ABDURROZAK.MY.ID // MIKROTIK TUTORIAL

GATEWAY MIKROTIK

RB941 hAP LITE - KONFIGURASI LENGKAP SEBAGAI GATEWAY INTERNET

Panduan step-by-step menjadikan RB941 sebagai gateway jaringan LAN: setup WAN, bridge, DHCP, NAT, DNS, firewall, wireless, dan verifikasi koneksi. Disediakan dalam 2 metode: CLI (Terminal) & WinBox (GUI).

SPESIFIKASI HARDWARE RB941-2nD

MikroTik RB941 hAP (Home Access Point) lite adalah router entry-level yang cocok sebagai gateway untuk jaringan rumah/kantor kecil dengan 10-20 client. Dilengkapi 4 port ethernet 10/100Mbps dan wireless 2.4GHz b/g/n.

CPU

AR9344 - 650MHz

RAM

32 MB DDR2

STORAGE

16 MB FLASH

ETHERNET

4x 10/100 Mbps

WIRELESS

2.4GHz b/g/n

POWER

5V DC / USB

RouterOS v6 L4

KATEGORI

HOME SOHO

DIMENSI

113 x 89 x 28mm

BERAT

160 gram

OPERASI

-20 ~ 70 C

KAPASITAS

~20 CLIENT

PORT LAYOUT: RB941 punya 4 port ethernet. Default config: ether1 = WAN (ke ISP/modem), ether2-4 + wlan1 = LAN (bridge). Untuk konfigurasi gateway, kita akan pertahankan setup ini.

TOPOLOGI GATEWAY SCHEMA

FUNGSI GATEWAY: Router menjadi "jembatan" antara jaringan lokal (LAN) dan internet. Semua traffic dari LAN ke internet harus melewati router. Router melakukan NAT (Network Address Translation) agar IP private LAN bisa akses internet via IP publik ISP.

VISUALISASI ALUR GATEWAY LIVE FLOW

Visualisasi alur data: client LAN kirim request ke router (gateway), router melakukan NAT dan forward ke internet. Response dari internet kembali ke router, di-UN-NAT, lalu dikirim ke client.

Request Out

Response In

LAN Traffic

Wireless Link

WAN Link

ALUR GATEWAY: (1) Client kirim packet ke gateway (192.168.10.1), (2) Router terima, cek routing, (3) NAT masquerade ubah IP private ke IP publik, (4) Forward ke ISP, (5) Response kembali, (6) UN-NAT, (7) Kirim ke client asal.

PERSIAPAN SEBELUM KONFIGURASI STEP 01

Sebelum mulai konfigurasi, siapkan hal-hal berikut agar proses berjalan lancar.

YANG HARUS DISIAPKAN

ITEM	KETERANGAN	CATATAN
Router RB941	Sudah terpasang adaptor 5V	LED PWR harus menyala
Kabel UTP	Minimal 2 buah (straight)	1 untuk WAN, 1 untuk koneksi ke PC
PC/Laptop	Dengan port ethernet	Untuk akses awal via kabel
WinBox	Download dari mikrotik.com	Atau pakai browser (WebFig)
Info ISP	Jenis koneksi: DHCP/PPPoE/Static	Tanya ISP jika tidak tahu
Username/Pass PPPoE	Jika ISP pakai PPPoE	Contoh: user@isp.com / password
IP Static ISP	Jika ISP beri IP static	IP, subnet, gateway, DNS

JENIS KONEKSI ISP

JENIS	CIRI	CONFIG
DHCP Client	Colok kabel langsung dapat IP	Paling mudah, otomatis
PPPoE	Butuh username & password	IndiHome, MyRepublic, dll
Static IP	ISP beri IP tetap	Biasanya bisnis/enterprise

TANYA ISP ANDA: Sebelum mulai, pastikan tahu jenis koneksi ISP Anda. Cek modem lama: jika ada username/password untuk connect, berarti PPPoE. Jika colok kabel langsung internet jalan, berarti DHCP. Jika ada IP address, subnet, gateway yang dicatat, berarti Static.

RESET & AKSES ROUTER STEP 02

Jika router bekas pakai atau ingin mulai dari nol, reset ke factory default dulu. Lalu akses router via WinBox atau browser.

