ABDURROZAK
HOME ABOUT ME MICROSITE KONTAK PERSEMBAHAN HELP
ABDURROZAK.MY.ID // MIKROTIK MASTERY SERIES

MIKROTIK MASTERY8 VOLUMES COMPLETE

Seri lengkap panduan MikroTik dari nol hingga mahir. 8 volume, 40+ bab, mencakup Fundamental, Basic Config, Routing, Firewall, Hotspot, QoS, Wireless, hingga Advanced (VLAN, VPN, Failover, Load Balancing). Setiap bab dilengkapi konfigurasi lengkap via CLI dan WinBox.

VOLUMES8
BAB40+
BACA10+ JAM
CONFIGCLI + WINBOX
ABDUR ROZAK, S.Kom. Web Developer & Network Educator - abdurrozak.my.id
ABDURROZAK.MY.ID // DAFTAR VOLUME

8 VOLUME SERI LENGKAP

Pilih volume untuk mulai belajar

VOLUME 1
MIKROTIK FUNDAMENTAL
Memahami dasar RouterOS & networking. Arsitektur, CLI basics, teori jaringan.
5 BABFONDASI
VOLUME 2
BASIC CONFIGURATION
Konfigurasi router dari nol. Interface, IP, DHCP, DNS, NAT.
5 BABPRAKTIS
VOLUME 3
ROUTING
Memahami routing & internet gateway. Static, OSPF, default route.
5 BABADVANCED
VOLUME 4
FIREWALL
Keamanan jaringan dengan firewall. Filter, mangle, address list.
5 BABSECURITY
VOLUME 5
HOTSPOT
Membangun sistem hotspot. Captive portal, user manager, voucher.
5 BABBUSINESS
VOLUME 6
QOS
Manajemen bandwidth. Simple Queue, Queue Tree, PCQ.
5 BABPERFORMANCE
VOLUME 7
WIRELESS
Membangun jaringan wireless. AP, station, WDS, CAPsMAN.
5 BABWIRELESS
VOLUME 8
ADVANCED
VLAN, VPN, Failover, Load Balancing. Topik tingkat lanjut.
5 BABEXPERT
VOLUME 1 / 8

MIKROTIK FUNDAMENTAL

Memahami dasar RouterOS & networking. Volume ini membangun fondasi teori dan konsep yang penting sebelum masuk ke konfigurasi praktis.
BAB5 LEVELFondasi WAKTU60 MENIT
1.1
VOLUME 1 FUNDAMENTAL

PENGENALAN ROUTEROS

Apa Itu RouterOS?

RouterOS adalah sistem operasi jaringan berbasis Linux kernel yang dikembangkan oleh MikroTik (Latvia, 1996). RouterOS mengubah hardware standar menjadi router canggih dengan fitur enterprise: routing, firewall, VPN, hotspot, QoS, wireless, dan banyak lagi - semua dalam satu platform.

Arsitektur RouterOS

LAYERKOMPONENFUNGSI
User InterfaceCLI, WinBox, WebFig, APITempat user berinteraksi
Service LayerRouting, Firewall, DHCP, DNS, QoSImplementasi fitur
KernelLinux kernel (modified)Network stack dasar
HardwareCPU, RAM, Flash, NICPhysical resources

Sistem Lisensi

LEVELNAMAFITUR
L0Free/DemoDemo 1 jam (CHR)
L3WISP CPE1-2 interface, fitur dasar
L4WISP APUnlimited interface, fitur lengkap (PALING UMUM)
L5ControllerAdvanced routing, tunneling
L6ControllerUnlimited tunnels, enterprise
VIA CLI
VIA WINBOX
CLI - INFO SISTEM
# Lihat versi & resource /system resource print # version: 7.15.3 (stable) # board-name: hEX # cpu-count: 4 # cpu-frequency: 800 MHz # uptime: 5d 12h 30m # free-memory: 45 MB # Lihat package terinstall /system package print # Cek license /system license print # Cek health (suhu, voltase) /system health print
1
MENU SYSTEM -> RESOURCES

1. Menu System -> Resources: lihat versi, CPU, memory, uptime.

2. Menu System -> Packages: lihat package terinstall.

3. Menu System -> License: lihat lisensi.

4. Menu System -> Health: suhu & voltase.

KOMPETENSI BAB 1.1
  • Memahami apa itu RouterOS dan arsitekturnya
  • Mengerti sistem lisensi MikroTik
  • Mampu cek informasi sistem via CLI & WinBox
1.2
VOLUME 1 FUNDAMENTAL

TEORI JARINGAN

Model OSI - 7 Layer

LAYERNAMAFUNGSICONTOH
7ApplicationAntarmuka userHTTP, FTP, DNS, SSH
6PresentationFormat data, enkripsiSSL/TLS, JPEG
5SessionMengelola sesiNetBIOS, RPC
4TransportKoneksi end-to-endTCP, UDP
3NetworkRouting, IP addressingIP, ICMP, OSPF
2Data LinkFrame, MAC addressEthernet, WiFi
1PhysicalMedia fisikKabel UTP, Fiber

TCP vs UDP

ASPEKTCPUDP
KoneksiConnection-orientedConnectionless
ReliabilityReliable (ack, retransmit)Unreliable
SpeedSlowerFaster
Use CaseWeb, email, fileStreaming, VoIP, DNS
KOMPETENSI BAB 1.2
  • Memahami model OSI 7 layer
  • Membedakan TCP dan UDP
  • Mengerti peran setiap layer
1.3
VOLUME 1 FUNDAMENTAL

CLI BASICS

Sintaks CLI RouterOS

/[category]/[subcategory]/[action] [parameter=value]
AKSISINTAKSCONTOH
Lihat/[menu] print/ip address print
Tambah/[menu] add [param]/ip address add address=192.168.1.1/24 interface=ether1
Edit/[menu] set [id] [param]/ip address set 0 address=10.0.0.1/24
Hapus/[menu] remove [id]/ip address remove 0
CLI - NAVIGASI
# Lihat menu utama (tekan ?) [admin@MikroTik] > ? # Navigasi ke sub-menu /ip /ip address # Kembali ke parent .. # Kembali ke root / # Auto-complete dengan TAB /ip ad [TAB] -> /ip address # Lihat help command /ip address add ?
KOMPETENSI BAB 1.3
  • Memahami sintaks CLI RouterOS
  • Mampu navigasi menu CLI
  • Menggunakan auto-complete TAB
1.4
VOLUME 1 FUNDAMENTAL

AKSES ROUTER

4 Metode Login

WINBOX
GUI resmi, paling mudah. Download di mikrotik.com
WEBFIG
Via browser di http://192.168.88.1
SSH
Via terminal/PuTTY, port 22
SERIAL
Kabel serial/USB-TTL untuk recovery
VIA CLI
VIA WINBOX
SSH LOGIN
# Via terminal Linux/Mac/Windows ssh admin@192.168.88.1 # Password: (kosong untuk default) # Ganti password admin /user set admin password="P@ssw0rdKuat!" # Ganti identity router /system identity set name="ROUTER-KANTOR" # Set zona waktu /system clock set time-zone-name="Asia/Jakarta"
1
LOGIN VIA WINBOX

1. Jalankan WinBox.exe, klik tab Neighbors.

2. Pilih router yang muncul, isi Login: admin, Password: (kosong).

3. Klik Connect.

4. Menu System -> Identity: ganti nama router.

5. Menu System -> Users: double-click admin, ganti password.

KOMPETENSI BAB 1.4
  • Mampu login via WinBox, WebFig, SSH
  • Mampu ganti password admin
  • Mampu set identity router
1.5
VOLUME 1 FUNDAMENTAL

