Eyed Of Office Boy

Cisco Router - Basic Command

2015-04-07T09:01:00.000+07:00

Hostname Configuration

Untuk memudahkan manajemen router dalam jumlah yang banyak, maka setiap router harus diberikan hostname sebagai pengenal. Pengenal ini berguna pada saat akan melakukan konfigurasi maupun monitoring dalam jaringan.

Untuk melakukan konfigurasi hostname, harus dilakukan pada global EXEC Mode, seperti berikut.

Router>enable

Router#conf

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname IlmuJaringan-ROUTER

IlmuJaringan-ROUTER(config)#exit

IlmuJaringan-ROUTER#

%SYS-5-CONFIG_I: Configured from console by console

IlmuJaringan-ROUTER#

Router Password

Password pada Router Cisco dapat diterapkan pada berbagai level maupun akses konfigurasi. Pada saat akan memasuki privileged EXEC mode dapat diimplementasikan password dengan menggunakan perintah sebagai berikut.

Router>enable

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#enable password 123456

Jika ingin menerapkan password yang sudah dienkripsi pada saat akan memasuki privileged EXEC Mode, maka perintah yang dapat digunakan adalah sebagai berikut.

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#enable secret 567890

Router(config)#^Z

Jika enable password dan enable secret digunakan bersamaan, maka yang akan digunakan oleh router adalah password yang dikonfigurasikan oleh enable secret.

Port Console yang sering digunakan untuk konfigurasi router juga dapat diberikan password dengan menggunakan perintah sebagai berikut.

Router#

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#line console 0

Router(config-line)#password cisco

Router(config-line)#login

Router(config-line)#exit

Sedangkan untuk akses konfigurasi yang menggunakan telnet dapat diberikan password, dengan menggunakan perintah berikut ini.

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#line vty 0 4

Router(config-line)#password cisco

Router(config-line)#login

Router(config-line)#exit

Secara default konfigurasi password pada line console maupun telnet tidak dienkripsi sehingga dapat dengan mudah dibaca, seperti terlihat berikut ini.

Router#show running-config

Building configuration…

Current configuration : 518 bytes

version 12.2

no service timestamps log datetime msec

line con 0

password cisco

login

line vty 0 4

password cisco

login

end

Untuk membuat password terenkripsi dapat digunakan perintah berikut ini.

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#service password-encryption

Banner

Mengkonfigurasikan banner sangat penting untuk pertimbangan keamanan suatu router, banner tersebut akan diperlihatkan pada saat ada user yang akan mengakses router. Peirntah yang dapat digunakan adalah sebagai berikut.

Router(config)#banner motd #

Enter TEXT message. End with the character ‘#’.

*********************************************

WARNING !!! Forbiden Access to this Device

*********************************************

Interface Configuration

Untuk mengkonfigurasikan interface Router Cisco, ada baiknya melihat terlebih dahulu interface apa saja yang dimiliki router tersebut. Perintah yang dapat digunakan adalah sebagai berikut

Router#show interface

FastEthernet0/0 is administratively down, line protocol is down (disabled)

Hardware is Lance, address is 0060.3e14.7701 (bia 0060.3e14.7701)

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

ARP type: ARPA, ARP Timeout 04:00:00,

Last input 00:00:08, output 00:00:05, output hang never

Last clearing of “show interface” counters never

Input queue: 0/75/0 (size/max/drops); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 input packets with dribble condition detected

0 packets output, 0 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

FastEthernet0/1 is administratively down, line protocol is down (disabled)

Hardware is Lance, address is 0060.3e14.7702 (bia 0060.3e14.7702)

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

ARP type: ARPA, ARP Timeout 04:00:00,

Last input 00:00:08, output 00:00:05, output hang never

Last clearing of “show interface” counters never

Input queue: 0/75/0 (size/max/drops); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 input packets with dribble condition detected

0 packets output, 0 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#interface f0/0

Router(config-if)#ip address 192.168.0.1 255.255.255.0

Router(config-if)#no shutdown

Router(config-if)#exit

Router(config)#

Router(config)#interface f0/1

Router(config-if)#ip address 192.168.1.1 255.255.255.0

Router(config-if)#no shutdown

Router(config-if)#exit

Saving Configuration

Cisco Router menggunakan dua konfigurasi yang disimpan pada dua file yang berbeda pula. Startup Configuration File adalah adalah file yang menyimpan konfigurasi yang akan digunakan router pada saat router tersebut pertama kali dihidupkan. Startup Configuration disimpan pada NVRAM sehingga tidak akan hilang pada saat router dimatikan maupun kehilangan power. Pada saat Router dihidupkan, Startup Configuration File akan di-copy ke dalam RAM untuk menjadi Running Configuration File. Karena disimpan dalam RAM, maka Running Configuration File akan hilang pada saat router kehilangan power.

Pada saat melakukan konfigurasi router, semua perintah konfigurasi akan disimpan pada Running Configuration File. Sehingga untuk mencegah kehilangan konfigurasi, maka konfigurasi yang tersimpan pada Running Configuration File perlu di-copy ke Startup Configuration File. Perintah yang dapat digunakan adalah sebagai berikut.

Router#copy running-config startup-config

Destination filename [startup-config]?

Building configuration…

[OK]

Router#

Atau dapat juga menggunakan perintah singkat seperti berikut ini.

Router#write

Building configuration…

[OK]

Basic Routing Table

Tabel routing adalah tabel yang akan digunakan router sebagai pedoman untuk mengirimkan paket data. Router hanya akan mengirimkan paket ke suatu network, jika network tersebut terdaftar didalam tabel routingnya. Jika ada sebuah paket yang menuju suatu network yang tidak terdaftar di dalam tabel routingnya, maka paket tersebut akan di-drop.

Yang akan ada di dalam tabel routing adalah network address dari jaringan yang dapat dituju beserta bagaimana cara router tersebut mencapai jaringan tersebut. Entry pada tabel routing tersebut bisa berupa network yang terhubung langsung (directly connected network) maupun network yang dapat dituju melalui router lain (remote network).