RESET FACTORY DEFAULT

VIA HARDWARE

Cabut power router (cabut kabel USB/adapter)

Tekan tombol RESET dengan pin/jarum di lubang reset

Colok power sambil tetap tekan tombol RESET

Tunggu ~5 detik sampai LED ACT berkedip cepat

Lepas tombol RESET, router akan reboot

Tunggu 1-2 menit sampai router fully boot

VIA CLI (JIKA MASIH BISA AKSES)

# Reset dengan default config [admin@MikroTik] > /system reset-configuration Do you really want to reset configuration? [y/N] y # Reset tanpa default config (kosong total) [admin@MikroTik] > /system reset-configuration no-defaults=yes skip-backup=yes ! WARNING: semua konfigurasi terhapus

AKSES ROUTER (3 CARA)

VIA WINBOX (RECOMMENDED)

Colok kabel UTP dari PC ke ether2 router

Buka aplikasi WinBox di PC

Klik tab Neighbors, tunggu router muncul

Klik MAC address router (paling aman)

Klik Connect - masuk ke WinBox

VIA WEBFIG (BROWSER)

Colok kabel UTP dari PC ke ether2 router

Buka browser (Chrome/Firefox/Edge)

Ketik alamat: http://192.168.88.1

Masuk ke WebFig (GUI web)

PENTING: Selalu connect via MAC address di WinBox, bukan IP. Jika IP berubah atau salah konfigurasi, Anda masih bisa akses via MAC. Ini safety net terbaik.

IDENTITY & GANTI PASSWORD STEP 03

Beri nama router agar mudah dikenali, dan GANTI PASSWORD ADMIN. Ini WAJIB dilakukan sebelum router terhubung internet, karena router dengan password kosong akan di-bruteforce dalam hitungan menit.

VIA CLI

# 1. Set identity (nama router) [admin@MikroTik] > /system identity set name="GW-RB941-RUMAH" [admin@GW-RB941-RUMAH] > # prompt berubah otomatis # 2. Ganti password admin (WAJIB!) [admin@GW-RB941-RUMAH] > /user set admin password="Rozak@Gateway2024!" # 3. (Opsional) Buat user operator [admin@GW-RB941-RUMAH] > /user add name="operator" password="op@2024" group="read" # 4. Cek list user [admin@GW-RB941-RUMAH] > /user print # NAME GROUP 0 admin full 1 operator read

VIA WINBOX

Menu: System -> Identity

Ketik nama: GW-RB941-RUMAH

Klik OK

Menu: System -> Users

Double-click user admin

Klik tombol Password

Ketik password baru (min 12 karakter, kombinasi huruf+angka+simbol)

Klik OK -> OK

KRITIS: Password admin harus KUAT. Gunakan minimal 12 karakter, kombinasi huruf besar, kecil, angka, dan simbol. CATAT password di tempat aman (password manager). Jika lupa, harus reset fisik router.

CEK & NAMA INTERFACE STEP 04

Cek interface yang ada, beri nama yang jelas agar mudah dikenali. ether1 = WAN, ether2-4 = LAN.

VIA CLI

# 1. Cek interface yang ada [admin@GW-RB941-RUMAH] > /interface print # NAME TYPE MTU 0 ether1 ether 1500 1 ether2 ether 1500 2 ether3 ether 1500 3 ether4 ether 1500 4 wlan1 wlan 1500 5 bridge1 bridge 1500 # 2. Rename interface (opsional) [admin@GW-RB941-RUMAH] > /interface set ether1 name="WAN" [admin@GW-RB941-RUMAH] > /interface set ether2 name="LAN1" [admin@GW-RB941-RUMAH] > /interface set ether3 name="LAN2" [admin@GW-RB941-RUMAH] > /interface set ether4 name="LAN3" # 3. Cek hasil rename [admin@GW-RB941-RUMAH] > /interface print

VIA WINBOX

Menu: Interfaces

Lihat daftar interface: ether1-4, wlan1, bridge1

Double-click ether1

Tab General -> ubah Name jadi WAN

Klik Apply -> OK

Ulangi untuk ether2-4: rename jadi LAN1, LAN2, LAN3

TIPS: Rename interface tidak wajib, tapi sangat membantu agar tidak salah konfigurasi. Jika Anda nyaman dengan nama default (ether1, ether2, dst), boleh skip langkah ini.

BRIDGE SETUP (GABUNG LAN) STEP 05

Bridge menyatukan semua interface LAN (ether2-4 dan wlan1) menjadi satu jaringan logis. Semua device yang terhubung ke port LAN atau WiFi akan berada di satu subnet yang sama dan bisa saling komunikasi.

VIA CLI

# 1. Cek bridge port default [admin@GW-RB941-RUMAH] > /interface bridge port print # INTERFACE BRIDGE PVID 0 ether2 bridge1 1 1 ether3 bridge1 1 2 ether4 bridge1 1 3 wlan1 bridge1 1 # Default sudah benar! # 2. Jika bridge belum ada, buat baru [admin@GW-RB941-RUMAH] > /interface bridge add name=bridge1 # 3. Tambah port ke bridge [admin@GW-RB941-RUMAH] > /interface bridge port add bridge=bridge1 interface=ether2 [admin@GW-RB941-RUMAH] > /interface bridge port add bridge=bridge1 interface=ether3 [admin@GW-RB941-RUMAH] > /interface bridge port add bridge=bridge1 interface=ether4 [admin@GW-RB941-RUMAH] > /interface bridge port add bridge=bridge1 interface=wlan1 # 4. Optimasi bridge [admin@GW-RB941-RUMAH] > /interface bridge set bridge1 protocol-mode=rstp fast-forward=yes # 5. Verifikasi [admin@GW-RB941-RUMAH] > /interface bridge port print