FILE SYSTEM & BACKUP

Jenis File di RouterOS

TIPEEKSTENSIFUNGSI
Backup binary.backupFull config, encrypted
Export script.rscText-based, portable
Firmware.npkPackage update
Certificate.crt/.keySSL/TLS
VIA CLI
VIA WINBOX
CLI - BACKUP
# Backup binary (encrypted) /system backup save name="backup-2026" password="BackupPass!" # Export ke script /export file="config-2026" # Lihat file /file print # Restore /system backup load name="backup-2026"
1
MENU FILES

1. Menu Files -> klik Backup.

2. Isi nama file, password (opsional), klik Backup.

3. Drag & drop file ke desktop untuk download.

4. Untuk restore: upload file, klik Restore.

KOMPETENSI BAB 1.5
  • Membedakan jenis file backup
  • Mampu backup dan restore konfigurasi
  • Mampu export konfigurasi ke script
VOLUME 2 / 8

BASIC CONFIGURATION

Konfigurasi router dari nol. Interface, IP address, DHCP, DNS, dan NAT - fondasi konfigurasi praktis.
BAB5 LEVELPraktis WAKTU75 MENIT
2.1
VOLUME 2 BASIC CONFIG

INTERFACE & BRIDGE

Konsep Interface

Interface = port/koneksi di router. Setiap interface punya nama (ether1-5, wlan1, dll). Bridge menggabungkan beberapa interface menjadi satu broadcast domain (seperti switch virtual).

VIA CLI
VIA WINBOX
CLI - INTERFACE & BRIDGE
# Lihat interface /interface print # Rename interface /interface ethernet set ether1 name=WAN comment="Ke ISP" /interface ethernet set ether2 name=LAN comment="Jaringan lokal" # Buat bridge /interface bridge add name=bridge-lan # Masukkan interface ke bridge /interface bridge port add bridge=bridge-lan interface=LAN # Verifikasi /interface bridge print /interface bridge ports print
1
MENU INTERFACES & BRIDGE

1. Menu Interfaces -> double-click ether1 -> Name = WAN.

2. Ulangi untuk ether2: Name = LAN.

3. Menu Bridge -> + -> Name = bridge-lan.

4. Tab Ports -> + -> Interface = LAN -> OK.

KOMPETENSI BAB 2.1
  • Mampu rename interface
  • Mampu buat bridge dan masukkan interface
  • Mengerti peran bridge sebagai virtual switch
2.2
VOLUME 2 BASIC CONFIG

IP ADDRESSING & SUBNETTING

Format IPv4 & CIDR

CIDRSUBNET MASKUSABLE HOSTUSE CASE
/30255.255.255.2522Point-to-point
/24255.255.255.0254LAN standar
/20255.255.240.04094Medium network
/16255.255.0.065534Large network
VIA CLI
VIA WINBOX
CLI - IP ADDRESS
# Lihat IP /ip address print # Tambah IP di bridge /ip address add address=192.168.1.1/24 interface=bridge-lan network=192.168.1.0 # Ubah IP /ip address set [find interface=bridge-lan] address=192.168.100.1/24 # Hapus IP /ip address remove [find interface=bridge-lan]
1
MENU IP -> ADDRESSES

1. Menu IP -> Addresses -> +.

2. Address: 192.168.1.1/24, Interface: bridge-lan.

3. Klik OK.

KOMPETENSI BAB 2.2
  • Memahami format IPv4 dan CIDR
  • Mampu set IP address di bridge
  • Mampu edit dan hapus IP
2.3
VOLUME 2 BASIC CONFIG

KONEKSI WAN KE ISP

3 Metode Koneksi

METODEKARAKTERISTIKUSE CASE
DHCP ClientIP otomatisISP rumahan (PALING UMUM)
PPPoEUsername + passwordFiber bisnis
Static IPIP tetapDedicated line
VIA CLI
VIA WINBOX
CLI - WAN SETUP
# METODE 1: DHCP Client /ip dhcp-client add interface=WAN use-peer-dns=yes use-peer-ntp=yes add-default-route=yes # Cek status (bound = berhasil) /ip dhcp-client print # METODE 2: PPPoE /interface pppoe-client add name=pppoe-out1 interface=WAN user="user@isp" password="pass" add-default-route=yes # METODE 3: Static IP /ip address add address=103.123.45.67/30 interface=WAN /ip route add dst-address=0.0.0.0/0 gateway=103.123.45.65
1
DHCP CLIENT VIA WINBOX

1. Menu IP -> DHCP Client -> +.

2. Interface: WAN, centang Add Default Route, Use Peer DNS, Use Peer NTP.

3. Klik OK. Status akan bound jika berhasil.

KOMPETENSI BAB 2.3
  • Memahami 3 metode koneksi WAN
  • Mampu konfigurasi DHCP Client
  • Mampu konfigurasi PPPoE dan Static IP
2.4
VOLUME 2 BASIC CONFIG

NAT & MASQUERADE

Mengapa NAT Wajib?

NAT (Network Address Translation) menerjemahkan IP private ke IP publik. TANPA NAT, client di LAN TIDAK BISA akses internet!

VIA CLI
VIA WINBOX
CLI - NAT
# NAT Masquerade - WAJIB! /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN comment="NAT ke Internet" # Verifikasi /ip firewall nat print # Test /ping 8.8.8.8 count=4
1
MENU IP -> FIREWALL -> NAT

1. Menu IP -> Firewall -> tab NAT -> +.

2. Tab General: Chain = srcnat, Out. Interface = WAN.

3. Tab Action: Action = masquerade.

4. Klik OK.

WAJIB: NAT Masquerade adalah konfigurasi PALING KRITIS setelah setup WAN. Tanpa ini, internet tidak jalan!
KOMPETENSI BAB 2.4
  • Memahami konsep NAT dan mengapa wajib
  • Mampu konfigurasi NAT Masquerade via CLI
  • Mampu konfigurasi NAT Masquerade via WinBox
2.5
VOLUME 2 BASIC CONFIG

DHCP & DNS SERVER

DHCP Server

DHCP memberikan IP otomatis ke client. Tanpa DHCP, setiap device harus di-set IP manual.

VIA CLI
VIA WINBOX
CLI - DHCP & DNS
# DHCP Server /ip pool add name=pool-lan ranges=192.168.1.100-192.168.1.200 /ip dhcp-server network add address=192.168.1.0/24 gateway=192.168.1.1 dns-server=192.168.1.1,8.8.8.8 /ip dhcp-server add name=dhcp-lan interface=bridge-lan address-pool=pool-lan lease-time=1d # DNS Server /ip dns set servers=8.8.8.8,1.1.1.1 allow-remote-requests=yes cache-size=4096 # Test /ping google.com count=4
1
DHCP SETUP WIZARD

1. Menu IP -> DHCP Server -> DHCP Setup.

2. Pilih interface bridge-lan -> Next terus sampai Finish.

3. Menu IP -> DNS -> DNS Settings: isi DNS servers, centang Allow Remote Requests.

KOMPETENSI BAB 2.5
  • Mampu konfigurasi DHCP Server lengkap
  • Mampu konfigurasi DNS Server
  • Mengerti cara kerja DHCP dan DNS
VOLUME 3 / 8

ROUTING

Memahami routing & internet gateway. Static routing, dynamic routing (OSPF), dan internet gateway configuration.
BAB5 LEVELIntermediate WAKTU75 MENIT
3.1
VOLUME 3 ROUTING

ROUTING FUNDAMENTAL

Apa Itu Routing?