Router#show ip route

Codes: C – connected, S – static, I – IGRP, R – RIP, M – mobile, B – BGP

D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area

N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2

E1 – OSPF external type 1, E2 – OSPF external type 2, E – EGP

i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area

* – candidate default, U – per-user static route, o – ODR

P – periodic downloaded static route

Gateway of last resort is not set

C 192.168.0.0/24 is directly connected, FastEthernet0/0

C 192.168.1.0/24 is directly connected, FastEthernet0/1

2015-01-15T20:17:00.000+07:00

ATS (Automatic Transfer switch), adalah alat yang berfungsi untuk memindahkan koneksi antara sumber tegangan listrik satu dengan sumber tegangan listrik lainnya secara automatis. Atau bisa juga disebut Automatic COS (Change Over Switch)

Sedangkan AMF (Automatic Main Failure), berfungsi untuk menyalakan mesin genset jika beban yang di layani kehilangan sumber energy listrik utama/PLN.

Dari penjelasan singkat tersebut dapat kita asumsikan fungsi utama ATS/AMF adalah menyalakan genset jika sumber listrik utama PLN mati. Dan menghubungkan daya/listrik dari genset terhadap beban secara otomatis.

Baiklah.. dalam posting kali ini saya akan membahas bagaimana membuat Panel ATS/AMF sederhana yang bisa diaplikasikan pada pemakaian sehari-hari, baik dilingkungan industri maupun rumah.

Pemahaman

Saya mengasumsikan, untuk menghidupkan genset yang digunakan hanya tinggal menekan starter, dan untuk mematikannya hanya perlu menekan tombol Off. Jika belakangan diketahui ada cara-cara menghidupkan dan mematikan dengan teknik lain, saya sarankan mengubah sistem kerjanya menjadi seperti yang telah saya sebutkan diatas tadi (Tekan Starter = nyala, Tekan tombol Off = mati). Mintalah pada teknisi penjual gensetnya untuk memodifikasi.

Ingat! panel yang saya buat ini hanya dasarnya saja, jadi mohon maklum bila saya tidak menambahkan asesoris lain seperti Voltmeter, Ampermeter, pilot Lamp, Frequensimeter, Phase Failure Relay dan sebagainya. Saya hanya menitikberatkan pengautomatisan penggunaan tombol Starter dan Off sebagai fungsi utama kerja "Change Over Switch" pada panel ATS/AMF ini

Peralatan
2 pcs Select Switch
2 pcs Kontaktor 220V 4-pole (sesuaikan dengan NFB) (M1 dan M2)
1 pcs relay 11 pin Omron MK3P-1 220V (R1) + Socket
1 pcs relay 8 pin Omron MK2P-1 220V (R1) + Socket
2 pcs TDR Omron H3CR-A8, 220V + Socket
6 pcs MCB 2A

2 pcs TDR Omron H3Y-2 24VDC + Socket
1 pcs Relay Omron MKS2PI 24VDC + Socket
2 pcs Accu 12 Volt (Serie up 24V DC)
(Sesuaikan TDR dan Relay dengan Accu)

wire cable 1,5 mm + Scun garpu Secukupnya
Box Panel (disesuaikan)
Terminal Blok Input Output Power (disesuaikan)
Terminal Blok Input Output Control TR-10
Rel Component
Kabel Duct
Kabel Ties

Berikut gambar rangkaian utama dan wiring diagramnya..

Prinsip Kerja
Dalam panel ATS/AMF ini saya membaginya dalam Tiga blok yang memiliki fungsi dan tugas masing-masing.

Blok 1.
Blok detector Sumber daya Utama, Rangkaian ini berfungsi untuk memberikan informasi kondisi sumber listrik utama (hidup atau mati) kepada rangkaian Blok starter engine (NC M1). Blok detector ini menghidupkan M1 apabila listrik utama hidup Sekaligus sebagai blok Stop engine (NC R2) apabila listrik utama mati. Pada terminal nomor 5 dan 6, anda harus menghubung seri pada rangkaian genset sebagai tombol OFF.

Pada blok satu ini juga terdapat Selector Switch untuk menfungsikan rangkaian ini Normal dan Automatis. Pada fungsi Normal, maka kerja Change Over Switch tidak akan berfungsi.

Blok 2.
Blok Relai detector Daya Genset, Relai detector ini berfungsi untuk menerima informasi kondisi tegangan/daya genset kepada rangkaian utama apabila listrik utama mati dengan menghidupkan (M2) setelah genset bekerja.

Blok 3.
Blok starter engine, berfungsi untuk menyalakan mesin genset. Blok ini bekerja berdasarkan masukan dari Blok detector Sumber daya Utama (NC M1) Sebagai awal kerja starter. T3 dan T4 sebagai delay starter dan R3 sebagai Kontak starter. Khusus pada rangkaian ini menggunakan komponen yang mempunyai tegangan kerja 24VDC dengan menggunakan 2 buah Accu 12VDC yang dihubung Seri. Namun apabila anda menemukan komponen yang mempunyai tegangan kerja 12VDC, anda bisa memakainya dengan hanya menggunakan 1 buah Accu saja.

Pada rangkaian ini ditambah juga Selector switch yang menginformasikan Accu (starter engine) pada kondisi standby. Pada terminal nomor 7 dan 8, anda harus menghubung paralel pada stater untuk menghidupkan genset.

Demikian saja penjelasan Cara Membuat Panel AMF ATS (switch genset otomatis) Sederhana ini.. kurang lebihnya mohon maaf.. dan

Selamat Mencoba !

Mesin mail Zimbra on Ubuntu

2015-01-10T10:07:00.000+07:00

Kali ini menginstall zimbra 6.0.7 GA pada ubuntu 10.04 LTS 64 bit server
Dikarenakan zimbra versi ini tidak full support dengan ubuntu 10.04, maka harus ada tips & trik tersendiri dalam hal installasinya.
Asumsi bahwa ubuntu dalam keadaan fresh installation.