VIA WINBOX

Menu: Bridge

Cek apakah bridge1 sudah ada. Jika belum, klik + Add, Name: bridge1, OK

Tab Ports di jendela Bridge

Cek apakah ether2, ether3, ether4, wlan1 sudah ada di list

Jika belum, klik + Add untuk tiap interface: Bridge: bridge1, Interface: ether2/3/4/wlan1

Double-click bridge1 -> tab Advanced -> Protocol Mode: rstp

Tab HW -> centang Fast Forward

Klik Apply -> OK

PERINGATAN: JANGAN masukkan ether1 (WAN) ke bridge! ether1 harus terpisah sebagai WAN. Jika ether1 masuk bridge, router tidak bisa connect ke internet.

IP ADDRESS GATEWAY STEP 06

Setup IP address untuk bridge (gateway LAN). IP ini akan jadi gateway untuk semua client di jaringan LAN. Default 192.168.88.1 bisa diganti sesuai skema Anda.

VIA CLI

# 1. Cek IP address saat ini [admin@GW-RB941-RUMAH] > /ip address print # ADDRESS NETWORK INTERFACE 0 192.168.88.1/24 192.168.88.0 bridge # 2. Ganti IP gateway (opsional) # Contoh: 192.168.10.1/24 [admin@GW-RB941-RUMAH] > /ip address set [find interface=bridge] address=192.168.10.1/24 # 3. Verifikasi [admin@GW-RB941-RUMAH] > /ip address print # ADDRESS NETWORK INTERFACE 0 192.168.10.1/24 192.168.10.0 bridge ! Setelah ganti IP, akses router ! via IP baru: 192.168.10.1

VIA WINBOX

Menu: IP -> Addresses

Double-click entry 192.168.88.1/24

Ubah Address jadi 192.168.10.1/24

Interface: bridge (sudah benar)

Klik Apply -> OK

CATATAN: Setelah ganti IP, Anda harus akses router via IP baru: 192.168.10.1

SKEMA IP RECOMMENDED

KOMPONEN	IP ADDRESS	KETERANGAN
Gateway Router	`192.168.10.1`	IP router di LAN
Subnet	`192.168.10.0/24`	Range: .0 - .255
Netmask	`255.255.255.0`	/24 = 254 host
DHCP Pool	`192.168.10.100 - .200`	101 IP untuk client
Reserved	`192.168.10.2 - .50`	Untuk static IP (server, printer)

TIPS: Jika Anda tidak yakin, biarkan default 192.168.88.1/24. Tidak masalah. Yang penting semua client dapat IP dari range yang sama.

DHCP CLIENT (WAN) STEP 07

Setup DHCP client di WAN (ether1) agar router mendapat IP otomatis dari ISP/modem. Ini untuk ISP yang pakai koneksi DHCP (colok langsung dapat IP). Jika ISP Anda pakai PPPoE atau Static IP, skip ke bagian PPPoE/Static di bawah.

VIA CLI - DHCP CLIENT

# 1. Tambah DHCP client di WAN [admin@GW-RB941-RUMAH] > /ip dhcp-client add interface=ether1 disabled=no use-peer-dns=yes use-peer-ntp=no add-default-route=yes dhcp-options=hostname,clientid # 2. Cek status - harus "bound" [admin@GW-RB941-RUMAH] > /ip dhcp-client print # INTERFACE STATUS ADDRESS 0 ether1 bound 10.10.10.5/24 # STATUS: # searching = sedang cari DHCP server # requesting = sedang minta IP # bound = BERHASIL (IP aktif) # error = gagal, cek kabel/modem # 3. Cek IP yang didapat [admin@GW-RB941-RUMAH] > /ip address print # ADDRESS NETWORK INTERFACE 0 192.168.10.1/24 192.168.10.0 bridge 1 10.10.10.5/24 10.10.10.0 ether1

VIA WINBOX - DHCP CLIENT

Menu: IP -> DHCP Client

Klik + Add

Tab General:

Interface: ether1

Add Default Route: yes

Use Peer DNS: yes

Use Peer NTP: no

DHCP Options: hostname,clientid

Tab Status: tunggu sampai bound

Klik OK

ALTERNATIF: PPPoE CLIENT

Jika ISP Anda pakai PPPoE (butuh username/password), pakai PPPoE Client, bukan DHCP Client.

