX (dari ISP)
lease time: 3d

web proxy_________________________
ip web-proxy
set enabled=yes
set src-address=0.0.0.0
set port=8080
set hostname=”proxy-apaaja”
set transparent-proxy=yes
set parent-proxy=0.0.0.0:0
set cache-administrator=”silahkan.pannggil.operator”
set max-object-size=4096KiB
set cache-drive=system
set max-cache-size=unlimited
set max-ram-cache-size=unlimited

bikinredirect port ke transparant proxy__________________________
/ip firewall nat add chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=8080
/ip firewall nat add chain=dstnat protocol=tcp dst-port=3128 action=redirect to-ports=8080
/ip firewall nat add chain=dstnat protocol=tcp dst-port=8080 action=redirect to-ports=8080

PCQ ________________________
/ip firewall mangle add chain=forward src-address=192.168.169.0/28 action=mark-connection new-connection-mark=client1-cm
/ip firewall mangle add connection-mark=client1-cm action=mark-packet new-packet-mark=client1-pm chain=forward
/queue type add name=downsteam-pcq kind=pcq pcq-classifier=dst-address
/queue type add name=upstream-pcq kind=pcq pcq-classifier=src-address
/queue tree add parent=ether1-internet queue=downsteam-pcq packet-mark=client1-pm
/queue tree add parent=ether2-local-master queue=upstream-pcq packet-mark=client1-pm

simpel queue______________________________
queue simple add name=PC-01 target-addresses=192.168.88.11
queue simple add name= PC -02 target-addresses=192.168.88.12
queue simple add name=PC -03 target-addresses=192.168.88.13
queue simple add name= PC -04 target-addresses=192.168.88.14
queue simple add name= PC -05 target-addresses=192.168.88.15
queue simple add name= PC -06 target-addresses=192.168.88.16
queue simple add name= PC -07 target-addresses=192.168.88.17
queue simple add name= PC -08 target-addresses=192.168.88.18
queue simple add name= PC -09 target-addresses=192.168.88.19
queue simple add name= PC -10 target-addresses=192.168.88.20
queue simple add name=xbilling target-addresses=192.168.88.2

BLOX SPAM____________________________
/ip firewall filter add chain=forward dst-port=135-139 protocol=tcp action=drop
/ip firewall filter add chain=forward dst-port=135-139 protocol=udp action=drop
/ip firewall filter add chain=forward dst-port=445 protocol=tcp action=drop
/ip firewall filter add chain=forward dst-port=445 protocol=udp action=drop
/ip firewall filter add chain=forward dst-port=593 protocol=tcp action=drop
/ip firewall filter add chain=forward dst-port=4444 protocol=tcp action=drop
/ip firewall filter add chain=forward dst-port=5554 protocol=tcp action=drop
/ip firewall filter add chain=forward dst-port=9996 protocol=tcp action=drop
/ip firewall filter add chain=forward dst-port=995-999 protocol=udp action=drop
/ip firewall filter add chain=forward dst-port=53 protocol=tcp action=drop
/ip firewall filter add chain=forward dst-port=55 protocol=tcp action=drop

Posted in: Mikrotik