Professional Documents
Culture Documents
Mtcna Lab PDF
Mtcna Lab PDF
com
catatan tentang belajar mikrotik by: teknisi_gaptek
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
/ip firewall nat add chain=srcnat out-interface=Public action=masquerade
-lakukan tes ping lagi dari computer client ke gateway (192.168.67.2) OK
-lakukan tes ping dari router ke google.com tidak bisa
- lakukan tes ping dari router ke 74.125.235.52 OK
-lakukan tes ping dari computer client ke 74.125.235.52 OK
- buka browser dengan alamat 74.135.235.52 OK
9. Menambahkan Primary DNS dan Secondary DNS
/ip dns set primary-dns=203.78.115.215 secondary-dns=203.78.115.222 allow-remoterequest=yes
-cek ping ke google.com OK
-cek ping dari computer client ke google OK
- ganti allow-remote-request=no
/ip dns set allow-remote-request=no
-cek ping dari computer client ke google masih bisa ????
10. Menambahkan DHCP Server packet
1. Buat IP Pool
/ip pool add name = ippool1 ranges= 172.16.10.1-172.16.10.10
2. Setup DHCP Server
/ip dhcp-server add interface=Local address=ippool1
3. Setup Netwok; Gateway, DNS Server,..
/ip dhcp-server network add address=172.16.10.0/24 gateway=172.16.10.100 s=dnsserver=203.78.115.222
11. Membackup & Restore System configuration
/system backup save name=Backup1
/system backup load name=Backup1
atau=Backup1.backup
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
(seting NAT-vmware)
(lan segment)
(seting Bridge-vmware)
(lan segment)
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
chain=forward
chain=forward
chain=forward
chain=forward
chain=forward
chain=forward
src-address=0.0.0.0/8 action=drop
dst-address=0.0.0.0/8 action=drop
src-address=127.0.0.0/8 action=drop
dst-address=127.0.0.0/8 action=drop
src-address=224.0.0.0/3 action=drop
dst-address=224.0.0.0/3 action=drop
Create 3 rules to ensure that only connectionstate new packets will proceed through the
chain forward (same as in the Chain Input Lab)
Create rules to close most popular ports of viruses
Drop TCP and UDP port range 137-139
Drop TCP and UDP port 445
4. Condition: Connection State
Connection state is a status assigned to each packet by conntrack system:
New packet is opening a new connection
Related packet is also opening a new connection, but it is in some kind of relation
to an already established connection
Established packet belongs to an already known connection
Invalid packet does not belong to any of the known connections
Connection state TCP state
5. Address List
Firewall address lists allow user to create lists of IP addresses grouped together. Firewall
filter, mangle and NAT facilities can use address lists to match packets against them.
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
The address list records could be updated dynamically via the action=add-src-toaddress-list or action=add-dst-to-address-list items found in NAT mangle and filter
facilities.
The following example creates an address list of people thet are connecting to port 23
(telnet) on the router and drops all further traffic from them. Additionaly, the address list
will contain one static entry of address=192.0.34.166/32 (www.example.com):
/ip firewall address-list add list=drop_traffic address=192.0.34.166/32
/ip firewall mangle add chain=prerouting protocol=tcp dst-port=23 action=addsrc-to-address-list address-list=drop_traffic
/ip firewall filter add action=drop chain=input src-address-list=drop_traffic
6. NAT Type
As there are 2 IP addresses and ports in an IP packet header, there are 2 types of NAT .
1. which rewrites source IP address and/or port is called source NAT (src-nat)
- performed on packet that are originated from natted network
- a NAT router replace the private source address of an IP packet with anew public IP
Address as it travel trough the router.
2. which rewrites destination IP address and/or port is called destination NAT (dst-nat)
- performed on packet that a destined to the natted network,
- its most commonly used to make ahost on private network to be accessible from
internet
7. Firewall NAT Structure
Firewall NAT rules are organized in chains, There are two default chains
dstnat processes traffic sent to and through the router, before it divides in to
input and forward chain of firewall filter.
srcnat processes traffic sent from and through the router, after it merges from
output and forward chain of firewall filter.
There are also user-defined chains, Firewall NAT rules process only the first packet of
each connection (connection state new packets)
8. NAT Action (6 specific action NAT)
1. dst-nat and redirect
2. src-nat and masquarade
3. netmap
4. same
9. Source NAT Action
Action src-nat changes packet's source address and/or port to specified address
and/or Port
This action can take place only in chain srcnat
Typical application: hide specific LAN resources behind specific public IP address
10. Masquerade Action
5
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
Action masquerade changes packet's source address router's address and specified
port
This action can take place only in chain srcnat
Typical application: hide specific LAN resources behind one dynamic public IP
address
11. Destination NAT Action
Action dst-nat changes packet's destination address and port to specified address
and port
This action can take place only in chain dstnat
Typical application: ensure access to local network services from public network
12. Redirect NAT Action
Action redirect changes packet's destination address to router's address and
specified port
This action can take place only in chain dstnat
Typical application: transparent proxying of network services (DNS,HTTP)
13. Netmap & Same
Netmap - creates a static 1:1 mapping of one set of IP addresses to another one.
Often used to distribute public IP addresses to hosts on private networks
Same - gives a particular client the same source/destination IP address from the
supplied range for any connection. Used for services that expect constant IP address
for multiple connections from the same client
14. DNS Chache
DNS cache is used to minimize DNS-requests to an external DNS server as well as to minimize
DNS resolution time. This is a simple recursive DNS server without any local items. DNS protocol
is described in RFC1035 and related documents
The MikroTik router with DNS cache feature enabled can be set as primary DNS server for any
DNS-compliant clients. Moreover, MikroTik router can be specified as primary DNS server under
its dhcp-server settings. When the DNS cache is enabled, the MikroTik router responds to DNS
requests on TCP and UDP ports 53. Make sure you do not block this port in the firewall setup!
The DNS cache feature is included in the dns-cache package. The package file dnscache-2.6.x.npk can be downloaded from MikroTiks web page www.mikrotik.com. To
install the package, please upload it with ftp in BINARY mode to the router and reboot.
Use the /system package print command to see the list of installed packages.
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
size: 512
dns-server: 159.148.60.2
enabled - defines whether DNS cache (TCP and UDP port 53) is enabled or not
size - maximum number of entries in the cache
dns-server - parent DNS server that is used to resolve requests absent in the cache
The server's address is now 192.168.0.4, and we are running web server on it that listens to
the TCP port 80. We want to make it accessible from the Internet at address:port
10.0.0.217:80.
This can be done by means of Static Network Address translation (NAT) at the MikroTik
Router. The Public address:port 10.0.0.217:80 will be translated to the Local address:port
192.168.0.4:80. One destination NAT rule is required for translating the destination address
and port:
1. Tambahkan sebuah komputer (10.0.0.2) yang terhubung dengan interface Public
2. Beri IP Address untuk masing-masing interface router
3. Set default gateway :
/ip route add gateway=192.168.10.1
4. Set DSTNAT
/ip firewall nat> add chain=dstnat action=dst-nat protocol=tcp
dst-address=10.0.0.217/32 dst-port=80 to-addresses=192.168.0.4
ip firewall nat pr
Flags: X - disabled, I - invalid, D - dynamic
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
0 chain=dstnat dst-address=10.0.0.217/32 protocol=tcp dst-port=80
action=dst-nat to-addresses=192.168.0.4 to-ports=0-65535
LAB 01
TOPOLOGI JARINGAN
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
www.catatanteknisi.com
catatan tentang belajar mikrotik by: teknisi_gaptek
10