VIA CLI - PPPoE

# Setup PPPoE client [admin@GW-RB941-RUMAH] > /interface pppoe-client add name=pppoe-out1 interface=ether1 user="user@isp.com" password="password123" add-default-route=yes use-peer-dns=yes disabled=no # Cek status [admin@GW-RB941-RUMAH] > /interface pppoe-client print # NAME STATUS 0 pppoe-out1 connected

VIA WINBOX - PPPoE

Menu: PPP

Tab Interfaces -> + Add

Pilih PPPoE Client

Tab General: Interface: ether1

Tab Dial Out:

User: user@isp.com

Password: password123

Centang: Add Default Route, Use Peer DNS

Status harus connected

Klik OK

ALTERNATIF: STATIC IP

VIA CLI - STATIC IP

# Setup static IP di WAN [admin@GW-RB941-RUMAH] > /ip address add address=202.123.45.67/29 interface=ether1 # Set default route [admin@GW-RB941-RUMAH] > /ip route add dst-address=0.0.0.0/0 gateway=202.123.45.65 # Set DNS dari ISP [admin@GW-RB941-RUMAH] > /ip dns set servers=202.123.45.1,202.123.45.2 allow-remote-requests=yes

VIA WINBOX - STATIC IP

Menu: IP -> Addresses

+ Add: Address: 202.123.45.67/29, Interface: ether1

Menu: IP -> Routes

+ Add: Dst. Address: 0.0.0.0/0, Gateway: 202.123.45.65

Menu: IP -> DNS

Servers: 202.123.45.1, 202.123.45.2

Centang Allow Remote Requests

Klik Apply -> OK

TIPS: Untuk NAT masquerade di langkah berikutnya, jika pakai PPPoE, ganti out-interface=ether1 dengan out-interface=pppoe-out1. Jika pakai static IP, tetap pakai ether1.

DHCP SERVER (LAN) STEP 08

Setup DHCP server agar semua client di LAN (PC, laptop, HP, smart TV, dll) otomatis mendapat IP address, gateway, dan DNS dari router. Tanpa DHCP server, client harus setting IP manual satu per satu.

VIA CLI

# 1. Buat IP pool untuk DHCP [admin@GW-RB941-RUMAH] > /ip pool add name="pool-lan" ranges=192.168.10.100-192.168.10.200 # 2. Buat DHCP server [admin@GW-RB941-RUMAH] > /ip dhcp-server add name="dhcp-lan" interface=bridge address-pool="pool-lan" lease-time=10m authoritative=yes disabled=no # 3. Buat DHCP network [admin@GW-RB941-RUMAH] > /ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=192.168.10.1,8.8.8.8 domain="rumah.local" # 4. Verifikasi [admin@GW-RB941-RUMAH] > /ip dhcp-server print # NAME INTERFACE POOL 0 dhcp-lan bridge pool-lan [admin@GW-RB941-RUMAH] > /ip dhcp-server network print # ADDRESS GATEWAY DNS 0 192.168.10.0/24 192.168.10.1 192.168.10.1,8.8.8.8

VIA WINBOX

Menu: IP -> Pool

+ Add: Name: pool-lan, Ranges: 192.168.10.100-192.168.10.200

Klik OK

Menu: IP -> DHCP Server

Klik tombol DHCP Setup (wizard)

Pilih interface: bridge -> Next

Address space: 192.168.10.0/24 -> Next

Gateway: 192.168.10.1 -> Next

Lease time: 10m -> Next (sampai selesai)

Verifikasi di tab Networks: gateway & DNS sudah benar

STATIC LEASE (IP TETAP)

Untuk device yang butuh IP tetap (server, printer, NVR), buat static lease agar selalu dapat IP yang sama.

VIA CLI

# Static lease untuk printer [admin@GW-RB941-RUMAH] > /ip dhcp-server lease add address=192.168.10.50 mac-address="A1:B2:C3:D4:E5:F6" server="dhcp-lan" comment="Printer" # Static lease untuk NVR CCTV [admin@GW-RB941-RUMAH] > /ip dhcp-server lease add address=192.168.10.51 mac-address="B2:C3:D4:E5:F6:01" server="dhcp-lan" comment="NVR-CCTV" # Cek lease [admin@GW-RB941-RUMAH] > /ip dhcp-server lease print

VIA WINBOX

Menu: IP -> DHCP Server

Tab Leases

Cari device di list (yang sudah pernah connect)

Double-click device tersebut

Ubah Address jadi IP yang diinginkan (misal 192.168.10.50)

Centang Static (atau klik tombol Make Static)

Comment: Printer (opsional)

Klik OK

TIPS: Lease time 10 menit cocok untuk hotspot/tamu. Untuk jaringan rumah/kantor, pakai 3-7 hari agar device tidak perlu request IP terus. Cek di /ip dhcp-server lease print untuk lihat client yang aktif.

NAT MASQUERADE STEP 09

NAT masquerade WAJIB agar client LAN bisa akses internet. Tanpa NAT, packet dari IP private (192.168.10.x) tidak bisa keluar ke internet karena IP private tidak valid di internet. NAT akan mengubah IP private ke IP publik router sebelum keluar ke ISP.