Routing = proses menentukan jalur paket dari sumber ke tujuan. Router menggunakan routing table untuk keputusan ini.

JENIS ROUTESUMBERADMIN DISTANCE
ConnectedAuto dari interface aktif0
StaticManual konfigurasi1
DHCPDHCP clientconfigurable
OSPFOSPF protocol110
BGPBGP protocol20
VIA CLI
VIA WINBOX
CLI - ROUTING
# Lihat routing table /ip route print # Static route /ip route add dst-address=10.0.0.0/8 gateway=192.168.1.254 distance=1 comment="Ke kantor pusat" # Default route manual /ip route add dst-address=0.0.0.0/0 gateway=103.xx.xx.1 distance=1 # Cek route untuk IP tertentu /ip route print where dst-address=8.8.8.8
1
MENU IP -> ROUTES

1. Menu IP -> Routes -> +.

2. Dst. Address: 10.0.0.0/8, Gateway: 192.168.1.254, Distance: 1.

3. Klik OK.

KOMPETENSI BAB 3.1
  • Memahami konsep routing dan routing table
  • Membedakan jenis-jenis route
  • Mampu set static route dan default route
3.2
VOLUME 3 ROUTING

OSPF DASAR

OSPF - Open Shortest Path First

OSPF adalah dynamic routing protocol yang menggunakan algoritma Dijkstra untuk mencari jalur terpendek. Cocok untuk jaringan multi-router dalam satu area.

VIA CLI
VIA WINBOX
CLI - OSPF
# Aktifkan OSPF /routing ospf instance add name=ospf1 router-id=1.1.1.1 # Tambah area /routing ospf area add name=area0 instance=ospf1 area-id=0.0.0.0 # Tambah interface ke OSPF /routing ospf interface add interface=LAN area=area0 network=192.168.1.0/24 # Cek OSPF neighbor /routing ospf neighbor print # Cek OSPF routes /ip route print where routing-table=ospf1
1
MENU ROUTING -> OSPF

1. Menu Routing -> OSPF -> tab Instances -> +: Name = ospf1, Router ID = 1.1.1.1.

2. Tab Areas -> +: Name = area0, Instance = ospf1, Area ID = 0.0.0.0.

3. Tab Interfaces -> +: Interface = LAN, Area = area0, Network = 192.168.1.0/24.

KOMPETENSI BAB 3.2
  • Memahami konsep OSPF dan area
  • Mampu konfigurasi OSPF dasar
  • Mampu cek OSPF neighbor dan routes
3.3
VOLUME 3 ROUTING

INTERNET GATEWAY

Gateway ke Internet

Gateway adalah "pintu keluar" ke internet. Biasanya didapat otomatis dari DHCP Client atau di-set manual.

VIA CLI
VIA WINBOX
CLI - GATEWAY
# Lihat gateway aktif /ip route print where dst-address=0.0.0.0/0 # Set gateway manual /ip route add dst-address=0.0.0.0/0 gateway=103.xx.xx.1 distance=1 comment="Gateway ISP" # Test gateway /ping 8.8.8.8 count=4 /tool traceroute google.com
1
CEK & SET GATEWAY

1. Menu IP -> Routes: cari route dengan dst-address 0.0.0.0/0.

2. Kalau belum ada, klik +: Dst. Address = 0.0.0.0/0, Gateway = IP gateway ISP.

KOMPETENSI BAB 3.3
  • Memahami konsep gateway
  • Mampu cek dan set gateway
  • Mampu test koneksi ke internet
3.4
VOLUME 3 ROUTING

POLICY ROUTING

Routing Berdasarkan Kriteria

Policy routing = routing berdasarkan kriteria tertentu (src IP, dst IP, protokol, dll). Berguna untuk multi-WAN atau traffic shaping.

VIA CLI
VIA WINBOX
CLI - POLICY ROUTING
# Routing table terpisah /ip route add dst-address=0.0.0.0/0 gateway=103.xx.xx.1 routing-table=to-isp1 /ip route add dst-address=0.0.0.0/0 gateway=103.yy.yy.1 routing-table=to-isp2 # Mangle - tandai traffic /ip firewall mangle add chain=prerouting src-address=192.168.1.0/24 action=mark-routing new-routing-table=to-isp1 # Traffic dari 192.168.1.0/24 akan lewat ISP1
1
ROUTING TABLE TERPISAH

1. Menu IP -> Routes -> +: Dst. Address = 0.0.0.0/0, Gateway = IP ISP1, Routing Table = to-isp1.

2. Menu IP -> Firewall -> tab Mangle -> +: Chain = prerouting, Src. Address = 192.168.1.0/24, Action = mark-routing, New Routing Table = to-isp1.

KOMPETENSI BAB 3.4
  • Memahami konsep policy routing
  • Mampu buat routing table terpisah
  • Mampu route traffic berdasarkan src IP
3.5
VOLUME 3 ROUTING

BGP INTRODUCTION

BGP - Border Gateway Protocol

BGP adalah routing protocol yang digunakan di internet backbone. Digunakan untuk exchange routing information antar Autonomous System (AS).

VIA CLI
VIA WINBOX
CLI - BGP
# BGP Connection /routing bgp connection add name=bgp-peer1 remote.address=103.xx.xx.1 remote.as=65000 local.role=ebgp input.filter=bgp-in output.filter=bgp-out # Cek BGP status /routing bgp connection print # Cek BGP routes /routing stats print
1
MENU ROUTING -> BGP

1. Menu Routing -> BGP -> Connections -> +.

2. Name = bgp-peer1, Remote Address = 103.xx.xx.1, Remote AS = 65000, Local Role = ebgp.

KOMPETENSI BAB 3.5
  • Memahami konsep BGP dan AS
  • Mampu konfigurasi BGP connection dasar
  • Mampu cek status BGP
VOLUME 4 / 8

FIREWALL

Keamanan jaringan dengan firewall. Filter rules, mangle, address list, connection tracking, dan implementasi firewall production-ready.
BAB5 LEVELSecurity WAKTU90 MENIT
4.1
VOLUME 4 FIREWALL

FIREWALL ARSITEKTUR

Komponen Firewall RouterOS

KOMPONENFUNGSI
Connection TrackingLacak state koneksi (new, established, related, invalid)
FilterAllow/drop paket berdasarkan rule
NATTranslate IP/port
MangleMark paket untuk QoS, routing
RawFilter di layer sangat awal

Firewall Chains

CHAINUNTUK
inputTraffic yang dituju ke router
forwardTraffic yang melewati router (LAN->WAN)
outputTraffic yang berasal dari router

Connection States

STATEARTI
newKoneksi baru
establishedKoneksi aktif
relatedKoneksi related dengan existing
invalidPaket tidak valid
KOMPETENSI BAB 4.1
  • Memahami arsitektur firewall RouterOS
  • Membedakan chain input, forward, output
  • Mengerti connection states
4.2
VOLUME 4 FIREWALL

FILTER RULES

Filter Rules Dasar

Filter rules adalah inti firewall. Setiap rule memiliki chain, matcher, dan action.

