Tuesday 21 June 2011

Cara Setting Hit,Queues Tree,Mangle Mikrotik + Squid Proxy External (Lengkap)

Dengan Router Mikrotik di tambah Squid ProxyExternal seperti ubuntu,ClearOs,IpCop Dll…Performa akan menjadi mantab,apalagi menggunakan Squid Lusca…Cache semua pada di telan…Ok berikut ini saya post Cara Setting Hit,Queues Tree,Mangle Mikrotik + Squid Proxy External,Untuk Setting Squid nya nggak saya post karena…Ini Label Mikrotik,Untuk Setting squid lihat di label Squid,,,

Ip Addess MengarahMikrotik = 192.168.0.5 Ke Modem (internet)
Ip Address Mengarah Local = 192.168.34.1 Ke Client
Ip Address Mengarah Squid Proxy = 192.168.35.1 Ke Squid Proxy
Ip Address Squid Proxy = 192.168.35.2 Ip Squid Proxy External

 

Terobosan….:

  1. Total bandwidth dari Modem (internet) 4 MB
  2. Client Download dari Modem dilimit dengan queue tree,jika file datanya telah tersimpan di Squid Proxy maka otomatis tidak terlimit alias lepas Loss
  3. Untuk client yang download file seperti .flv .exe .rar .zip youtube dll…..dilimit 1 MB untuk semua file bagi rata,kecuali yang berbau bokep….bokep saya kasih 128 aja bagi rata…..nah…jika extention seperti .flv .exe .rar .zip youtube dll tersebut pernah di download…otomatis tersimpan di Squid proxy ..dan otomatis tidak terlimit extention tersebut…alias lepas loss….
  4. Untuk ping ….ini perlu….bagi bagi client yang main poker,pointblank,atau game lainnya..saya gunakan queue tree juga…tapi tidak di limit…
  5. Untuk Upload…tidak perlu di limit…demi kenyamanan pemain game

Berikut langkahnya dari awal…dari Router Mikrotik  belum berisi..alias kosong…:

Kita mainkan di new terminal semua:

  • Set interface:
/interface set 0 name=public \
;/interface set 1 name=local \
;/interface set 2 name=proxy

  • Set Ip address (Sesuaikan Ip address dgn jaringan anda):
/ip address add address=192.168.0.5 \
netmask=255.255.255.0 \
interface=public \
;/ip address add address=192.168.34.1 \
netmask=255.255.255.0 \
interface=local \
;/ip address add address=192.168.35.1 \
netmask=255.255.255.0 \
interface=proxy
  • Set Gateway (Sesuaikan Gateway dengan gateway jaringan anda):
/ip route add gateway=192.168.0.1
  • Set DNS (sesuaikan DNS sengan jaringan anda):
    • Cara set DNS Untuk RB Os versi 4.XX kebawah:
/ip dns set primary-dns=203.130.208.18
\
;/ip dns set secondary-dns=203.130.193.74 \
allow-remote-requests=yes
    • Cara set DNS untuk RB Os versi 4.XX keatas:
/ip dns set servers=203.130.208.18,203.130.193.74 \
allow-remote-requests=yes