VIA CLI

# NAT masquerade untuk DHCP client [admin@GW-RB941-RUMAH] > /ip firewall nat add chain=srcnat action=masquerade out-interface=ether1 comment="NAT to ISP" # JIKA PAKAI PPPoE: [admin@GW-RB941-RUMAH] > /ip firewall nat add chain=srcnat action=masquerade out-interface=pppoe-out1 # Verifikasi [admin@GW-RB941-RUMAH] > /ip firewall nat print # CHAIN ACTION OUT-INTERFACE 0 srcnat masquerade ether1

VIA WINBOX

Menu: IP -> Firewall

Tab NAT

Klik + Add

Tab General:

Chain: srcnat

Out. Interface: ether1 (atau pppoe-out1)

Tab Action:

Action: masquerade

Tab Advanced / Extra: kosongkan

Comment: NAT to ISP

Klik OK

BAGAIMANA NAT BEKERJA?

// ALUR NAT MASQUERADE // 1. PC kirim request ke google.com src: 192.168.10.101 -> dst: 142.250.x.x 2. Router terima packet di bridge Cek routing -> keluar via ether1 3. NAT masquerade ubah src IP: src: 10.10.10.5 (IP publik router) -> dst: 142.250.x.x 4. Packet keluar ke ISP -> Internet -> Google 5. Google reply ke IP publik router: src: 142.250.x.x -> dst: 10.10.10.5 6. Router UN-NAT (kembalikan IP asli): src: 142.250.x.x -> dst: 192.168.10.101 7. PC terima reply dari google.com Selesai!

PENTING: Pastikan hanya ada SATU rule masquerade. Jika ada 2 atau lebih, akan terjadi konflik. Jika pakai PPPoE, hapus rule masquerade untuk ether1, ganti dengan pppoe-out1.

DNS FORWARDING STEP 10

Setup DNS forwarding agar client bisa resolve nama domain (google.com, youtube.com, dll) ke IP address. Router akan jadi DNS server untuk semua client di LAN.

VIA CLI

# Set DNS server [admin@GW-RB941-RUMAH] > /ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-size=2048KiB max-concurrent-queries=100 # Verifikasi [admin@GW-RB941-RUMAH] > /ip dns print servers: 1.1.1.1, 8.8.8.8 allow-remote-requests: yes cache-size: 2048KiB # Test resolve [admin@GW-RB941-RUMAH] > /ping google.com count=4 HOST SIZE TTL TIME STATUS 142.250.x 56 117 12ms 142.250.x 56 117 11ms

VIA WINBOX

Menu: IP -> DNS

Servers: 1.1.1.1, 8.8.8.8

Centang Allow Remote Requests

Cache Size: 2048 KiB

Max UDP Packet Size: 4096

Klik Apply -> OK

Test: buka browser, ketik google.com

REKOMENDASI DNS SERVER

PROVIDER	PRIMARY	SECONDARY	KEUNGGULAN
Cloudflare	`1.1.1.1`	`1.0.0.1`	Tercepat, privacy
Google	`8.8.8.8`	`8.8.4.4`	Paling stabil
OpenDNS	`208.67.222.222`	`208.67.220.220`	Filtering
Quad9	`9.9.9.9`	`149.112.112.112`	Block malware
Telkom ID	`180.131.144.144`	`180.131.145.145`	Low latency ID

TIPS: Pakai 2 DNS server (primary + secondary) untuk redundancy. Jika primary down, otomatis pakai secondary. Allow Remote Requests WAJIB dicentang agar client LAN bisa pakai router sebagai DNS.

NTP & TIMEZONE STEP 11

Setup NTP (Network Time Protocol) agar waktu router akurat. Penting untuk log, scheduler, dan sertifikat.

VIA CLI

# Aktifkan NTP client [admin@GW-RB941-RUMAH] > /system ntp client set enabled=yes mode=unicast primary-ntp=132.163.96.1 secondary-ntp=8.8.8.8 # Set timezone Indonesia (WIB) [admin@GW-RB941-RUMAH] > /system clock set time-zone-name=Asia/Jakarta # Verifikasi [admin@GW-RB941-RUMAH] > /system clock print date and time: 2024-11-15 14:32:08 time-zone-name: Asia/Jakarta gmt-offset: +7:00

VIA WINBOX

Menu: System -> NTP Client

Centang Enabled

Mode: unicast

Primary NTP: 132.163.96.1

Secondary NTP: 8.8.8.8

Klik Apply -> OK

Menu: System -> Clock

Time Zone Name: Asia/Jakarta

Klik OK

TIMEZONE INDONESIA

WILAYAH	TIMEZONE	GMT
WIB (Jakarta, Sumatera, Jawa, Kalbar, Kalteng)	`Asia/Jakarta`	+07:00
WITA (Bali, Kalsel, Kaltim, Sulsel, NTT)	`Asia/Makassar`	+08:00
WIT (Maluku, Papua)	`Asia/Jayapura`	+09:00

FIREWALL DASAR STEP 12

Setup firewall dasar untuk melindungi router dari akses tidak sah dari internet. Tanpa firewall, router akan terus-menerus di-scan dan di-bruteforce oleh bot dari internet.