Tahap awal yaitu pastikan bahwa semua paket ubuntu sudah diupgrade
# apt-get update
# apt-get upgrade
Setelah itu, install paket yang dibutuhkan oleh zimbra
# apt-get install sysstat libperl5.10
Pastikan bahwa isi dari /etc/hosts dan /etc/hostname sudah benar dan sinkron, yaitu sesuai dengan FQDN nya. Apabila ternyata menggunakan ip private (dibelakang nat) maka pake tips yang ada diakhir tutorial ini
# pico /etc/hosts
# pico /etc/hostname
Download file installasi zimbra dengan jenis debian 5 yang 64 bit
# wget -c http://files2.zimbra.com/downloads/6.0.7_GA/zcs-6.0.7_GA_2473.DEBIAN5_64.20100616222328.tgz
# tar -xzvf zcs*
# cd zcs*
Jalankan file installasi zimbra dengan opsi platform override, lalu isi pilihan paketnya ketika installasi. Jangan lupa untuk memastikan bahwa domain sudah disetup MX nya untuk diarahkan ke ubuntu 10.04
# ./install.sh –platform-override
Setelah itu akan muncul main menu pada saat installasi. Isi admin password agar dapat ke proses selanjutnya

Apabila terdapat pesan error seperti berikut :

Initializing ldap…
Running as zimbra user: /opt/zimbra/libexec/zmldapinit
IO::Socket::INET: connect: Connection refused at /opt/zimbra/libexec/zmldapinit line 136.
failed. (28416)

Maka pastikan bahwa MX sudah benar .. dan ip harus sesuai dengan hasil query MX. Kemungkinan besar kesalahan terjadi pada /etc/hosts yang tidak sesuai dengan ip ubuntu
Tipsnya yaitu dengan cara buat ip alias aja, jadi biar ip sesuai dengan hasil query MX. Tapi setelah proses installasi udah kelar, jangan lupa untuk hapus ip aliasnya atau direboot ubuntunya dan jangan lupa benerkan /etc/hostsnya. Sarankan banget pake ip public.
# ifconfig eth0:0 202.187.45.xx

DNS ERROR resolving MX for xxx.yourdomain.net
It is suggested that the domain name have an MX record configured in DNS
Change domain name? [Yes] yes
Create domain: [xxx.yourdomain.net] k4ng-el4ng.com
MX: mail.k4ng-el4ng.com (202.187.45.xx)

Interface: 192.168.20.20
Interface: 172.16.20.20
Interface: 127.0.0.1
done.
Checking for port conflicts

Selesai deh proses installasinya, selanjutnya adalah tinggal akses webmail nya pada http://mail.k4ng-e14ng.com atau untuk mengakses webadminnya bisa dilihat pada https://mail.k4ng-el4ngcom:7071

Referensi :
http://library.linode.com/email/zimbra/install-zimbra-ubuntu-10.04-lucid
http://www.zimbra.com/downloads/os-downloads.html

Quality of Service (QoS)

2014-12-26T10:51:00.000+07:00

Skenario yang digunakan adalah jaringan lokal 10.10.10.0/24 yang memiliki alokasi bandwitdh total 512 kbps (upload) dan 512 kbps (download). Client yang digunakan adalah client 1 (10.10.10.2) dan client 2 (10.10.10.3)

Simple Bandwidth Management

Dengan menggunakan static bandwidth control maka alokasi bandwidth untuk masing-masing client akan tetap. Misalnya client 1 akan mendapatkan alokasi bandwidth yaitu sebesar 256kbps/256kbps, begitu juga dengan client 2.

Perintah yang dapat digunakan adalah sebagai berikut :

[admin@Ijc-router]> queue simple add name=limit-1 target-addresses=10.10.10.1 max-limit=256000/256000

[admin@Ijc-router]> queue simple add name=limit-2 target-addresses=10.10.10.2 max-limit=256000/256000

[admin@Ijc-router]> queue simple print

Flags: X – disabled, I – invalid, D – dynamic

0 name=”limit-1″ target-addresses=10.10.10.1/32 dst-address=0.0.0.0/0 interface=all parent=none direction=both priority=8 queue=default-small/default-small limit-at=0/0 max-limit=256k/256k burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s total-queue=default-small

1 name=”limit-2″ target-addresses=10.10.10.1/32 dst-address=0.0.0.0/0 interface=all parent=none direction=both priority=8queue=default-small/default-small limit-at=0/0 max-limit=256k/256k burst-limit=0/0 burst-threshold=0/0burst-time=0s/0s total-queue=default-small

Bila menggunakan WinBox maka konfigurasi dapat dilakukan melalui menu Queue > Simple Queues > Add

Pengujian atau monitoring terhadap aktifitas bandwidth yang sudah dibatasi dapat dilihat dengan menggunakan menu torch, dan interface yang dimonitor adalah interface ether2, karena interface ini yang terhubung ke jaringan lokal. Perintah yang dapat digunakan adalah sebagai berikut :

[admin@Ijc-router] >tool torch ether2 src-address=10.10.10.0/24

Shared Bandwidth Management

Dengan menggunakan shared bandwidth control, maka alokasi bandwidth untuk tiap client akan bervariasi, tergantung aktif tidaknya client lain dalam sebuah jaringan.

Dalam skenario, berikut client 1 dan client 2 masing-masing akan mendapatkan alokasi bandwidth 256kbps/256kbps. Sehingga total bandwitdh untuk 2 client tersebut adalah 512kbps/512kbps. Jika client 1 tidak menggunakan alokasi bandiwidthnya, maka jatah bandwidthnya akan diberikan kepada client yang lain, sehingga client 2 akan mendapatkan alokasi bandwidth maksimum 256kbps/256kbps.

