Starting from RouterOS version 6.14, MikroTik offers a Dynamic DNS name service with some clicks on WinBox we can connect to MikroTik device which using dynamic public ip address from internet.
System: RB750 v6.2x
Steps to setup IP Cloud:
1) Login to Mikrotik via WinBox as Administrative priviledge.
2) On IP menu select Cloud
Continue reading
Skenario
Mikrotik RB450G tidak bisa diakses karena lupa password,solusi akan dilakukan hard reset dengan Netinstall dan install RouterOS.
Preparation
-Download Netinstall disini .
-Download RouterOS mispbe untuk model RB450G disini dan unzip ke folder.
-Pastikan firewall atau anti virus di PC/laptop tidak mengeblok Netinstall.
-(Optional) Disconnect laptop/PC dari wireless sehingga cuma ada koneksi ethernet dari laptop/PC ke Mikrotik.
Step-step Hard Reset
1) Setting IP address statik di ethernet PC/laptop, saya setting: 192.168.2.5/24
Continue reading
Skenario:
VPN clients(192.168.90.2-10) — eth1(public ip):mikrotik:eth2(LAN 192.168.99.1) — LAN Clients (192.168.99.x/24)
System:
-Mikrotik RB750 RouterOS v5.20
I. Create pool ip address for VPN clients ip address
Example create pool for 9 VPN clients with ip address 192.168.90.2-192.168.90.10
/ip pool
add name=vpn-pool ranges=192.168.90.2-192.168.90.10
Skenario:
internet — ip public:ether1-gateway:Mikrotik RB750:ether2-master-local:192.168.99.1 — clients:192.168.99.x/24
I. Memisah bandwidth IIX dan Internasional
-Download script nice.rsc dari http://ixp.mikrotik.co.id/download/nice.rsc
-Via Winbox => New Terminal ketik
/tool fetch address=ixp.mikrotik.co.id src-path=/download/nice.rsc mode=http;
Setup Hotspot User Manager di Mikrotik disini hanya sekedar catatan pribadi, menggunakan command line di terminal karena malas upload gambar ^_^
Untuk lebih mudah bisa setup hotspot lewat winbox…
Skenario:
-Router RB750: RouterOS v5.14 mispbe
-Eth1 : Internet
-Eth2 : IP Address 192.168.88.1, DHCP Server, DNS, Hotspot
-Pastikan package User Manager sudah terinstall di RB750. Via Winbox cek di System ==> Packages
1. Setup Radius
/radius add accounting-backup=no accounting-port=1813 address=127.0.0.1 authentication-port=1812 called-id="" disabled=no domain="" realm="" secret=qwerty service=hotspot timeout=300ms
/radius incoming set accept=no port=3799
Speedy paket familia menggunakan ip dynamic,jadi biar mikrotik bisa diremote dari luar maka mikrotik disetup autoupdate ke dyndns.com.. Mikrotik yg digunakan seri RB750 dengan OSv4.6(also work on OS v5.14) bridge mode(Dial dari mikrotik)
1. Add script:
–Via Winbox: System => Scripts => Klik tanda + => Beri nama script sesuai keinginan => Centang semua Policy => Masukkan script dibawah ini => Klik Apply => Klik OK
Continue reading
Reference:
http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention
allows only 10 FTP login incorrect answers per minute
/ip firewall filter
add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \
comment="drop ftp brute forcers"
add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m
add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \
address-list=ftp_blacklist address-list-timeout=3h
This will prevent a SSH brute forcer to be banned for 10 days after repetitive attempts. Change the timeouts as necessary.
/ip firewall filter
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute forcers" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=10d comment="" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m comment="" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \
action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \
address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no
If you want to block downstream access as well, you need to block the with the forward chain:
/ip firewall filter
add chain=forward protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute downstream" disabled=no
1. Setting Bridge di Modem Router Speedy
-Masuk ke konfigurasi Modem Router Speedy via web. (Saya menggunakan TP-Link,dengan iface LAN Modem (http://192.168.1.1)
-Setting Interface Internet menjadi Bridge & Encap Mode LLC, seperti pada Gambar. Untuk setting VPI & VCI bisa browsing google untuk daerah masing-masing.(Saya di Jakarta)
1. Setting timezone, via Winbox pilih System => Clock
Setup Clock via Terminal:
/system clock
set time-zone-name=Asia/Jakarta
2. Setting NTP Client sinkronisasi dengan NTP Server, via Winbox menu System => NTP Client
-Primary NTP Server: id.pool.ntp.org or pool.ntp.org or asia.pool.ntp.org
-Secondary NTP Server : time.windows.com
Continue reading
-Via Winbox => New Terminal => type command:
/system reset-configuration
pilih yes maka router secara otomatis reboot, setelah reboot maka konfigurasi kembali ke default..