VIA CLI

# 1. Allow established/related [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=input connection-state=established,related action=accept in-interface=ether1 # 2. Drop invalid connections [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=input connection-state=invalid action=drop in-interface=ether1 log=yes log-prefix="INVALID:" # 3. Allow ICMP (ping) [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=input protocol=icmp action=accept in-interface=ether1 # 4. Drop semua dari WAN [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=input action=drop in-interface=ether1 log=yes log-prefix="WAN-DROP:" # 5. Forward: allow established [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=forward connection-state=established,related action=accept # 6. Forward: drop invalid [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=forward connection-state=invalid action=drop # Verifikasi [admin@GW-RB941-RUMAH] > /ip firewall filter print

VIA WINBOX

Menu: IP -> Firewall

Tab Filter Rules

+ Add Rule 1: Chain: input, Connection State: established,related, In. Interface: ether1, Action: accept

+ Add Rule 2: Chain: input, Connection State: invalid, In. Interface: ether1, Action: drop

+ Add Rule 3: Chain: input, Protocol: icmp, In. Interface: ether1, Action: accept

+ Add Rule 4: Chain: input, In. Interface: ether1, Action: drop

+ Add Rule 5: Chain: forward, Connection State: established,related, Action: accept

+ Add Rule 6: Chain: forward, Connection State: invalid, Action: drop

Drag rule agar urutan benar (accept established di atas, drop di bawah)

HARDENING TAMBAHAN (RECOMMENDED)

VIA CLI

# Block port scanner [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=input action=add-src-to-address-list address-list="port-scanners" address-list-timeout=10m protocol=tcp psd=21:3s,3:1s,1:1s,1:1s in-interface=ether1 [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=input action=drop src-address-list="port-scanners" in-interface=ether1 # Block IP private di WAN (anti spoof) [admin@GW-RB941-RUMAH] > /ip firewall filter add chain=input in-interface=ether1 src-address=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8 action=drop

VIA WINBOX

Menu: IP -> Services

Disable service tidak perlu: ftp, telnet, www, www-ssl, api, api-ssl

Sisakan hanya: ssh dan winbox

Double-click winbox -> tab General

Available from: 192.168.10.0/24 (hanya LAN)

Double-click ssh -> Available from: 192.168.10.0/24

Klik OK

PENTING: Urutan rule firewall SANGAT PENTING. Rule diproses dari atas ke bawah. Rule pertama yang match akan dieksekusi. Pastikan rule accept established di PALING ATAS, baru rule drop di bawahnya.

WIRELESS SETUP STEP 13

Setup WiFi agar client wireless (HP, laptop, tablet) bisa connect ke jaringan LAN. SSID, security WPA2-PSK, channel, dan password.

VIA CLI

# 1. Set mode AP, SSID, country [admin@GW-RB941-RUMAH] > /interface wireless set wlan1 mode=ap-bridge ssid="RUMAH-WIFI" country=indonesia frequency-mode=regulatory-domain installation=indoor # 2. Set channel [admin@GW-RB941-RUMAH] > /interface wireless set wlan1 channel=6 band=2ghz-b/g/n # 3. Setup WPA2-PSK security [admin@GW-RB941-RUMAH] > /interface wireless security-profiles set [find default=yes] mode=dynamic-keys authentication-types=wpa2-psk group-ciphers=aes-ccm unicast-ciphers=aes-ccm wpa2-pre-shared-key="wifi@rumah2024!" # 4. Set tx-power [admin@GW-RB941-RUMAH] > /interface wireless set wlan1 tx-power-mode=all-rates-fixed tx-power=17 # 5. Verifikasi [admin@GW-RB941-RUMAH] > /interface wireless print [admin@GW-RB941-RUMAH] > /interface wireless registration-table print

VIA WINBOX

Menu: Wireless

Double-click wlan1

Tab Wireless:

Mode: ap-bridge

SSID: RUMAH-WIFI

Band: 2GHz-B/G/N

Channel: 6 (atau scan dulu untuk cari channel sepi)

Country: indonesia

Tab Security Profiles:

Pilih default -> klik icon edit

Mode: dynamic-keys

Authentication Types: wpa2-psk

WPA2 Pre-Shared Key: wifi@rumah2024!

Klik OK -> Apply -> OK

SCAN CHANNEL TERBAIK

VIA CLI

# Scan WiFi sekitar [admin@GW-RB941-RUMAH] > /interface wireless scan # Tunggu 3-5 detik # CHAN SIGNAL SECURITY SSID 0 1 -65 wpa2-psk Tetangga1 1 6 -58 wpa2-psk Tetangga2 2 11 -75 wpa2-psk Tetangga3 # Pilih channel paling sepi

VIA WINBOX

Menu: Wireless

Klik tombol Scan di toolbar

Tunggu hasil scan (3-5 detik)

Lihat channel mana yang paling sedikit AP

Pilih channel 1, 6, atau 11 (non-overlapping)

Set channel di wlan1

JANGAN: pakai WEP/WPA (sudah jebol). Selalu WPA2-PSK minimal. Password 12+ karakter. Jangan pakai SSID default (MikroTik-XXXXXX) - ganti dengan nama unik.