Konfigurasi yang pertama kali dilakukan adalah konfigurasi untuk membatasi penggunaan bandwidth untuk kedua client sekaligus. Konfigurasi ini juga berfungsi sebagai pembatasan bandiwidth parent. Perintah yang dapat digunakan adalah sebagai berikut :

[admin@Ijc-router] > queue simple add name=limit-all target-addresses=10.10.10.0/24 max-limit=512000/512000

Selanjutnya dibuat konfigurasi untuk membatasi pemakaian bandiwidth setiap client dengan menggunakan konfigurasi sebelumnya sebagai parent. Perintah yang dapat digunakan adalah sebagai berikut :

[admin@Ijc-router] > queue simple add name=limit-1 target-addresses=10.10.10.1 max-limit=512000/512000 limit-at=256000/256000 parent=limit-all

[admin@Ijc-router] > queue simple add name=limit-2 target-addresses=10.10.10.2 max-limit=512000/512000 limit-at=256000/256000 parent=limit-all

[admin@Ijc-router] > queue simple print

Flags: X – disabled, I – invalid, D – dynamic

0 name=”limit-all” target-addresses=10.10.10.0/24 dst-address=0.0.0.0/0 interface=all parent=none direction=both priority=8 queue=default-small/default-small limit-at=0/0 max-limit=512k/512k burst-limit=0/0 burst-threshold=0/0burst-time=0s/0s total-queue=default-small

1 name=”limit-1″ target-addresses=10.10.10.1/32 dst-address=0.0.0.0/0 interface=all parent=limit-all direction=bothpriority=8 queue=default-small/default-small limit-at=128k/128k max-limit=512k/512k burst-limit=0/0burst-threshold=0/0 burst-time=0s/0s total-queue=default-small

2 name=”limit-2″ target-addresses=10.10.10.2/32 dst-address=0.0.0.0/0 interface=all parent=limit-all direction=bothpriority=8 queue=default-small/default-small limit-at=128k/128k max-limit=512k/512k burst-limit=0/0burst-threshold=0/0 burst-time=0s/0s total-queue=default-small

Application Bandwidth Management

Pengaturan bandwidth juga dapat dilakukan dengan melihat jenis aplikasi yang akan dibatasi, misalnya aplikasi HTTP (web) akan dibatasi pemakaian bandwidthnya untuk keseluruhan client dalam jaringan. Untuk memisahkan jenis aplikasi yang diakses oleh client, maka perlu dilakukan penandaan paket data dari aplikasi tersebut (mangle).

Contoh skenario yang akan digunakan adalah membatasi pemakaian bandiwidth untuk aplikasi web sebesar 128 kbps bagi semua client yang ada dalam jaringan.

Tahap pertama yang dilakukan adalah penandaan paket (mangle) HTTP dari setiap client, dapat digunakan perintah sebagai berikut :

[admin@Ijc-router] > ip firewall mangle add chain=prerouting src-address=10.10.10.0/24 protocol=tcp dst-port=80 action=mark-connection new-connection-mark=http-con

[admin@Ijc-router] > ip firewall mangle add chain=prerouting connection-mark=http-con action=mark-packet new-packet-mark=http

[admin@Ijc-router] > ip firewall mangle print

Flags: X – disabled, I – invalid, D – dynamic

0 chain=prerouting action=mark-connection new-connection-mark=http-con passthrough=yes protocol=tcpsrc-address=10.10.10.0/24 dst-port=80

1 chain=prerouting action=mark-packet new-packet-mark=http passthrough=yes connection-mark=http-con

Dilanjutkan dengan melakukan pembatasan penggunaan bandwidth untuk aplikasi HTTP untuk jaringan 10.10.10.0/24. Perintah yang dapat digunakan adalah sebagai berikut :

[admin@Ijc-router] > queue simple add name=limit-http target-addresses=10.10.10.0/24 packet-marks=http max-limit=128000/128000

[admin@Ijc-router] > queue simple add name=all-network target-addresses=10.10.10.0/24 max-limit=512000/512000

[admin@Ijc-router] > queue simple print

Flags: X – disabled, I – invalid, D – dynamic

0 name=”limit-http” target-addresses=10.10.10.0/24 dst-address=0.0.0.0/0 interface=all parent=none packet-marks=http direction=both priority=8 queue=default-small/default-small limit-at=0/0 max-limit=128k/128k burst-limit=0/0burst-threshold=0/0 burst-time=0s/0s total-queue=default-small

Firewall

2014-12-19T10:32:00.000+07:00

Secara umum firewall ditempatkan diantara jaringan lokal dan jaringan publik, ditujukan untuk melindungi jaringan lokal dengan mebatasi traffik yang menuju router (input), keluar dari router (output) dan melewati router (forward)

Masquerade

Router MikroTik yang akan digunakan sebagai Internet Gateway harus menjalankan NAT (Network Address Translation), yaitu sebuah fungsi yang merubah field Source IP Private dari sebuah packet data menjadi IP Address Publik.

Berdasarkan skenario, untuk menjalankan fungsi NAT bagi keseluruhan host dari jaringan 10.10.10.0/24 untuk semua jenis layanan Internet, maka dapat digunakan perintah sebagai berikut :

[admin@MikroTik] > ip firewall nat add chain=srcnat src-address=10.10.10.0/24 action=masquerade

[admin@MikroTik] > ip firewall nat print

Flags: X – disabled, I – invalid, D – dynamic

0 chain=srcnat action=masquerade src-address=10.10.10.0/24

Dapat juga menggunakan perintah masquerade dengan memilih outgoing interface (dalam hal ini adalah ether1 yang akan digunakan untuk menuju Internet), seperti berikut :

[admin@MikroTik] > ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

Bila menggunakan WinBox, maka konfigurasi dapat dilakukan melalui menu IP > Firewall > NAT >Add

Jika diinginkan jaringan 10.10.10.0/24 hanya dapat mengakses layanan HTTP, maka konfigurasi yang harus digunakan adalah sebagai berikut :

[admin@MikroTik] > ip firewall nat add chain=srcnat src-address=10.10.10.0/24 protocol=tcp dst-port=80 action=masqurade