  • Set Ip Firewall Nat …..termasuk nat untuk redirect ke proxy…saya gunakan port 3128 pada squid saya (ip addressnya sesuaikan dengan jaringan anda):
/ip firewall nat add chain=srcnat out-interface=public \
src-address=192.168.34.0/24 action=masquerade \
src-address-list="wirelessrouterproxy.blogspot.com client" \
comment="LOCAL NAT MASQUERADE"
/ip firewall nat add chain=srcnat out-interface=public \
src-address=192.168.35.0/24 action=masquerade \
src-address-list="wirelessrouterproxy.blogspot.com proxy" \
comment="PROXY NAT MASQUERADE"
/ip firewall nat add action=dst-nat chain=dstnat \
comment="REDIRECT KE PROXY" disabled=no \
dst-port=80,8080,3128 in-interface=local \
protocol=tcp src-address=!192.168.35.0/24 \
to-addresses=192.168.35.2 to-ports=3128
/ip firewall nat add action=dst-nat \
chain=dstnat comment="TRANSPARENT DNS UDP LOCAL" \
disabled=no dst-port=53 in-interface=local \
protocol=udp to-ports=53
/ip firewall nat add action=dst-nat \
chain=dstnat disabled=no dst-port=53 in-interface=local \
protocol=tcp to-ports=53 comment="TRANSPARENT DNS TCP LOCAL"
/ip firewall nat add action=dst-nat \
chain=dstnat disabled=no dst-port=53 in-interface=proxy \
protocol=udp to-ports=53 comment="TRANSPARENT DNS UDP PROXY"
/ip firewall nat add action=dst-nat \
chain=dstnat disabled=no dst-port=53 in-interface=proxy \
protocol=tcp to-ports=53 comment="TRANSPARENT DNS TCP PROXY"
  • Selanjutnya Keamanan jaringan :
/ip firewall filter add action=add-src-to-address-list \
address-list="PORT SCANNER1" \
address-list-timeout=2w chain=input \
comment="PORT SCANNER2 KE ADDRESS \
LIST " disabled=no protocol=tcp psd=21,3s,3,1
/ip firewall filter add action=add-src-to-address-list \
address-list="PORT SCANNER2" address-list-timeout=2w \
chain=input comment="NMAP FIN Stealth scan" disabled=no \
protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
/ip firewall filter add action=add-src-to-address-list \
address-list="PORT SCANNER3" address-list-timeout=2w \
chain=input comment="SYN/FIN scan" disabled=no \
protocol=tcp tcp-flags=fin,syn
/ip firewall filter add action=add-src-to-address-list \
address-list="PORT SCANNER4" address-list-timeout=2w \
chain=input comment="SYN/RST scan" disabled=no \
protocol=tcp tcp-flags=syn,rst
/ip firewall filter add action=add-src-to-address-list \
address-list="PORT SCANNER5" address-list-timeout=2w \
chain=input comment="FIN/PSH/URG scan" disabled=no \
protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
/ip firewall filter add action=add-src-to-address-list \
address-list="PORT SCANNER6" address-list-timeout=2w \
chain=input comment="ALL/ALL scan" disabled=no \
protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
/ip firewall filter add action=add-src-to-address-list \
address-list="PORT SCANNER7" address-list-timeout=2w \
chain=input comment="NMAP NULL scan" disabled=no \
protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
/ip firewall filter add action=drop chain=input \
comment="BLOK PORT SCANNER" disabled=no \
src-address-list="PORT SCANNER1"
/ip firewall filter add action=accept chain=input \
comment="IZINKAN MENDIRIKAN KONEKSI" \
connection-state=established disabled=no
/ip firewall filter add action=accept chain=input \
comment="IZINKAN KONEKSI TERKAIT" \
connection-state=related disabled=no
/ip firewall filter add action=accept chain=input \
comment="IZINKAN PING LOCAL" \
disabled=no protocol=icmp \
src-address-list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall filter add action=accept chain=input \
comment="IZINKAN PING PROXY" disabled=no \
protocol=icmp src-address-list=\