VERIFIKASI KONFIGURASI STEP 14

Setelah semua konfigurasi selesai, lakukan verifikasi untuk memastikan gateway bekerja dengan benar.

VIA CLI

# 1. Cek IP address [admin@GW-RB941-RUMAH] > /ip address print # ADDRESS NETWORK INTERFACE 0 192.168.10.1/24 192.168.10.0 bridge 1 10.10.10.5/24 10.10.10.0 ether1 # 2. Cek routing (default route) [admin@GW-RB941-RUMAH] > /ip route print # DST-ADDRESS GATEWAY DISTANCE 0 0.0.0.0/0 10.10.10.1 1 # 3. Test ping ke gateway ISP [admin@GW-RB941-RUMAH] > /ping 10.10.10.1 count=4 # 4. Test ping ke internet [admin@GW-RB941-RUMAH] > /ping 8.8.8.8 count=4 # 5. Test DNS resolve [admin@GW-RB941-RUMAH] > /ping google.com count=4 # 6. Cek DHCP server [admin@GW-RB941-RUMAH] > /ip dhcp-server print # 7. Cek DHCP lease (client aktif) [admin@GW-RB941-RUMAH] > /ip dhcp-server lease print # 8. Cek NAT [admin@GW-RB941-RUMAH] > /ip firewall nat print # 9. Cek wireless client [admin@GW-RB941-RUMAH] > /interface wireless registration-table print

VIA WINBOX / BROWSER

Test dari PC LAN: colok kabel ke ether2/3/4

Cek IP PC: harus dapat 192.168.10.x dari DHCP

Ping gateway: ping 192.168.10.1 (harus reply)

Ping internet: ping 8.8.8.8 (harus reply)

Ping domain: ping google.com (harus reply)

Buka browser: akses google.com, youtube.com

Test WiFi: connect HP ke SSID RUMAH-WIFI

Input password: wifi@rumah2024!

HP harus dapat IP 192.168.10.x

Test browsing dari HP: harus bisa akses internet

CHECKLIST VERIFIKASI

TEST	EXPECTED	STATUS
PC dapat IP dari DHCP	`192.168.10.100-200`	✓
Ping gateway (192.168.10.1)	Reply	✓
Ping 8.8.8.8 (internet)	Reply	✓
Ping google.com (DNS)	Reply	✓
Buka browser -> google.com	Halaman Google muncul	✓
HP connect WiFi	Dapat IP, bisa browsing	✓
Router dapat IP dari ISP	IP publik di ether1	✓
Default route ada	`0.0.0.0/0` via gateway ISP	✓
NAT masquerade aktif	1 rule srcnat masquerade	✓

SELAMAT! Jika semua test di atas berhasil, router Anda sudah berfungsi sebagai gateway internet. Client LAN (kabel & WiFi) sudah bisa akses internet melalui router.

MONITORING & BACKUP STEP 15

Monitor performa router dan backup konfigurasi secara berkala.

VIA CLI

# Cek resource (CPU, memory, uptime) [admin@GW-RB941-RUMAH] > /system resource print uptime: 2d 5h 32m cpu-load: 12% free-memory: 8192KiB # Cek suhu & voltase [admin@GW-RB941-RUMAH] > /system health print temperature: 48C voltage: 5.0V # Monitor traffic real-time [admin@GW-RB941-RUMAH] > /tool traffic-monitor interface=ether1 # Torch - lihat traffic per IP [admin@GW-RB941-RUMAH] > /tool torch interface=bridge # Backup config [admin@GW-RB941-RUMAH] > /system backup save name="gw-rumah-2024-11-15" password="backup@2024" # Export script [admin@GW-RB941-RUMAH] > /export file="gw-config"

VIA WINBOX

Monitoring: Menu System -> Resources (CPU, RAM)

Menu System -> Health (suhu, voltase)

Menu Tools -> Traffic Monitor (real-time)

Menu Tools -> Torch (per IP)

Backup: Menu Files

Klik Backup -> nama file -> password -> OK

Drag file .backup dari WinBox ke desktop

Export: Menu Tools -> Export (script text)

TIPS: Backup konfigurasi SETELAH selesai setup dan setiap kali ada perubahan besar. Simpan minimal 3 versi backup terakhir di tempat berbeda (local + cloud). Test restore secara berkala.

TROUBLESHOOTING SUPPORT

Masalah umum dan solusinya.