[admin@MikroTik] > ip firewall nat print

Flags: X – disabled, I – invalid, D – dynamic

0 chain=srcnat action=masquerade protocol=tcp src-address=10.10.10.0/24 dst-port=80

HTTP merupakan aplikasi yang menggunakan protocol TCP dengan destination port pada server adalah 80

Untuk layanan mail atau Secure HTTP (https), maka konfigurasi tambahan yang harus dilakukan adalah sebagai berikut :

[admin@MikroTik] > ip firewall nat add chain=srcnat src-address=10.10.10.0/24 protocol=tcp dst-port=443 action=masquerade

[admin@MikroTik] > ip firewall nat add chain=srcnat src-address=10.10.10.0/24 protocol=icmp action=masquerade

[admin@MikroTik] > ip firewall nat print

Flags: X – disabled, I – invalid, D – dynamic

0 chain=srcnat action=masquerade protocol=tcp src-address=10.10.10.0/24 dst-port=80

1 chain=srcnat action=masquerade protocol=tcp src-address=10.10.10.0/24 dst-port=443

2 chain=srcnat action=masquerade protocol=icmp src-address=10.10.10.0/24

Bila terdapat bebarapa rule, maka Mikrotik akan mengeksekusi rule-rule tersebut dengan prinsip “top to bottom”. Sehingga urutan dari rule sangat berpengaruh terhadap efektifitas rule yang diinginkan.

MikroTik dapat membatasi akses jaringan (routing maupun NAT) berdasarkan waktu (hari dan jam). Misalnya jika ingin memberikan akses HTTP (web) pada jaringan 10.10.10.0/24 hanya pada jam 08.00 – 14.30 untuk hari senin, selasa, rabu, kamis, jumat, sabtu, maka konfigurasi yang dapat digunakan

[admin@Ijc-router] > ip firewall nat add chain=srcnat src-address=10.10.10.0/24 protocol=tcp dst-port=80 action=masquerade time=08:00:00-14:30:00,mon,tue,wed,thu,fri,sat

[admin@Ijc-router] > ip firewall nat print

Flags: X – disabled, I – invalid, D – dynamic

0 chain=srcnat action=masquerade protocol=tcp src-address=10.10.10.0/24 dst-port=80 time=8h-14h30m,mon,tue,wed,thu,fri,sat

Untuk konfigurasi dengan menggunakan WinBox dapat melalui menu IP > Firewall > NAT > Add >Extra

Filtering

Filter ditujukan untuk menentukan apakah sebuah paket yang ditujukan pada sebuah interface router dapat diizinkan atau tidak. Umumnya ditujukan untuk meningkatkan level keamanan dari Router. Filter tidak digunakan untuk memeriksa paket data yang melewati router. Fungsi firewall untuk memeriksa data yang melewati router dilakukan oleh NAT.

Berikut contoh penerapan filtering pada sisi Interface ether1 yang berhubungan ke Internet. Filtering ini ditujukan untuk menutup port-port yang tidak dibutuhkan, sehingga tingkat keamanan dapat ditingkatkan. Contoh port yang terbuka secara default pada router MikroTik adalah 22 (ssh), 23 (telnet), 20 dan 21 (ftp), 80 (web), 8291 (WinBox).

[admin@Ijc-router] > ip firewall filter add chain=input in-interface=ether1 protocol=tcp dst-port=22 action=drop

[admin@Ijc-router] > ip firewall filter add chain=input in-interface=ether1 protocol=tcp dst-port=23 action=drop

[admin@Ijc-router] > ip firewall filter add chain=input in-interface=ether1 protocol=tcp dst-port=8291 action=drop

[admin@Ijc-router] > ip firewall filter add chain=input in-interface=ether1 protocol=icmp action=drop

[admin@Ijc-router] > ip firewall filter print

Flags: X – disabled, I – invalid, D – dynamic

0 chain=input action=drop protocol=tcp in-interface=ether1 dst-port=22

1 chain=input action=drop protocol=tcp in-interface=ether1 dst-port=23

2 chain=input action=drop protocol=tcp in-interface=ether1 dst-port=8291

3 chain=input action=drop protocol=icmp in-interface=ether1

Jika ada sebuah paket yang akan diizinkan masuk ke interface ether1 (misalnya mengizinkan host dengan IP Address 222.124.222.171), maka perintah yang diberikan adalah perintah dengan action=accept seperti berikut :

[admin@Ijc-router] > ip firewall filter add chain=input in-interface=ether1 protocol=tcp dst-port=22 src-address=222.124.222.171 action=accept

Sedangkan untuk sisi Interface ether2 yang dihubungkan dengan jaringan lokal, berikut contoh rule filtering yang dapat digunakan :

[admin@Ijc-router] > ip firewall filter add chain=input protocol=tcp dst-port=80 in-interface=ether2 action=accept

[admin@Ijc-router] > ip firewall filter add chain=input protocol=tcp dst-port=22 in-interface=ether2 src-address=10.10.10.2 action=accept

[admin@Ijc-router] > ip firewall filter add chain=input protocol=tcp dst-port=23 in-interface=ether2 src-address=10.10.10.2 action=accept

[admin@Ijc-router] > ip firewall filter add chain=input protocol=tcp dst-port=8291 in-interface=ether2 src=address=10.10.10.2 action=accept

[admin@Ijc-router] > ip firewall filter add chain=input protocol=icmp in-interface=ether2 src=address=10.10.10.1 action=accept

[admin@Ijc-router] > ip firewall filter add chain=input protocol=udp dst-port=53 in-interface=ether2 action=accept

[admin@Ijc-router] > ip firewall filter add chain=input in-interface=ether2 action=drop

Address List

Fitur Address List pada Firewall MikroTik dapat digunakan untuk mengelompokkan IP Address tertentu. Kelompok IP Address ini nantinya dapat digunakan oleh filter, NAT maupun mangle dari firewall. Address List dapat dibuat secara manual (static) maupun secara otomatis oleh MikroTik.