"wirelessrouterproxy.blogspot.com proxy"
/ip firewall filter add action=accept chain=input \
comment="IZINKAN INPUT DARI LOCAL" disabled=no \
src-address-list="wirelessrouterproxy.blogspot.com client"
/ip firewall filter add action=accept chain=input \
comment="IZINKAN INPUT DARI PROXY" disabled=no \
src-address-list="wirelessrouterproxy.blogspot.com proxy"
/ip firewall filter add action=jump chain=forward \
comment="FILTER PAKET YANG JELEK" disabled=no \
jump-target=tcp protocol=tcp
/ip firewall filter add action=jump \
chain=forward disabled=no jump-target=udp \
protocol=udp
/ip firewall filter add action=jump \
chain=forward disabled=no jump-target=icmp protocol=icmp
/ip firewall filter add action=drop chain=tcp \
comment="TOLAK SMTP" disabled=no dst-port=25 \
protocol=tcp
/ip firewall filter add action=drop chain=tcp \
comment="TOLAK RPC2portmapper" disabled=no \
dst-port=135 protocol=tcp
/ip firewall filter add action=drop chain=tcp \
comment="TOLAK NBT" disabled=no dst-port=137-139 \
protocol=tcp
/ip firewall filter add action=drop \
chain=tcp comment="TOLAK CIFS" disabled=no \
dst-port=445 protocol=tcp
/ip firewall filter add action=drop chain=tcp \
comment="TOLAK NFS" disabled=no dst-port=2049 \
protocol=tcp
/ip firewall filter add action=drop chain=tcp \
comment="TOLAK NETBUS" disabled=no dst-port=20034 \
protocol=tcp
/ip firewall filter add action=drop chain=tcp \
comment="TOLAK BackOriffice" disabled=no dst-port=\
3133 protocol=tcp
/ip firewall filter add action=drop chain=tcp \
comment="BLOK DHCP" disabled=no dst-port=67-68 \
protocol=tcp
/ip firewall filter add action=drop chain=tcp \
comment="TOLAK P2P" disabled=no p2p=all-p2p
/ip firewall filter add action=drop chain=udp \
comment="TOLAK TFTP" disabled=no dst-port=69 \
protocol=udp
/ip firewall filter add action=drop chain=udp \
comment="TOLAK PRC portmapper" disabled=no \
dst-port=111 protocol=udp
/ip firewall filter add action=drop chain=udp \
comment="TOLAK PRC portmapper" disabled=no \
dst-port=135 protocol=udp
/ip firewall filter add action=drop chain=tcp \
comment="TOLAK NETBUS" disabled=no \
dst-port=12345-12346 protocol=tcp
/ip firewall filter add action=drop chain=udp \
comment="BLOK NBT" disabled=no dst-port=137-139 \
protocol=udp
/ip firewall filter add action=drop chain=udp \
comment="BLOK NFS" disabled=no dst-port=2049 \
protocol=udp
/ip firewall filter add action=drop \
chain=udp comment="TOLAK BackOriffice" \
disabled=no dst-port=3133 protocol=udp
/ip firewall filter add action=accept chain=icmp \
comment="limit packets 5/secs" disabled=no \
icmp-options=0:0-255 limit=5,5 protocol=icmp
/ip firewall filter add action=accept chain=icmp \
comment="limit packets 5/secs" disabled=no \
icmp-options=3:0 protocol=icmp
/ip firewall filter add action=accept \
chain=icmp comment="limit packets 5/secs" \
disabled=no icmp-options=3:3 limit=5,5 protocol=icmp
/ip firewall filter add action=accept chain=icmp \
comment="limit packets 5/secs" disabled=no \
icmp-options=3:4 limit=5,5 protocol=icmp
/ip firewall filter add action=accept chain=icmp \
comment="limit packets 5/secs" disabled=no \
icmp-options=8:0-255 limit=5,5 protocol=icmp
/ip firewall filter add action=accept \
chain=icmp comment="limit packets 5/secs" \
disabled=no icmp-options=11:0-255 limit=5,5 protocol=icmp
/ip firewall filter add action=accept chain=forward \
comment="Allow Established connections" \
connection-state=established disabled=no
/ip firewall filter add action=accept chain=forward \
comment="Allow Forward from LOCAL Network" \