VIA CLI
VIA WINBOX
CLI - FILTER RULES
# URUTAN SANGAT PENTING! # Rule 1: Accept established (WAJIB DI ATAS!) /ip firewall filter add chain=input action=accept connection-state=established,related comment="1-EST" # Rule 2: Drop invalid /ip firewall filter add chain=input action=drop connection-state=invalid comment="2-INV" # Rule 3: Allow ICMP /ip firewall filter add chain=input action=accept protocol=icmp limit=5,50 comment="3-PING" # Rule 4: Allow WinBox dari LAN /ip firewall filter add chain=input action=accept in-interface=LAN protocol=tcp dst-port=8291 comment="4-WINBOX" # Rule 5: Allow DNS dari LAN /ip firewall filter add chain=input action=accept in-interface=LAN protocol=udp dst-port=53 comment="5-DNS" # Rule 6: Allow DHCP dari LAN /ip firewall filter add chain=input action=accept in-interface=LAN protocol=udp dst-port=67-68 comment="6-DHCP" # Rule 7: Drop semua dari WAN /ip firewall filter add chain=input action=drop in-interface=WAN comment="7-DROP-WAN" # Rule 8: Drop semua yang tidak match /ip firewall filter add chain=input action=drop comment="8-DROP-ALL" # FORWARD chain /ip firewall filter add chain=forward action=accept connection-state=established,related comment="F1-EST" /ip firewall filter add chain=forward action=drop connection-state=invalid comment="F2-INV" /ip firewall filter add chain=forward action=accept in-interface=LAN out-interface=WAN comment="F3-LAN-OUT" /ip firewall filter add chain=forward action=drop comment="F4-DROP-ALL" /ip firewall filter print
1
MENU IP -> FIREWALL -> FILTER RULES

1. Menu IP -> Firewall -> tab Filter Rules.

2. Klik + untuk setiap rule sesuai urutan di atas.

3. Tab General: chain, parameter. Tab Action: accept/drop.

URUTAN ADALAH SEGALANYA! Firewall proses rule dari ATAS ke BAWAH. Rule pertama yang match dieksekusi. Rule "accept established" HARUS di paling atas.
KOMPETENSI BAB 4.2
  • Mampu konfigurasi filter rules lengkap
  • Memahami pentingnya urutan rule
  • Mampu set rule untuk input dan forward chain
4.3
VOLUME 4 FIREWALL

ADDRESS LIST

Mengelompokkan IP

Address list = daftar IP/network yang bisa dipakai di firewall rule. Berguna untuk maintenance.

VIA CLI
VIA WINBOX
CLI - ADDRESS LIST
# Buat address list /ip firewall address-list add list=trusted address=192.168.1.0/24 /ip firewall address-list add list=blacklist address=1.2.3.4 /ip firewall address-list add list=blacklist address=5.6.7.8 # Gunakan di rule /ip firewall filter add chain=input action=accept src-address-list=trusted /ip firewall filter add chain=input action=drop src-address-list=blacklist # Lihat address list /ip firewall address-list print
1
MENU IP -> FIREWALL -> ADDRESS LISTS

1. Menu IP -> Firewall -> tab Address Lists -> +.

2. List = trusted, Address = 192.168.1.0/24 -> OK.

3. Gunakan di Filter Rules: tab General, field Src. Address List = trusted.

KOMPETENSI BAB 4.3
  • Mampu buat address list
  • Mampu gunakan address list di firewall rule
  • Mengerti manfaat address list untuk maintenance
4.4
VOLUME 4 FIREWALL

MANGLE & MARKING

Marking Paket

Mangle = fitur untuk "menandai" paket. Mark ini digunakan oleh fitur lain (QoS, routing, firewall).

VIA CLI
VIA WINBOX
CLI - MANGLE
# Mark connection /ip firewall mangle add chain=prerouting src-address=192.168.1.0/24 action=mark-connection new-connection-mark=conn-lan passthrough=yes # Mark packet /ip firewall mangle add chain=prerouting connection-mark=conn-lan action=mark-packet new-packet-mark=pkt-lan passthrough=no # Mark routing (policy routing) /ip firewall mangle add chain=prerouting src-address=192.168.1.0/24 action=mark-routing new-routing-table=to-isp1 # Lihat mangle rules /ip firewall mangle print
1
MENU IP -> FIREWALL -> MANGLE

1. Menu IP -> Firewall -> tab Mangle -> +.

2. Tab General: Chain = prerouting, Src. Address = 192.168.1.0/24.

3. Tab Action: Action = mark-connection, New Connection Mark = conn-lan.

KOMPETENSI BAB 4.4
  • Memahami konsep mangle dan marking
  • Mampu mark connection, packet, routing
  • Mengerti perbedaan connection mark dan packet mark
4.5
VOLUME 4 FIREWALL

LAYER 7 & LOGGING

Layer 7 Protocol

Layer 7 filter = filter berdasarkan konten aplikasi (regex). Bisa blokir YouTube, Facebook, dll.

VIA CLI
VIA WINBOX
CLI - L7 & LOGGING
# Layer 7 protocol /ip firewall layer7-protocol add name=youtube regexp="youtube|googlevideo" /ip firewall layer7-protocol add name=facebook regexp="facebook|fbcdn" # Block berdasarkan L7 /ip firewall filter add chain=forward action=drop layer7-protocol=youtube comment="Block YouTube" # Logging dropped packets /ip firewall filter add chain=input action=log log-prefix="DROP-INPUT:" in-interface=WAN # Lihat log /log print /log print where topics~"firewall"
1
LAYER 7 & LOG

1. Menu IP -> Firewall -> tab Layer 7 Protocol -> +: Name = youtube, Regexp = youtube|googlevideo.

2. Menu Filter Rules -> +: Chain = forward, tab Advanced: Layer 7 = youtube, Action = drop.

3. Untuk logging: Action = log, Log Prefix = DROP-INPUT:.

KOMPETENSI BAB 4.5
  • Mampu buat Layer 7 protocol
  • Mampu block aplikasi berdasarkan L7
  • Mampu setup firewall logging
VOLUME 5 / 8

HOTSPOT

Membangun sistem hotspot. Captive portal, user manager, voucher system, dan implementasi hotspot untuk bisnis WiFi.
BAB5 LEVELBusiness WAKTU75 MENIT
5.1
VOLUME 5 HOTSPOT

HOTSPOT SETUP

Apa Itu Hotspot?

Hotspot = captive portal yang memaksa user login sebelum bisa akses internet. Cocok untuk kafe, hotel, kampus, RT/RW Net.

VIA CLI
VIA WINBOX
CLI - HOTSPOT SETUP
# Setup Hotspot (wizard) /ip hotspot setup # Wizard akan tanya: # Hotspot interface: bridge-lan # IP address: 192.168.88.1/24 # DNS name: (kosongkan) # SMTP server: (kosongkan) # Hotspot IP pool: pool-hotspot # User: admin # Password: (buat password admin hotspot) # Cek hotspot /ip hotspot print /ip hotspot user print /ip hotspot active print
1
MENU IP -> HOTSPOT -> HOTSPOT SETUP

1. Menu IP -> Hotspot -> Hotspot Setup.

2. Pilih interface bridge-lan -> Next.

3. Isi IP, DNS name (kosongkan), SMTP (kosongkan), pool, admin user & password.

4. Klik Finish.

KOMPETENSI BAB 5.1
  • Memahami konsep hotspot captive portal
  • Mampu setup hotspot via wizard
  • Mampu cek status hotspot
5.2
VOLUME 5 HOTSPOT