Contoh perintah untuk mendapatkan hasil Address List (dynamic) dari host yang pernah mengakses MikroTik dengan menggunakan protokol SSH pada interfecae ether2 :

[admin@ijc-router] > ip firewall filter add chain=input in-interface=ether2 protocol=tcp dst-port=22 action=add-src-to-address-list address-list=”akses ssh”

[admin@ijc-router] > ip firewall address-list print

Flags: X – disabled, D – dynamic

# LIST ADDRESS

0 D akses ssh 10.10.10.2

Jika ingin menggunakan IP Address pada Address list untuk tidak memberikan akses SSH, maka dapat digunakan filter dengan perintah sebagai berikut :

[admin@ijc-router] > ip firewall filter add chain=input in-interface=ether2 protocol=tcp dst-port=22 action=drop src-address-list=”akses ssh”

[admin@ijc-router] > ip firewall filter print

Flags: X – disabled, I – invalid, D – dynamic

0 chain=input action=add-src-to-address-list protocol=tcp address-list=akses ssh address-list-timeout=0s in-interface=ether2 dst-port=22

1 chain=input action=drop protocol=tcp src-address-list=akses ssh in-interface=ether2 dst-port=22

Jika ingin membuat Address List secara manual (static), maka dapat digunakan perintah sebagai berikut :

[admin@ijc-router] > ip firewall address-list add address=10.10.10.0/24 list=”akses ssh terlarang”

[admin@ijc-router] > ip firewall address-list print

Flags: X – disabled, D – dynamic

# LIST ADDRESS

1 akses ssh terlarang 10.10.10.0/24

Graph Simple Queue dengan MRTG(Cacti)

2014-12-10T21:09:00.000+07:00

Cara simple untuk menampilkan graph pada mikrotik ke server (Ubuntu 8.10) yang mempunyai fasilitas cacti.

Apabila menggunakan simple queue pada mikrotiknya, maka download file berikut http://www.nixnux.or.id/wp-content/uploads/2008/11/cacti-mikrotik-queue-simple.zip

Apabila menggunakan queue tree pada mikrotiknya, maka download file berikut http://www.nixnux.or.id/wp-content/uploads/2008/11/cacti-mikrotik-queue-tree.zip

Ekstrak file yang sudah didownload tersebut, lalu login ke cacti menggunakan account administrator dan import file yang sudah diekstrak tersebut (Import Templates) kedalam cacti:
# cacti_data_query_mikrotik_simple_queue.xml
# cacti_data_template_mikrotik_simple_queue.xml
# cacti_graph_template_mikrotik_simple_queue.xml
# cacti_host_template_mikrotik_queue.xml

Salin file ipacmikro.xml ke /usr/share/cacti/resource/snmp_queries pada server cacti (path disesuaikan).

Login pada mikrotiknya menggunakan winbox :
– Enable settingan SNMP
– Tambahkan nama community yang akan digunakan di cacti

Login sebagai administrator pada cacti :
– Tambahkan device dan pilih “Mikrotik Queue” pada “Host Template”
– Masukan hostnamenya dan pilih SNMP version 1 lalu masukan nama community mikrotik nya
– Klik tombol “Create Graphs for this Host”
– Pilih “Data Query” yang dibutuhkan, lalu tekan tombol “save”

Selanjutnya cek graphnya deh.
Apabila traffic upload dan download terbalik, maka dapat diubah pada “Graph Management” di cacti.

Ref : http://www.nixnux.or.id/2008/11/15/graphing-mikrotik-queue-simple-and-queue-tree-with-cacti/

IP Forwarding

2014-11-05T11:02:00.000+07:00

Untuk menjalankan Iptables pada sebuah Internet Gateway, yang harus dikonfigurasikan terlebih dahulu adalah kemampuan forwarding paket data.

Forwarding paket pada sistem Linux dapat dikonfigurasikan pada file/etc/sysctl.conf

[root@gateway]# cat /etc/sysctl.conf

# Controls source route verification

net.ipv4.conf.default.rp_filter = 1

# Do not accept source routing

net.ipv4.conf.default.accept_source_route = 0

# Controls the System Request debugging functionality of the kernel

kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.

# Useful for debugging multi-threaded applications.

kernel.core_uses_pid = 1

# Disable netfilter on bridges.

net.bridge.bridge-nf-call-ip6tables = 0

net.bridge.bridge-nf-call-iptables = 0

net.bridge.bridge-nf-call-arptables = 0

Perubahan pada file ini mengharuskan sistem untuk di reboot.

Masquerade

Untuk menjalankan fungsi Masquerade untuk seluruh aplikasi (baik TCP, UDP dan ICMP) bagi seluruh jaringan 10.10.10.0/24 konfigurasi yang dapat digunakan adalah

[root@gateway ~]# iptables-save

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*mangle

:PREROUTING ACCEPT [292122:195815236]

:INPUT ACCEPT [3607:780036]

:FORWARD ACCEPT [152405:97620004]

:OUTPUT ACCEPT [3087:459443]

:POSTROUTING ACCEPT [155488:98079207]

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*nat

:PREROUTING ACCEPT [56359:7782935]

:INPUT ACCEPT [1147:99782]

:OUTPUT ACCEPT [1950:151466]

:POSTROUTING ACCEPT [2056:156978]

-A POSTROUTING -s 10.10.10.0/24 –j MASQUERADE

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*filter

:INPUT ACCEPT [12:636]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [22:2312]

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

Jika hanya ingin menjalankan fungsi Masquerade untuk layanan HTTP (Browsing Internet) bagi jaringan 10.10.10.0/24, konfigurasi file yang dapat digunakan adalah :

[root@gateway ~]# iptables-save

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*mangle

:PREROUTING ACCEPT [292122:195815236]

:INPUT ACCEPT [3607:780036]

:FORWARD ACCEPT [152405:97620004]

:OUTPUT ACCEPT [3087:459443]

:POSTROUTING ACCEPT [155488:98079207]

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*nat

:PREROUTING ACCEPT [56359:7782935]

:INPUT ACCEPT [1147:99782]