CLIENT TIDAK DAPAT IP (DHCP GAGAL)

KEMUNGKINAN PENYEBAB:

1. Bridge belum berisi interface LAN: /interface bridge port print
2. DHCP server tidak aktif: /ip dhcp-server print
3. Pool habis: /ip pool print
4. IP address tidak ada di bridge: /ip address print
5. Network DHCP belum ada: /ip dhcp-server network print

CLIENT DAPAT IP TAPI TIDAK BISA INTERNET

KEMUNGKINAN PENYEBAB:

1. Router tidak dapat IP dari ISP: /ip dhcp-client print (harus bound)
2. Default route tidak ada: /ip route print
3. NAT masquerade tidak ada: /ip firewall nat print
4. DNS tidak aktif: /ip dns print
5. Firewall block: /ip firewall filter print

WIFI TIDAK MUNCUL / TIDAK BISA CONNECT

KEMUNGKINAN PENYEBAB:

1. wlan1 disabled: /interface wireless print (harus R=running)
2. SSID salah / typo
3. Password salah (case-sensitive)
4. Channel tidak support device client
5. wlan1 tidak jadi port bridge: /interface bridge port print

ROUTER TIDAK BISA DIAKSES

KEMUNGKINAN PENYEBAB:

1. IP router berubah - cek via MAC address di WinBox
2. PC tidak satu subnet dengan router
3. Firewall block akses management
4. Service winbox/ssh disabled: /ip service print
5. Reset fisik router jika lupa password

INTERNET LAMBAT / DROP

KEMUNGKINAN PENYEBAB:

1. CPU overload: /system resource print (CPU >80%)
2. ISP masalah - test bypass router (colok langsung ke modem)
3. WiFi interferensi - ganti channel
4. Bandwidth ISP penuh - cek traffic monitor
5. Router butuh reboot - /system reboot

DIAGNOSTIC COMMANDS

# Cek semua konfigurasi penting > /ip address print > /ip route print > /ip dhcp-client print > /ip dhcp-server print > /ip firewall nat print > /ip firewall filter print > /ip dns print > /interface bridge port print > /interface wireless print # Test connectivity > /ping 192.168.10.1 > /ping 8.8.8.8 > /ping google.com > /tool traceroute 8.8.8.8 # Cek log > /log print > /log print follow

BEST PRACTICE TIPS

GANTI PASSWORD DEFAULT

Password admin WAJIB diganti. Pakai 12+ karakter, kombinasi huruf+angka+simbol. Catat di tempat aman.

DISABLE SERVICE TIDAK PERLU

Disable ftp, telnet, www, api. Hanya sisakan ssh dan winbox. Batasi akses hanya dari LAN.

UPDATE ROUTEROS

Update ke versi stable terbaru untuk patch keamanan. Backup dulu sebelum update.

BACKUP RUTIN

Backup config setiap minggu. Simpan 3 versi terakhir di tempat berbeda. Test restore berkala.

PILIH CHANNEL WIFI SEPI

Scan WiFi sekitar, pilih channel 1, 6, atau 11 yang paling sepi. Width 20MHz untuk stabilitas.

PAKAI WPA2-PSK

Jangan WEP/WPA (sudah jebol). WPA2-PSK minimal. Password 12+ karakter. Jangan pakai SSID default.

MONITOR CPU & SUHU

Cek /system resource dan health. CPU <70%, suhu <60C. Jika overload, kurangi fitur atau upgrade hardware.

DOKUMENTASI

Dokumentasikan: IP skema, VLAN, password, SSID, dll. Update saat ada perubahan. Simpan di tempat aman.

INDIKATOR LED REFERENCE

PWR

Power normal

ACT

BLINK

Ada traffic

ETHER1

LINK

WAN OK

ETHER2-4

LINK

LAN OK

WLAN

BLINK

WiFi aktif

KONDISI LED	ARTI	TINDAKAN
PWR ON	Power normal	OK
PWR OFF	Tidak ada power	Cek adaptor/kabel
ACT BLINK CEPAT	Traffic tinggi	Normal saat banyak client
ACT OFF	Tidak ada traffic	Cek koneksi
WLAN BLINK	WiFi ada traffic	Normal
WLAN OFF	WiFi disabled	Aktifkan wireless

GATEWAY CHEATSHEET QUICK REF

GATEWAY COMMANDS

# SETUP GATEWAY (urutan) > /system identity set name="GW-RB941" > /user set admin password="xxx" > /ip dhcp-client add interface=ether1 disabled=no > /ip pool add name="pool-lan" ranges=192.168.10.100-192.168.10.200 > /ip dhcp-server add name="dhcp-lan" interface=bridge address-pool="pool-lan" > /ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=192.168.10.1,8.8.8.8 > /ip firewall nat add chain=srcnat action=masquerade out-interface=ether1 > /ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes # VERIFIKASI > /ip address print > /ip route print > /ip dhcp-client print > /ping 8.8.8.8 > /ping google.com # MONITORING > /system resource print > /system health print > /tool traffic-monitor interface=ether1 > /tool torch interface=bridge # BACKUP > /system backup save name="backup" > /export file="config"

ABDURROZAK.MY.ID // JARINGAN SOSIAL

GATEWAY MIKROTIK

s.id

GitHub

Instagram

Threads

Facebook

TikTok

YT Teacher

YT Course

YT Studio

Hashnode

WhatsApp

Email