disabled=no src-address-list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall filter add action=accept chain=forward \
comment="Allow Forward from PROXY Network" \
disabled=no src-address-list=\
"wirelessrouterproxy.blogspot.com proxy"
  • Selanjutnya buat address list untuk client anda…tujuannya hanya ip address yang di buat ini yang bisa terkoneksi ke internet…jika client anda melebihi sebanayak yang terdaftar di bawah ini…silahkan di tambah..sesuai dgn jumlah client anda….(Sesuaikan ip addresnya dengan jaringan anda):
/ip firewall address-list \
add address=192.168.35.2 \
comment="SQUID PROXY EXTERNAL" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com proxy"
/ip firewall address-list \
add address=192.168.34.2 \
comment="CLIENT1" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.3 \
comment="CLIENT2" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.4 \
comment="CLIENT3" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.5 \
comment="CLIENT4" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.6 \
comment="CLIENT5" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.7 \
comment="CLIENT6" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.8 \
comment="CLIENT7" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.9 \
comment="CLIENT8" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.10 \
comment="CLIENT9" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.11 \
comment="CLIENT10" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
/ip firewall address-list \
add address=192.168.34.12 \
comment="CLIENT11" \
disabled=no list=\
"wirelessrouterproxy.blogspot.com client"
  • Selanjutnya Firwall layer7,yang nanti nya untuk limit .exe .zip .rar dll:
/ip firewall layer7-protocol add name=YOUTUBE \
regexp="http/(0\\.9|1\\.0|1\\.1)[\\x09-\\x0d ][1-5][0-9][0\
-9][\\x09-\\x0d -~]*(content-type: video)"
/ip firewall layer7-protocol add name="EXE" \
regexp="\\.(exe)"
/ip firewall layer7-protocol add name="RAR" \
regexp="\\.(rar)"
/ip firewall layer7-protocol add name="7z" \
regexp="\\.(7z)"
/ip firewall layer7-protocol add name="CAB" \
regexp="\\.(cab)"
/ip firewall layer7-protocol add name="ASF" \
regexp="\\.(asf)"
/ip firewall layer7-protocol add name="MOV" \
regexp="\\.(mov)"
/ip firewall layer7-protocol add name="WMV" \
regexp="\\.(wmv)"
/ip firewall layer7-protocol add name="MPG" \
regexp="\\.(mpg)"
/ip firewall layer7-protocol add name="MPEG" \
regexp="\\.(mpeg)"
/ip firewall layer7-protocol add name="MKV" \
regexp="\\.(mkv)"
/ip firewall layer7-protocol add name="ZIP" \
regexp="\\.(zip)"
/ip firewall layer7-protocol add name="AVI" \
regexp="\\.(avi)"
/ip firewall layer7-protocol add name="FLV" \
regexp="\\.(flv)"
/ip firewall layer7-protocol add name="WAV" \
regexp="\\.(wav)"
/ip firewall layer7-protocol add name="RM" \
regexp="\\.(rm)"
/ip firewall layer7-protocol add name="MP3" \
regexp="\\.(mp3)"
/ip firewall layer7-protocol add name="MP4" \
regexp="\\.(mp4)"
/ip firewall layer7-protocol add name="RAM" \
regexp="\\.(ram)"
/ip firewall layer7-protocol add name="RMVB" \
regexp="\\.(rmvb)"
/ip firewall layer7-protocol add name="DAT" \
regexp="\\.(dat)"
/ip firewall layer7-protocol add name="DAA" \
regexp="\\.(daa)"
/ip firewall layer7-protocol add name="ISO" \
regexp="\\.(iso)"
/ip firewall layer7-protocol add name="NRG" \
regexp="\\.(nrg)"
/ip firewall layer7-protocol add name="BIN" \
regexp="\\.(bin)"
/ip firewall layer7-protocol add name="VCD" \
regexp=\\.(vcd)
  • Selanjutanya Mangle…….
    • Mangle Suid Hit:
/ip firewall mangle add action=mark-packet \
chain=forward comment="SQUID PROXY HIT" \
disabled=no dscp=12 \
new-packet-mark="PROXY HIT" passthrough=no