USER & VOUCHER

Manajemen User Hotspot

VIA CLI
VIA WINBOX
CLI - USER HOTSPOT
# Buat user voucher /ip hotspot user add name="voucher1jam" password="vcr1jam" profile=default limit-uptime=1h comment="Voucher 1 jam" /ip hotspot user add name="voucher1hari" password="vcr1hari" profile=default limit-uptime=1d # Buat profile dengan bandwidth limit /ip hotspot user profile add name="basic" rate-limit="2M/5M" shared-users=1 /ip hotspot user profile add name="premium" rate-limit="10M/20M" shared-users=3 # Lihat user aktif /ip hotspot active print # Logout user /ip hotspot active remove [find user="voucher1jam"]
1
MENU IP -> HOTSPOT -> USERS

1. Menu IP -> Hotspot -> tab Users -> +.

2. Name = voucher1jam, Password = vcr1jam, Profile = default, Limit Uptime = 1h.

3. Untuk profile: tab User Profiles -> +: Name = basic, Rate Limit = 2M/5M, Shared Users = 1.

KOMPETENSI BAB 5.2
  • Mampu buat user voucher
  • Mampu buat user profile dengan bandwidth limit
  • Mampu manage user aktif
5.3
VOLUME 5 HOTSPOT

USER MANAGER (UM)

User Manager Package

User Manager adalah package terpisah untuk manajemen user hotspot yang lebih advanced. Bisa generate voucher massal, cetak, dan kelola via web interface.

VIA CLI
VIA WINBOX
CLI - USER MANAGER
# Aktifkan package user-manager /system package enable user-manager /system reboot # Setup User Manager /tool user-manager database set compat="1.3" # Buat router /tool user-manager router add name="router1" address=192.168.88.1 shared-secret="rahasia" # Buat profile /tool user-manager profile add name="1jam" validity="3h" session-time="1h" /tool user-manager profile add name="sehari" validity="24h" session-time="unlimited" # Generate user voucher /tool user-manager user add username="v001" password="v001" profile="1jam" # Generate massal /tool user-manager user create-and-activate-profile="v002-v010" profile="1jam" # Akses web User Manager: # http://192.168.88.1/userman
1
MENU SYSTEM -> PACKAGES

1. Menu System -> Packages: cari user-manager, klik Enable.

2. Reboot router.

3. Menu User Manager (muncul di sidebar) -> Setup router, profiles, users.

4. Akses web di http://192.168.88.1/userman.

KOMPETENSI BAB 5.3
  • Mampu aktifkan package User Manager
  • Mampu setup router dan profile di UM
  • Mampu generate voucher massal
5.4
VOLUME 5 HOTSPOT

WALLED GARDEN & LOGIN PAGE

Walled Garden

Walled Garden = situs yang bisa diakses TANPA login hotspot. Berguna untuk izinkan WhatsApp, situs penting, dll.

VIA CLI
VIA WINBOX
CLI - WALLED GARDEN
# Allow WhatsApp tanpa login /ip hotspot walled-garden add action=accept dst-host="wa.me" /ip hotspot walled-garden add action=accept dst-host="*.whatsapp.net" /ip hotspot walled-garden add action=accept dst-host="*.whatsapp.com" # Allow situs penting /ip hotspot walled-garden add action=accept dst-host="google.com" /ip hotspot walled-garden add action=accept dst-host="*.google.com" # Lihat walled garden /ip hotspot walled-garden print
1
MENU IP -> HOTSPOT -> WALLED GARDEN

1. Menu IP -> Hotspot -> tab Walled Garden -> +.

2. Action = accept, Dst. Host = wa.me -> OK.

3. Ulangi untuk situs lain yang ingin di-allow.

KOMPETENSI BAB 5.4
  • Memahami konsep walled garden
  • Mampu setup walled garden untuk situs tertentu
  • Mampu custom login page (via Files)
5.5
VOLUME 5 HOTSPOT

HOTSPOT MONITORING

Monitoring Hotspot

VIA CLI
VIA WINBOX
CLI - HOTSPOT MONITORING
# Lihat user aktif /ip hotspot active print # Lihat detail user /ip hotspot active print detail # Lihat statistik /ip hotspot print stats # Logout user paksa /ip hotspot active remove [find user="voucher1jam"] # Lihat history login /ip hotspot cookie print # Cek user yang sudah expired /ip hotspot user print where limit-uptime>0
1
MONITORING VIA WINBOX

1. Menu IP -> Hotspot -> tab Active: lihat user yang sedang online.

2. Menu IP -> Hotspot -> tab Users: lihat semua user.

3. Klik user -> Logout untuk logout paksa.

KOMPETENSI BAB 5.5
  • Mampu monitoring user hotspot aktif
  • Mampu logout user paksa
  • Mampu cek statistik hotspot
VOLUME 6 / 8

QOS

Manajemen bandwidth dengan Simple Queue & Queue Tree. PCQ, burst, priority, dan implementasi QoS production-ready.
BAB5 LEVELPerformance WAKTU75 MENIT
6.1
VOLUME 6 QOS

SIMPLE QUEUE DASAR

Apa Itu Simple Queue?

Simple Queue = cara termudah untuk limit bandwidth per-IP/subnet. Cocok untuk kebutuhan dasar.

VIA CLI
VIA WINBOX
CLI - SIMPLE QUEUE
# Limit total LAN /queue simple add name=total-lan target=192.168.1.0/24 max-limit=50M/50M priority=8/8 # Limit per-user /queue simple add name=user-1 target=192.168.1.100/32 max-limit=10M/10M /queue simple add name=user-2 target=192.168.1.101/32 max-limit=10M/10M # Prioritas untuk server /queue simple add name=server target=192.168.1.5/32 max-limit=20M/20M priority=3/3 # Dengan burst /queue simple add name=burst-user target=192.168.1.100/32 max-limit=10M/10M burst-limit=20M/20M burst-threshold=8M/8M burst-time=10s # Lihat queue aktif /queue simple print
1
MENU QUEUES -> SIMPLE QUEUES

1. Menu Queues -> tab Simple Queues -> +.

2. Tab General: Name = user-1, Target Addresses = 192.168.1.100/32.

3. Tab Queues: Max Limit = 10M/10M, Priority = 8/8.

4. Klik OK.

KOMPETENSI BAB 6.1
  • Memahami konsep Simple Queue
  • Mampu limit bandwidth per-IP
  • Mampu set priority dan burst
6.2
VOLUME 6 QOS

QUEUE TREE & PCQ

PCQ - Per Connection Queue

PCQ = algoritma fair-queueing yang otomatis bagi bandwidth adil ke setiap koneksi/IP. Tidak perlu set limit per-IP manual.

VIA CLI
VIA WINBOX
CLI - QUEUE TREE + PCQ
# 1. Mangle - tandai traffic /ip firewall mangle add chain=prerouting src-address=192.168.1.0/24 action=mark-connection new-connection-mark=conn-lan passthrough=yes /ip firewall mangle add chain=prerouting connection-mark=conn-lan action=mark-packet new-packet-mark=pkt-lan passthrough=no # 2. Queue Tree dengan PCQ /queue tree add name=total-bandwidth max-limit=50M/50M /queue tree add name=lan-pcq parent=total-bandwidth packet-mark=pkt-lan queue=pcq-download-default/pcq-upload-default # Cek queue tree /queue tree print
1
MANGLE + QUEUE TREE

1. Menu IP -> Firewall -> tab Mangle -> +: Chain = prerouting, Src. Address = 192.168.1.0/24, Action = mark-connection, New Connection Mark = conn-lan.