:OUTPUT ACCEPT [1950:151466]

:POSTROUTING ACCEPT [2056:156978]

-A POSTROUTING -s 10.10.10.0/24 -p tcp -m tcp –dport 80 -j MASQUERADE

-A POSTROUTING -s 10.10.10.0/24 -p tcp -m tcp –dport 443 -j MASQUERADE

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*filter

:INPUT ACCEPT [12:636]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [22:2312]

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

Untuk menjalankan Masquerade untuk aplikasi ICMP (ping) bagi seluruh host jaringan 192.168.0.0/24, file konfigurasi yang dapat dilakukan adalah

[root@gateway ~]# iptables-save

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*mangle

:PREROUTING ACCEPT [292122:195815236]

:INPUT ACCEPT [3607:780036]

:FORWARD ACCEPT [152405:97620004]

:OUTPUT ACCEPT [3087:459443]

:POSTROUTING ACCEPT [155488:98079207]

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*nat

:PREROUTING ACCEPT [56359:7782935]

:INPUT ACCEPT [1147:99782]

:OUTPUT ACCEPT [1950:151466]

:POSTROUTING ACCEPT [2056:156978]

-A POSTROUTING -s 10.10.10.0/24 -p tcp -m tcp –dport 80 -j MASQUERADE

-A POSTROUTING -s 10.10.10.0/24 -p tcp -m tcp –dport 443 -j MASQUERADE

-A POSTROUTING –s 10.10.10.0/24 –p icmp –j MASQUERADE

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

# Generated by iptables-save v1.4.12 on Wed Aug 29 21:58:21 2012

*filter

:INPUT ACCEPT [12:636]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [22:2312]

COMMIT

# Completed on Wed Aug 29 21:58:21 2012

Urutan konfigurasi pada file /etc/sysconfig/iptables sangat menentukan efektif tidaknya rule-rule yang diinginkan.

Logging

Iptables memiliki fasilitas untuk melakukan logging terhadap aktifitas client yang akan mengakses Internet, seperti contoh berikut :

*nat

:OUTPUT ACCEPT [0:0]

:PREROUTING ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

-A POSTROUTING -d www.facebook.com -j LOG –log-prefix “FACEBOOK ACCESS”

-A POSTROUTING -p tcp –dport 80 -s 10.10.10.0/24 -j MASQUERADE

-A POSTROUTING -p tcp –dport 443 -s 10.10.10.0/24 -j MASQUERADE

-A POSTROUTING -p icmp -s 10.10.10.0/24 -j MASQUERADE

COMMIT

*mangle

:PREROUTING ACCEPT [0:0]

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

COMMIT

*filter

:FORWARD ACCEPT [0:0]

:INPUT ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

COMMIT

Hasil logging dapat dilihat pada file /var/log/messages, bisa dilakukan real time dengan perintah sebagai berikut :

[root@gateway ~]# tail -f /var/log/messages

Aug 29 22:38:09 gateway kernel: [25123.593699] FACEBOOK ACCESSIN= OUT=p3p1 SRC=10.10.10.2 DST=31.13.79.4 LEN=52 TOS=0×00 PREC=0×00 TTL=127 ID=26747 DF PROTO=TCP SPT=56226 DPT=80 WINDOW=8192 RES=0×00 SYN URGP=0

Aug 29 22:38:18 gateway kernel: [25132.609546] FACEBOOK ACCESSIN= OUT=p3p1 SRC=10.10.10.2 DST=31.13.79.4 LEN=52 TOS=0×00 PREC=0×00 TTL=127 ID=26816 DF PROTO=TCP SPT=56231 DPT=80 WINDOW=8192 RES=0×00 SYN URGP=0

Aug 29 22:38:19 gateway kernel: [25134.336709] FACEBOOK ACCESSIN= OUT=p3p1 SRC=10.10.10.2 DST=31.13.79.4 LEN=52 TOS=0×00 PREC=0×00 TTL=127 ID=26864 DF PROTO=TCP SPT=56242 DPT=80 WINDOW=8192 RES=0×00 SYN URGP=0

Source NAT

Masquerade digunakan untuk merubah secara otomatis IP Address pengirim dari sebuah paket data menjadi IP Address yang digunakan pada Interface Router tempat paket tersebut akan keluar. Selain menggunakan action Masquerade, dapat juga digunakan action SNAT yang masih memungkinkan memilih IP Address yang akan digunakan pada paket data tersebut.

Sebagai contoh, sebuah Internet gateway memiliki dua IP Address publik yang digunakan untuk mengakses Internet. Konfigurasi berikut memperlihatkan bahwa host yang berbeda akan menggunakan IP Address publik yang berbeda pada saat akan mengakses Internet. Contoh konfigurasinya adalah sebagai berikut :

[root@gateway ~]# iptables-save

# Generated by iptables-save v1.4.12 on Thu Aug 30 18:29:37 2012

*mangle

:PREROUTING ACCEPT [47254:17717989]

:INPUT ACCEPT [1148:299960]

:FORWARD ACCEPT [26398:8742980]

:OUTPUT ACCEPT [1058:148990]

:POSTROUTING ACCEPT [27481:8899171]

COMMIT

# Completed on Thu Aug 30 18:29:37 2012

# Generated by iptables-save v1.4.12 on Thu Aug 30 18:29:37 2012

*nat

:PREROUTING ACCEPT [8860:1378298]

:INPUT ACCEPT [249:19978]

:OUTPUT ACCEPT [731:56175]

:POSTROUTING ACCEPT [773:58359]

-A POSTROUTING -s 10.10.10.2/32 -j SNAT –to-source 60.1.1.2

-A POSTROUTING -s 10.10.10.4/32 -j SNAT –to-source 60.1.1.3

COMMIT

# Completed on Thu Aug 30 18:29:37 2012

# Generated by iptables-save v1.4.12 on Thu Aug 30 18:29:37 2012

*filter

:INPUT ACCEPT [1161:300480]

:FORWARD ACCEPT [26398:8742980]

:OUTPUT ACCEPT [1084:151926]

COMMIT

# Completed on Thu Aug 30 18:29:37 2012

Destination NAT

Destination NAT digunakan untuk merubah IP Address tujuan dari sebuah paket data, juga dapat digunakan untuk merubah port tujuan. Contoh yang biasa digunakan jika akan melakukan remote dari Internet ke komputer yang berada di jaringan lokal.