    • Mangle Squid koneksi dan squid Paket:
/ip firewall mangle add action=mark-connection \
chain=prerouting comment="BROWSING SQUID" disabled=no \
dst-address-list="!wirelessrouterproxy.blogspot.com client" \
dst-port=80,443 new-connection-mark="SQUID KONEKSI" \
passthrough=yes protocol=tcp \
src-address-list="wirelessrouterproxy.blogspot.com proxy"
/ip firewall mangle add action=mark-packet \
chain=forward comment="SQUID PAKET" \
connection-mark="SQUID KONEKSI" disabled=no \
new-packet-mark="SQUID PAKET" passthrough=no
    • Mangle Semua koneksi masuk dan koneksi keluar:
/ip firewall mangle add action=mark-connection \
chain=prerouting comment="TANDA SEMUA KONEKSI" disabled=no \
dst-address-list="!wirelessrouterproxy.blogspot.com client" \
in-interface=local new-connection-mark="SEMUA KONEKSI MASUK" \
passthrough=yes
/ip firewall mangle add action=mark-connection \
chain=forward disabled=no \
new-connection-mark="SEMUA KONEKSI KELUAR" \
out-interface=local passthrough=yes \
src-address-list="!wirelessrouterproxy.blogspot.com client" \
comment="SEMUA KONEKSI KELUAR"
/ip firewall mangle add chain=prerouting \
action=mark-packet new-packet-mark="SEMUA PAKET_MASUK"\
passthrough=yes connection-mark="SEMUA KONEKSI MASUK" \
comment="SEMUA PAKET MASUK"
/ip firewall mangle add chain=forward \
action=mark-packet new-packet-mark="SEMUA PAKET KELUAR" \
passthrough=yes connection-mark="SEMUA KONEKSI KELUAR"
comment="SEMUA PAKET KELUAR"
    • Mangle Browsing koneksi yang koneksi dari semua koneksi masuk:
/ip firewall mangle add action=mark-connection chain=prerouting \
comment="BROWSING CLIENT" \
connection-mark="SEMUA KONEKSI MASUK" disabled=no \
new-connection-mark="BROWSING KONEKSI" \
passthrough=yes protocol=tcp
    • Mangle Koneksi ICMP dengan dscp1:
/ip firewall mangle add action=mark-connection \
chain=postrouting disabled=no dscp=1 \
new-connection-mark="ICMP KONEKSI" passthrough=yes \
comment="ICMP KOMEKSI"
    • Mangle Game koneksi yang koneksi dari semua koneksi masuk:
    • Mangle Pointblank,Poker,dan RF online,jika anda ingin memasukkan game lainnya silahkan cari port game tersebut:
/ip firewall mangle add action=mark-connection \
chain=prerouting comment="POINT BLANK" \
connection-mark="SEMUA KONEKSI MASUK" \
disabled=no dst-port=40000-40010 \
new-connection-mark="GAME KONEKSI" \
passthrough=yes protocol=udp
/ip firewall mangle add action=mark-connection \
chain=prerouting comment="POKER" \
connection-mark="SEMUA KONEKSI MASUK" \
disabled=no dst-port=9339,843 \
new-connection-mark="GAME KONEKSI" \
passthrough=yes protocol=tcp
/ip firewall mangle add action=mark-connection \
chain=prerouting comment="RF ONLINE" \
connection-mark="SEMUA KONEKSI MASUK" disabled=no \
dst-port=10001,10002,10003,10004,10005,10006,10007 \
new-connection-mark="GAME KONEKSI" \
passthrough=yes protocol=udp
    • Mangle ICMP PAKET:
/ip firewall mangle add action=mark-packet \
chain=postrouting connection-mark="ICMP KONEKSI" \
disabled=no new-packet-mark="ICMP PAKET" passthrough=no \
comment="ICMP PAKET"
    • Selanjutnya mangle Game Paket:
/ip firewall mangle add action=mark-packet \
chain=forward comment="SEMUA GAME DIPAKETKAN" \
connection-mark="GAME KONEKSI" disabled=no \
new-packet-mark="GAME PAKET" passthrough=no
    • Selanjutnya Bowsing paket:
/ip firewall mangle add action=mark-packet \
chain=forward comment="BROWSING PAKET" \
connection-bytes=0-131072 \
connection-mark="BROWSING KONEKSI" \
disabled=no new-packet-mark="BROWSING PAKET" \
passthrough=no protocol=tcp
    • Change dscp ICMP dan Port 53:
/ip firewall mangle add action=change-dscp \
chain=postrouting comment="ICMP CHANGE DSCP" \
disabled=no new-dscp=1 protocol=icmp
/ip firewall mangle add action=change-dscp \
chain=postrouting disabled=no dst-port=53 new-dscp=1 \
protocol=udp
/ip firewall mangle add action=change-dscp \
chain=postrouting disabled=no dst-port=53 new-dscp=1 \
protocol=tcp
    • Mangle Extention file seperti .zip .rar .flv .exe dll :
/p firewall mangle add action=mark-connection \
chain=forward comment="EXTENTION KONEKSI" \
disabled=no in-interface=local \
new-connection-mark="EXTENTION KONEKSI" \
passthrough=yes
/ip firewall mangle add action=mark-packet \
chain=forward comment="YOUTUBE MARK" \
connection-mark="EXTENTION KONEKSI" disabled=no \
new-packet-mark="YOUTUBE" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="WMV MARK" \
connection-mark="EXTENTION KONEKSI" disabled=no \
new-packet-mark="WMV" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="EXE MARK" \
connection-mark="EXTENTION KONEKSI" disabled=no \
new-packet-mark="EXE" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="ZIP MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="ZIP" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="RAR MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="RAR" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="MPG MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="MPG" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="MPEG MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="MPEG" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="MP3 MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="MP3" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="MOV MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="MOV" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="ISO MARK" disabled=no \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="ISO" \
passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="MKV MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="MKV" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="FLV MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="FLV" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="AVI MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="AVI" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="CAB MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="CAB" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="ASF MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="ASF" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="WAV MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="WAV" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="RM MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="RM" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="RAM MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="RAM" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="RMVB MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="RMVB" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="DAT MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="DAT" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="DAA MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="DAA" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="NRG MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="NRG" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="BIN MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="BIN" passthrough=no