2. Tambah rule lagi: Chain = prerouting, Connection Mark = conn-lan, Action = mark-packet, New Packet Mark = pkt-lan.

3. Menu Queues -> tab Queue Tree -> +: Name = total-bandwidth, Max Limit = 50M/50M.

4. Tambah child: Name = lan-pcq, Parent = total-bandwidth, Packet Mark = pkt-lan, Queue Type = pcq-download-default/pcq-upload-default.

KOMPETENSI BAB 6.2
  • Memahami konsep PCQ
  • Mampu konfigurasi mangle untuk marking
  • Mampu setup Queue Tree dengan PCQ
6.3
VOLUME 6 QOS

PRIORITY & BURST

Priority Queue

Priority menentukan urutan antrian. Priority 1 = paling prioritas, Priority 8 = paling rendah.

VIA CLI
VIA WINBOX
CLI - PRIORITY & BURST
# Priority untuk VoIP (paling prioritas) /ip firewall mangle add chain=prerouting protocol=udp dst-port=5060 action=mark-packet new-packet-mark=voip-pkt passthrough=no /queue tree add name=voip-priority packet-mark=voip-pkt priority=1 queue=default-small # Burst - kecepatan tinggi sementara /queue simple add name=burst-user target=192.168.1.100/32 max-limit=10M/10M burst-limit=20M/20M burst-threshold=8M/8M burst-time=10s # Penjelasan burst: # max-limit = kecepatan normal # burst-limit = kecepatan saat burst # burst-threshold = trigger burst # burst-time = durasi burst
1
PRIORITY & BURST VIA WINBOX

Priority:

1. Menu IP -> Firewall -> tab Mangle -> +: mark packet untuk VoIP.

2. Menu Queues -> tab Queue Tree -> +: Packet Mark = voip-pkt, Priority = 1.

Burst:

3. Menu Queues -> tab Simple Queues -> +: tab Queues: Max Limit = 10M/10M, Burst Limit = 20M/20M, Burst Threshold = 8M/8M, Burst Time = 10s.

KOMPETENSI BAB 6.3
  • Memahami konsep priority queue
  • Mampu set priority untuk traffic penting
  • Mampu konfigurasi burst
6.4
VOLUME 6 QOS

QUEUE TYPE & ALGORITHM

Jenis Queue Type

QUEUE TYPEKARAKTERISTIKUSE CASE
defaultFIFO standarGeneral purpose
pcqPer Connection QueueFair share per-IP
sfqStochastic Fairness QueueFairness sederhana
redRandom Early DetectAvoid congestion
VIA CLI
VIA WINBOX
CLI - QUEUE TYPE
# Lihat queue types /queue type print # Buat custom PCQ /queue type add name=pcq-custom kind=pcq pcq-classifier=dst-address pcq-rate=5M pcq-limit=0 pcq-burst-rate=0 pcq-total-limit=2000 # Gunakan di queue tree /queue tree add name=custom-queue packet-mark=pkt-lan queue=pcq-custom
1
MENU QUEUES -> QUEUE TYPES

1. Menu Queues -> tab Queue Types -> +.

2. Name = pcq-custom, Kind = pcq.

3. PCQ Classifier = dst-address, PCQ Rate = 5M.

KOMPETENSI BAB 6.4
  • Membedakan jenis queue type
  • Mampu buat custom queue type
  • Mampu gunakan queue type di queue tree
6.5
VOLUME 6 QOS

QOS MONITORING

Monitoring Queue

VIA CLI
VIA WINBOX
CLI - QOS MONITORING
# Lihat queue aktif /queue simple print /queue tree print # Lihat detail dengan stats /queue simple print detail # Monitor traffic per queue /queue simple print stats # Torch untuk lihat traffic real-time /tool torch interface=WAN
1
MONITORING VIA WINBOX

1. Menu Queues -> tab Simple Queues: lihat traffic per queue.

2. Menu Queues -> tab Queue Tree: lihat hierarchical queue.

3. Menu Tools -> Torch: lihat traffic real-time per IP/protocol.

KOMPETENSI BAB 6.5
  • Mampu monitoring queue aktif
  • Mampu analisis traffic per queue
  • Mampu troubleshoot masalah QoS
VOLUME 7 / 8

WIRELESS

Membangun jaringan wireless. Access Point, Station, WDS, security WPA2/WPA3, dan CAPsMAN untuk multi-AP management.
BAB5 LEVELWireless WAKTU75 MENIT
7.1
VOLUME 7 WIRELESS

ACCESS POINT SETUP

Setup Access Point

VIA CLI
VIA WINBOX
CLI - WIRELESS AP
# 1. Buat security profile /interface wireless security-profiles add name=wifi-secure mode=dynamic-keys authentication-types=wpa2-psk unicast-ciphers=aes-ccm group-ciphers=aes-ccm wpa2-pre-shared-key="P@ssw0rdWiFi!" # 2. Set wireless interface /interface wireless set wlan1 \ mode=ap-bridge \ ssid="RUMAH-WIFI" \ band=2ghz-b/g/n \ frequency=2437 \ channel-width=20mhz \ country=indonesia \ wps-mode=disable \ default-authentication=yes \ default-forwarding=yes \ security-profile=wifi-secure # 3. Masukkan wlan1 ke bridge /interface bridge port add bridge=bridge-lan interface=wlan1 # 4. Cek status /interface wireless monitor wlan1 /interface wireless registration-table print
1
MENU INTERFACES -> WLAN1

1. Menu Interfaces -> double-click wlan1.

2. Tab Wireless: Mode = ap bridge, SSID = RUMAH-WIFI, Band = 2GHz-B/G/N, Frequency = 2437, Channel Width = 20MHz, Country = indonesia, WPS Mode = disable.

3. Klik Wireless Security Profiles -> +: Mode = dynamic-keys, Authentication Types = wpa2-psk, WPA2 Pre-Shared Key = P@ssw0rdWiFi!

4. OK -> Apply -> OK.

5. Menu Bridge -> Ports -> +: Interface = wlan1 -> OK.

KOMPETENSI BAB 7.1
  • Mampu konfigurasi Access Point
  • Mampu set security profile WPA2-PSK
  • Mampu masukkan wlan ke bridge
7.2
VOLUME 7 WIRELESS

SECURITY WPA2/WPA3

Wireless Security

MODEENKRIPSISTATUS
noneTidak adaTIDAK AMAN
wpa-pskWPA dengan PSKUSANG
wpa2-pskWPA2 dengan PSKRECOMMENDED
wpa3-saeWPA3 dengan SAEPALING AMAN
VIA CLI
VIA WINBOX
CLI - WIRELESS SECURITY
# WPA2-PSK (recommended) /interface wireless security-profiles add \ name=wpa2-profile \ mode=dynamic-keys \ authentication-types=wpa2-psk \ unicast-ciphers=aes-ccm \ group-ciphers=aes-ccm \ group-key-update=5m \ wpa2-pre-shared-key="P@ssw0rdKuat2026!" \ management-protection=allowed # WPA3-SAE (paling aman, jika device support) /interface wireless security-profiles add \ name=wpa3-profile \ mode=dynamic-keys \ authentication-types=wpa3-sae \ wpa3-sae-password="P@ssw0rdKuat2026!" # Access list (MAC filter) /interface wireless access-list add mac-address=AA:BB:CC:DD:EE:01 authentication=yes forwarding=yes comment="HP Admin" # Set default authentication = no (hanya MAC di list yang bisa connect) /interface wireless set wlan1 default-authentication=no
1
SECURITY PROFILES & ACCESS LIST

1. Menu Interfaces -> wlan1 -> Wireless Security Profiles -> +.

2. Mode = dynamic-keys, Authentication Types = wpa2-psk, WPA2 Pre-Shared Key = P@ssw0rdKuat2026!.

3. Untuk MAC filter: tab Access List -> +: MAC Address = AA:BB:CC:DD:EE:01, Authentication = ✓, Forwarding = ✓.

4. Tab Wireless: Default Authentication = NO (hanya MAC di list yang bisa connect).

KOMPETENSI BAB 7.2
  • Membedakan WPA, WPA2, WPA3
  • Mampu konfigurasi security profile
  • Mampu setup MAC filter access list
7.3
VOLUME 7 WIRELESS

STATION & WDS

Mode Station & WDS

Station = mode client, connect ke AP lain. WDS (Wireless Distribution System) = menghubungkan beberapa AP secara wireless.