/ip firewall mangle add action=mark-packet \
chain=forward comment="VCD MARK" \
connection-mark="EXTENTION KONEKSI" \
new-packet-mark="VCD" passthrough=no
    • Mangle Paket client (sesuaikan Ip addressnya dengan ip address client jaringan anda):
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT1" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.2 \
new-packet-mark="CLIENT1" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT2" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.3 \
new-packet-mark="CLIENT2" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT3" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.4 \
new-packet-mark="CLIENT3" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT4" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.5 \
new-packet-mark="CLIENT4" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT5" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.6 \
new-packet-mark="CLIENT5" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT6" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.7 \
new-packet-mark="CLIENT6" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT7" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.8 \
new-packet-mark="CLIENT7" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT8" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.9 \
new-packet-mark="CLIENT8" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT9" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.10 \
new-packet-mark="CLIENT9" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT10" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.11 \
new-packet-mark="CLIENT10" \
passthrough=no protocol=tcp
/ip firewall mangle add action=mark-packet \
chain=forward comment="CLIENT11" \
connection-mark="SEMUA KONEKSI KELUAR" \
disabled=no dst-address=192.168.34.12 \
new-packet-mark="CLIENT11" \
passthrough=no protocol=tcp
  • Queue Tree
    • Queue tree ICMP prioritas ke 1:
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no \
limit-at=0 max-limit=0 name="ICMP PING" \
packet-mark="ICMP PAKET" parent=public priority=1 \
queue="default"
    • Queue Squid Hit Prioritas ke 2:
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no \
limit-at=0 max-limit=0 name="SQUID HIT" \
packet-mark="PROXY HIT" parent=local priority=2 \
queue=default
    • Queue Limit Extention prioritas ke 3 (jika anda ingin melimit yang berbeda silahkan ubah max-limitnya):
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=1000000 \
name="LIMIT FILE EXTENTION" parent=global-out priority=3
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=128000 \
name="AVI" packet-mark=AVI parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="EXE" packet-mark="EXE" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=128000 \
name="FLV" packet-mark="FLV" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="YOUTUBE" packet-mark="YOUTUBE" \
parent="LIMIT FILE EXTENTION" priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="ISO" packet-mark=iso parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 name="MP3" \
packet-mark="MP3" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 name="MP4" \
packet-mark="MP4" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=128000 \
name="MPEG" packet-mark="MPEG" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=128000 \
name="MPG" packet-mark="MPG" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="RAR" packet-mark="RAR" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=128000 \
name="WMV" packet-mark="WMV" \
parent="LIMIT FILE EXTENTION" priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="ZIP" packet-mark="ZIP" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="CAB" packet-mark="CAB" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="ASF" packet-mark="ASF" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="MOV" packet-mark="MOV" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="MKV" packet-mark="MKV" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="WAV" packet-mark="WAV" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="RM" packet-mark="RM" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="RAM" packet-mark="RAM" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="RMVB" packet-mark="RMVB" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="DAT" packet-mark="DAT" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="DAA" packet-mark="DAA" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="NRG" packet-mark="NRG" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="BIN" packet-mark="BIN" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="VCD" packet-mark="VCD" parent="LIMIT FILE EXTENTION" \
priority=3 queue=default
    • Queue tree Semua Upload Prioritas ke 4 :
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="+++TOTAL UPLOAD+++" \
packet-mark="SEMUA PAKET MASUK" \
parent=public priority=4 queue=default
    • Total download Prioritas ke 5 :
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="+++TOTAL DOWNLOAD+++" packet-mark="SEMUA PAKET KELUAR" \
parent=global-out priority=5
    • Game download Prioritas ke  6 :
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="GAME DOWNLOAD" packet-mark="GAME PAKET" \
parent="+++TOTAL DOWNLOAD+++" priority=6 \
queue=default
    • Queue Browsing Paket Priority ke 7
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s \
disabled=no limit-at=0 max-limit=0 \
name="BROWSING PAKET" packet-mark="BROWSING PAKET" \
parent="+++TOTAL DOWNLOAD+++" priority=7 queue=default
    • Queue tree Total download client priority8
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no \
limit-at=0 max-limit=0 name="+++TOTAL DOWNLOAD CLIENT+++" \
parent="+++TOTAL DOWNLOAD+++" priority=8
    • Queue tree client priority8
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT1" packet-mark="CLIENT1" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT2" packet-mark="CLIENT2" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT3" packet-mark="CLIENT3" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT4" packet-mark="CLIENT4" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT5" packet-mark="CLIENT5" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT6" packet-mark="CLIENT6" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT7" packet-mark="CLIENT7" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT8" packet-mark="CLIENT8" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT9" packet-mark="CLIENT9" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT10" packet-mark="CLIENT10" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default
/queue tree add burst-limit=0 \
burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name="CLIENT11" packet-mark="CLIENT11" \
parent="+++TOTAL DOWNLOAD CLIENT+++" priority=8 queue=default