VIA CLI
VIA WINBOX
CLI - STATION & WDS
# Mode Station (client ke AP lain) /interface wireless set wlan1 \ mode=station-bridge \ ssid="AP-UTAMA" \ scan-list=2437 \ security-profile=wifi-secure # Mode WDS AP (AP dengan WDS) /interface wireless set wlan1 \ mode=wds-ap-bridge \ wds-default-bridge=bridge-lan \ default-tunnel-mode=802.11 # Scan AP sekitar /interface wireless scan duration=10s
1
MODE STATION & WDS

1. Menu Interfaces -> wlan1.

2. Tab Wireless: Mode = station bridge (untuk client) atau wds ap bridge (untuk AP dengan WDS).

3. Untuk scan: tab Wireless, klik Scan.

KOMPETENSI BAB 7.3
  • Memahami mode station dan WDS
  • Mampu konfigurasi station bridge
  • Mampu scan AP sekitar
7.4
VOLUME 7 WIRELESS

CAPsMAN MULTI-AP

CAPsMAN - Centralized AP Management

CAPsMAN = fitur untuk mengelola banyak AP dari satu router pusat. Semua AP (CAP) dikonfigurasi dari controller (CAPsMAN).

VIA CLI
VIA WINBOX
CLI - CAPsMAN
# Di Controller (CAPsMAN) # 1. Buat configuration /caps-man configuration add name=cfg-wifi ssid="KANTOR-WIFI" security-passphrase="P@ssw0rd!" security.authentication-types=wpa2-psk security.encryption=aes-ccm datapath.bridge=bridge-lan # 2. Buat provisioning /caps-man provisioning add action=create-enabled master-configuration=cfg-wifi # 3. Buat interface /caps-man interface add configuration=cfg-wifi name=cap-wifi1 # 4. Lihat CAP yang terhubung /caps-man registration-table print # Di CAP (Access Point) # Set mode ke CAP /caps-man manager set enabled=yes discovery-interface=bridge-lan # CAP akan otomatis dapat konfigurasi dari controller
1
MENU CAPsMAN

Di Controller:

1. Menu CAPsMAN -> Configuration -> +: Name = cfg-wifi, SSID = KANTOR-WIFI, Security = WPA2-PSK.

2. Tab Provisioning -> +: Action = create-enabled, Master Configuration = cfg-wifi.

Di CAP:

3. Menu CAPsMAN -> Manager: Enabled = ✓, Discovery Interface = bridge-lan.

KOMPETENSI BAB 7.4
  • Memahami konsep CAPsMAN
  • Mampu konfigurasi controller dan CAP
  • Mampu manage multi-AP terpusat
7.5
VOLUME 7 WIRELESS

OPTIMASI WIRELESS

Optimasi Performa WiFi

VIA CLI
VIA WINBOX
CLI - OPTIMASI
# Set TX power /interface wireless set wlan1 tx-power-mode=manual tx-power=18 # Set distance /interface wireless set wlan1 distance=dynamic # Set max client /interface wireless set wlan1 max-station-count=30 # Monitor wireless /interface wireless monitor wlan1 # Lihat registration table /interface wireless registration-table print # Scan channel sekitar /interface wireless scan duration=30s band=2ghz-b/g/n
1
OPTIMASI VIA WINBOX

1. Menu Interfaces -> wlan1.

2. Tab Wireless: TX Power Mode = manual, TX Power = 18, Distance = dynamic, Max Station Count = 30.

3. Klik Monitor untuk lihat status real-time.

4. Klik Scan untuk scan channel sekitar.

KOMPETENSI BAB 7.5
  • Mampu optimasi TX power
  • Mampu set distance dan max client
  • Mampu monitor dan scan wireless
VOLUME 8 / 8

ADVANCED

Topik tingkat lanjut: VLAN, VPN (WireGuard, IPsec, OpenVPN), Failover, dan Load Balancing. Untuk network administrator expert.
BAB5 LEVELExpert WAKTU90 MENIT
8.1
VOLUME 8 ADVANCED

VLAN SEGMENTASI

VLAN - Virtual LAN

VLAN membagi satu physical network menjadi beberapa logical network. Setiap VLAN adalah broadcast domain terpisah.

VIA CLI
VIA WINBOX
CLI - VLAN
# Buat VLAN /interface vlan add interface=bridge-lan vlan-id=10 name=vlan-staff /interface vlan add interface=bridge-lan vlan-id=20 name=vlan-guest /interface vlan add interface=bridge-lan vlan-id=30 name=vlan-iot # Buat bridge per VLAN /interface bridge add name=br-staff /interface bridge add name=br-guest /interface bridge add name=br-iot /interface bridge port add bridge=br-staff interface=vlan-staff /interface bridge port add bridge=br-guest interface=vlan-guest /interface bridge port add bridge=br-iot interface=vlan-iot # Set IP per VLAN /ip address add address=10.10.10.1/24 interface=br-staff /ip address add address=10.10.20.1/24 interface=br-guest /ip address add address=10.10.30.1/24 interface=br-iot # DHCP per VLAN /ip pool add name=pool-staff ranges=10.10.10.100-10.10.10.200 /ip dhcp-server network add address=10.10.10.0/24 gateway=10.10.10.1 dns-server=8.8.8.8 /ip dhcp-server add name=dhcp-staff interface=br-staff address-pool=pool-staff # Firewall isolation antar VLAN /ip firewall filter add chain=forward action=drop src-address=10.10.20.0/24 dst-address=10.10.10.0/24 comment="Guest ke Staff"
1
MENU INTERFACES -> VLAN

1. Menu Interfaces -> + -> VLAN: VLAN ID = 10, Interface = bridge-lan, Name = vlan-staff.

2. Buat bridge per VLAN: Bridge -> + -> Name = br-staff.

3. Masukkan VLAN ke bridge: tab Ports -> + -> Interface = vlan-staff.

4. Set IP, DHCP, dan firewall per VLAN.

KOMPETENSI BAB 8.1
  • Memahami konsep VLAN dan segmentasi
  • Mampu buat VLAN dan bridge per VLAN
  • Mampu isolasi traffic antar VLAN
8.2
VOLUME 8 ADVANCED

WIREGUARD VPN

WireGuard - Modern VPN

WireGuard = VPN modern yang cepat, ringan, dan aman. Menggunakan cryptography state-of-the-art.