Sekarang percobaan …..saya coba youtube

Buka youtube.com..dan cari video kesukaan anda..yang belum pernah di putar..dan belum pernah di cache squid external proxy anda,seperti gambar di bawah ini:

Video terlimit….Limit Extention nya merah …kemudian Static youtube nya ..penuh sampai 1 MB Avg rate nya,lihat gambar di bawah ini:

Tunggu videonya berbutar sampai selesai…squid external proxy akan menyimpan content tersebutsampai selesai seperti gambar di bawah ini:

Biasanya mozilla firefox juga mempunya cache…untuk memastikan cache tersebut telah tersimpan di squid external proxy …maka hapus cache mozilla firefox,seperti gambar di bawah ini:

Pilih everityng dan clear now,seperti gambar di bawah ini:

Sekarang tutup mozilla firefox anda….dan buka kembali youtube.com..selanjutnya cari video yang tadi…dan putar…terlihat bahwa video tersebut telah tercache di squid proxy…loading streamingnya jauh mendahului play video tersebut…seperti tanda panah gambar di bawah ini:

Kemudian secara bersamaan video itu terputar…buka winbox…dan lihat queue tree untuk limit extention…di bawah ini bias dilihat…bahwa video youtube tersebut tidak terlimit…karena sudah ada tersimpan di cache squid external proxy anda…

Selesai---

Saturday 18 June 2011

Cara Pasang dan Setting Wireless Mikrotik Point to Point jangkauan 40 KM

Dengan Wireless Mikrotik dan Mini Pci ubiquity XR5 atau XR2 anda bisa share Point to Point hingga 40 KM lebih,di sini saya menggunakn Mini Pci XR5 karena tinggkat interfensi yang rendah dengan Band 5.8 Ghz …Ok peralatan yang di butuhkan:

  • Dua bijik Wireless Board Mikrotik RB 411 ,seperti gambar di bawah:

  • Mini PCI Ubiquity XR5 dua bijik,seperti gambar di bawah ini:

  • Out Door Box (TiBox) dua bijik,seperti gambar di bawah ini:

  • Adaptor 24 Volt dua bijik,dan POE dua bijik,seperti gambar di bawah ini:

  • Pigtail MMCX dua bijik,seperti gambar di bawah ini:

  • Cable gland dua bijik ,dan Ring out door box dua bijik,seperti gambar di bawah ini:

  • Jumper Connector N Name to N male dua bijik,seperti gambar di bawah ini:

  • Antenna Grid Kenbotong 5.8 Ghz dua bijik,seperti gambar di bawah ini:

  • 3M Rubber Tape,seperti gambar di bawah ini:

  • Kabel STP secukupnya,seperti gambar di bawah ini:

  • Pasang Wireless Mikrotik RB 411 ke Box Outdoor,seperti gambar di bawah ini:

  • Selanjutnya Pasang Mini PCI XR5 ke Wireless Mikrotik RB411 dan Pigtail MMCX seperti gambar di bawah ini:

  • Selanjutnya pasang antenna grid kenbotong,seperti gambar di bawah ini:

  • Periksa kaki antenna grid ,jgn sampai terbalik,seperti gambar di bawah ini:

  • Setelah itu pasang antenna grid ke tower dan nyalakan Wireless Mikrotik nya,dan buka winbox,set untuk Access Point seperti gambar di bawah ini:

  • Selanjutnya Pasang Wireless Mikrotik Client di tower,kemudian set di winbox seperti gambar di bawah ini,saya menggunakan bridge:

  • Tx powernya default aja,seperti gambar di bawah ini:

  • Kemudian Scan Access pointnya,hehe…dapet -64 ….perlu anda ingat..untuk hasil yang memuaskan sebaiknya jumper jgn sampai loss,tidak perlu jumpernya di putar kuat2 ke pigtail MMCX nya…sedikit direnggangkan ,kemudian di balut dengan 3M rubber,hasil scan seperti gambar di bawah ini:

  • Dengan tingkat Loss yang rendah dan Interfensi juga rendah,Point to Point yang akurat,sensitifitas yang tinggi,maka untuk 30 KM dapat throughput yang sangat memuaskan,seperti gambar di bawah ini:

  • Tidak perlu Power besar besar,cukup dengan :
    1.Tingkat Loss yang rendah,periksa jumper
    2.Sensifity yang tinggi,Mini PCI yang bagus
    3.Tingkat interfensi yang rendah,Band 5.8 Ghz
    4.Point to Point yang akurat,gunakan GPS

Selamat Mencoba--

Thursday 9 June 2011

Cara men stabilkan ping saat koneksi padat di Mikrotik Router

Mikrotik Router bisa mengkondisikan ping saat koneksi padat,misalnya seperti jalan lagi padat dan mecet nih,nah untuk ping kita buat di jalan bus way,biasanya jika jalan koneksi lagi padat ping jadi lemah…akibatnya semua jenis permainan jadi ngelag,seperti pointblank,poker,dan lain lain…begini caranya:

  • Remote mikrotik anda dengan winbox…kemudian copykan scripts di bawah ini dan pastekan di “New Terminal” winbox Mikrotik Router anda:
/ip firewall mangle add chain=prerouting \
protocol=icmp action=mark-connection \
new-connection-mark=ICMP_KONEKSI \
passthrough=yes comment="ICMP_KONEKSI" \
disabled=no

  • Dan Tekan Enter di Keyboard
  • Untuk melihat hasilnya,di halaman utama winbox pilih “Ip” kemudian “Firewall” kemudian “Mangle” seperti gambar di bawah ini:

  • Selanjutnya copykan lagi scripts mangle di bawah ini dan pastekan di “New Terminal” winbox mikrotik router anda:
/ip firewall mangle add chain=prerouting \
protocol=icmp connection-mark=ICMP_KONEKSI \
action=mark-packet new-packet-mark=ICMP_PAKET \
passthrough=no comment="ICMP_PAKET" \
disabled=no
  • Dan Tekan Enter Di keyboard
  • Untuk melihat hasilnya,di halaman utama winbox pilih “Ip” kemudian “Firewall” kemudian “Mangle” seperti gambar di bawah ini:

  • Kemudian Copykan scripts queue tree di bawah ini , dan pastekan di “New Terminal” winbox mikrotik router anda:
/queue tree add name="==KONDISI_PING==" \
parent=global-total packet-mark=ICMP_PAKET \
limit-at=0 queue=default priority=1 max-limit=0 \
burst-limit=0 burst-threshold=0 burst-time=0s

  • Dan Tekan Enter Di keyboard
  • Untuk melihat hasilnya,dihalaman utama winbox pilih “Queues ”kemudian  “Queues Tree” ,seperti gambar di bawah ini:

  • Selanjutnya anda ping di “New Terminal” winbox mikrotik router anda ping yahoo.com
  • Tanpa menutup “New Terminal” winbox mikrotik router anda langsung buka “Queue Tree” kemudian di kolom “Queue Tree” anda lihat “Avg Rate”nya,jika berjalan berarti telah sukses,dan ping client akan stabil,seperti gambar di bawah ini:

 

Selamat Mencoba--