VIA CLI
VIA WINBOX
CLI - WIREGUARD
# 1. Generate key pair /interface wireguard add name=wg-server listen-port=13231 # 2. Lihat public key /interface wireguard print # 3. Set IP address /ip address add address=10.10.0.1/24 interface=wg-server # 4. Tambah peer (client) /interface wireguard peers add interface=wg-server public-key="CLIENT_PUBLIC_KEY" allowed-address=10.10.0.2/32 endpoint-address="" endpoint-port=0 # 5. NAT untuk VPN client /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN src-address=10.10.0.0/24 # 6. Cek status /interface wireguard peers print
1
MENU INTERFACES -> WIREGUARD

1. Menu Interfaces -> + -> WireGuard: Name = wg-server, Listen Port = 13231.

2. Catat Public Key untuk dibagikan ke client.

3. Menu IP -> Addresses -> +: Address = 10.10.0.1/24, Interface = wg-server.

4. Tab Peers -> +: Interface = wg-server, Public Key = CLIENT_PUBLIC_KEY, Allowed Address = 10.10.0.2/32.

KOMPETENSI BAB 8.2
  • Memahami konsep WireGuard VPN
  • Mampu setup WireGuard server
  • Mampu tambah peer/client
8.3
VOLUME 8 ADVANCED

IPSEC & L2TP VPN

IPsec Site-to-Site

IPsec = standar VPN untuk koneksi site-to-site. L2TP = protokol tunneling yang sering dipasangkan dengan IPsec.

VIA CLI
VIA WINBOX
CLI - L2TP SERVER
# 1. PPP Profile /ppp profile add name=vpn-profile local-address=10.10.0.1 remote-address=vpn-pool use-encryption=yes # 2. IP Pool untuk VPN client /ip pool add name=vpn-pool ranges=10.10.0.100-10.10.0.200 # 3. L2TP Server /interface l2tp-server server set enabled=yes default-profile=vpn-profile use-ipsec=yes ipsec-secret="IPsecSecret!" # 4. PPP Secret (user VPN) /ppp secret add name=vpnuser1 password="P@ssw0rd!" service=l2tp profile=vpn-profile # 5. NAT untuk VPN client /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN src-address=10.10.0.0/24 # 6. Cek status /ppp active print
1
MENU PPP & L2TP

1. Menu PPP -> tab Profiles -> +: Name = vpn-profile, Local Address = 10.10.0.1, Remote Address = vpn-pool, Use Encryption = ✓.

2. Menu PPP -> tab L2TP Server: Enabled = ✓, Default Profile = vpn-profile, Use IPsec = ✓, IPsec Secret = IPsecSecret!.

3. Menu PPP -> tab Secrets -> +: Name = vpnuser1, Password = P@ssw0rd!, Service = l2tp.

KOMPETENSI BAB 8.3
  • Memahami konsep IPsec dan L2TP
  • Mampu setup L2TP server dengan IPsec
  • Mampu buat user VPN
8.4
VOLUME 8 ADVANCED

FAILOVER MULTI-WAN

Failover - Redundancy Internet

Failover = konfigurasi multi-WAN dengan automatic switch ke ISP backup jika ISP utama down.

VIA CLI
VIA WINBOX
CLI - FAILOVER
# Rename interfaces /interface ethernet set ether1 name=WAN1 /interface ethernet set ether2 name=WAN2 # DHCP Client di kedua WAN /ip dhcp-client add interface=WAN1 add-default-route=no use-peer-dns=no /ip dhcp-client add interface=WAN2 add-default-route=no use-peer-dns=no # Netwatch - detect ISP down /tool netwatch add host=8.8.8.8 interval=10s timeout=2s up-script="/ip route enable [find comment=WAN1]" down-script="/ip route disable [find comment=WAN1]" # Default route dengan distance berbeda /ip route add dst-address=0.0.0.0/0 gateway=WAN1 distance=1 comment="WAN1" /ip route add dst-address=0.0.0.0/0 gateway=WAN2 distance=2 comment="WAN2" # NAT untuk kedua WAN /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN1 /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN2 # Cek status /tool netwatch print /ip route print where dst-address=0.0.0.0/0
1
FAILOVER SETUP

1. Rename ether1 = WAN1, ether2 = WAN2.

2. Menu IP -> DHCP Client -> + untuk kedua WAN, Add Default Route = NO.

3. Menu IP -> Routes -> +: Dst. Address = 0.0.0.0/0, Gateway = WAN1, Distance = 1, Comment = WAN1.

4. Tambah route lagi: Gateway = WAN2, Distance = 2, Comment = WAN2.

5. Menu Tools -> Netwatch -> +: Host = 8.8.8.8, Up Script = /ip route enable [find comment=WAN1], Down Script = /ip route disable [find comment=WAN1].

KOMPETENSI BAB 8.4
  • Memahami konsep failover multi-WAN
  • Mampu konfigurasi failover dengan netwatch
  • Mampu test failover
8.5
VOLUME 8 ADVANCED

LOAD BALANCING PCC

PCC - Per Connection Classifier

Load balancing = membagi traffic ke beberapa ISP secara bersamaan. PCC = metode yang mengelompokkan koneksi berdasarkan src/dst IP+port.

VIA CLI
VIA WINBOX
CLI - PCC LOAD BALANCE
# 2 ISP: WAN1 dan WAN2 # 1. Mangle - classify connection /ip firewall mangle add chain=prerouting in-interface=LAN src-address=192.168.1.0/24 per-connection-classifier=both-addresses:2/0 action=mark-connection new-connection-mark=conn-WAN1 passthrough=yes /ip firewall mangle add chain=prerouting in-interface=LAN src-address=192.168.1.0/24 per-connection-classifier=both-addresses:2/1 action=mark-connection new-connection-mark=conn-WAN2 passthrough=yes # 2. Mark routing /ip firewall mangle add chain=prerouting connection-mark=conn-WAN1 action=mark-routing new-routing-table=to-WAN1 /ip firewall mangle add chain=prerouting connection-mark=conn-WAN2 action=mark-routing new-routing-table=to-WAN2 # 3. Route per ISP /ip route add dst-address=0.0.0.0/0 gateway=WAN1 routing-table=to-WAN1 /ip route add dst-address=0.0.0.0/0 gateway=WAN2 routing-table=to-WAN2 # 4. NAT per ISP /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN1 /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN2 # Cek status /ip firewall mangle print
1
PCC LOAD BALANCING

1. Menu IP -> Firewall -> tab Mangle -> +: Chain = prerouting, In. Interface = LAN, tab Extra: PCC Classifier = both-addresses:2/0, Action = mark-connection, New Connection Mark = conn-WAN1.

2. Tambah rule lagi: PCC Classifier = both-addresses:2/1, New Connection Mark = conn-WAN2.

3. Tambah 2 rule untuk mark-routing berdasarkan connection-mark.

4. Menu IP -> Routes -> +: buat route per routing-table.

KOMPETENSI BAB 8.5
  • Memahami konsep load balancing PCC
  • Mampu konfigurasi PCC mangle
  • Mampu setup routing dan NAT per ISP
SERI LENGKAP SELESAI

SELAMAT!

Kamu telah menyelesaikan 8 volume seri MikroTik Mastery. Dari fundamental hingga advanced, dari basic config hingga VLAN/VPN/Failover/Load Balancing. Kamu sekarang memiliki kompetensi lengkap untuk menjadi MikroTik expert.
VOLUME8 BAB40 LEVELMASTER
ABDURROZAK.MY.ID // TERHUBUNG

JARINGAN SOSIAL

Temukan saya di berbagai platform digital

s.id GitHub Instagram Threads Facebook TikTok YT Teacher YT Course YT Studio Hashnode WhatsApp Email