Contoh berikut adalah konfigurasi yang mengizinkan komputer dari jaringan publik (Internet) untuk melakukan akses dengan menggunakan Remote Desktop (port 3389) pada komputer lokal dengan IP Address 10.10.10.4.

[root@gateway ~]# iptables-save

# Generated by iptables-save v1.4.12 on Thu Aug 30 19:15:48 2012

*mangle

:PREROUTING ACCEPT [45133:36583527]

:INPUT ACCEPT [945:77940]

:FORWARD ACCEPT [21922:18231585]

:OUTPUT ACCEPT [787:62148]

:POSTROUTING ACCEPT [22709:18293733]

COMMIT

# Completed on Thu Aug 30 19:15:48 2012

# Generated by iptables-save v1.4.12 on Thu Aug 30 19:15:48 2012

*nat

:PREROUTING ACCEPT [8591:1058310]

:INPUT ACCEPT [53:5541]

:OUTPUT ACCEPT [81:6367]

:POSTROUTING ACCEPT [81:6279]

-A PREROUTING -i p3p1 -p tcp -m tcp –dport 3389 -j DNAT –to-destination 10.10.10.4

-A POSTROUTING -s 10.10.10.0/24 -j MASQUERADE

COMMIT

# Completed on Thu Aug 30 19:15:48 2012

# Generated by iptables-save v1.4.12 on Thu Aug 30 19:15:48 2012

*filter

:INPUT ACCEPT [958:78460]

:FORWARD ACCEPT [21922:18231585]

:OUTPUT ACCEPT [812:65008]

COMMIT

# Completed on Thu Aug 30 19:15:48 2012

Setting VPS Linux yang Memiliki RAM Terbatas

2014-07-10T11:49:00.000+07:00

VPS adalah singkatan dari Virtual Private Server. Kata virtual ini merujuk pada fakta bahwa server tersebut tidak eksis secara fisik, namun berada di dalam sebuah komputer. Satu server fisik dibagi menjadi beberapa server virtual.

Masing-masing VPS memiliki sumber daya yang sudah dialokasikan atau berbagi satu sama lain, sesuai dengan setelan utamanya. Dengan kata lain, VPS adalah komputer di dalam komputer. VPS merupakan pilihan yang lebih murah jika menginginkan server sendiri untuk berbagai tujuan.

Cara setting VPS dengan RAM minimalis

Kali ini saya akan membahas bagaimana cara setting vps dari awal. Cara yang akan saya bahas kali ini tidak membutuhkan keahlian yang terlalu tinggi. Asalkan anda mengerti bagaimana mengetik perintah di terminal Linux, itu sudah cukup. Sebelumnya, siapkan dulu segelas kopi dan cemilan.

Di pembahasan kali ini, saya menggunakan Debian 6 dan memang harus Debian 6. Oleh karena itu install Debian 6 di VPS anda. Caranya? Kalo anda beli VPS, pasti anda sudah tahu caranya bagaimana.
Setelah itu masuk ke VPS anda lewat SSH, jalankan perintah apt-get update && apt-get -y upgrade. Perintah ini akan mengupdate aplikasi-aplikasi lawas dan menggantinya dengan yang baru jika ada
Instal aplikasi git, ketik apt-get install git
Download script LEB Debian 6, caranya ketik git clone https://github.com/restiono/autosetupvps.git /root/bin/ lalu tunggu prosesnya sampai selesai.
Jalankan dpkg-reconfigure locales untuk mensetting locale. Nanti akan muncul dialog box, pastikan anda hanya memilih en_US saja.
Masuk ke folder /root/bin, lalu jalankan perintah-perintah ini:

chmod +x ./setup-debian.sh
./setup-debian.sh dotdeb
./setup-debian.sh dotdeb
./setup-debian.sh system
./setup-debian.sh dropbear 22
./setup-debian.sh iptables 22
./setup-debian.sh nginx
./setup-debian.sh php

./setup-debian.sh mysql

Perintah kedua menambahkan repository dari dotdeb. Perintah

ketiga membersihkan sistem VPS anda dari aplikasi-aplikasi

yang tidak diperlukan seperti Apache, dll. Perintah keempat

membuang sshd dan menggantinya dengan dropbear lalu berjalan

di port 22. Perintah kelima melakukan instalasi firewall

sederhana untuk mengamankan server anda. Perintah enam, tujuh

dan delapan sudah jelas menginstall nginx web server, dukungan

PHP dan database MySQL

Anda juga dapat memindahkan port dropbear selain 22, misalnya pindah ke 888 atau 666, sesuka anda, asalkan bukan 80. Perhatikan bahwa angka pada perintah ketiga dan keempat harus sama atau anda akan kesulitan login SSH.

Pada langkah ini server anda sudah siap tempur, namun belum bisa diakses sebagai web server. Nah, untuk itulah ada langkah lagi untuk menangani web server nginx supaya dapat digunakan.

Menambahkan website/blog ke dalam VPS

Setelah melalui langkah diatas, anda bisa mulai menambahkan domain anda ke dalam web server nginx. Caranya masih cukup sederhana menggunakan script LEB diatas. Perintahnya adalah sebagai berikut:

./setup-debian.sh site nama-domain.com

./setup-debian.sh mysqluser nama-domain.com

./setup-debian.sh wordpress nama-domain.com

Perintah nama-domain.com diganti dengan nama domain anda, misalnya kampret.com atau yang lain. Penjelasan perintah-perintah diatas adalah sebagai berikut:

Perintah pertama membuat file config nginx untuk domain yang anda sebutkan. Perintah ini juga membuat direktori di /var/www dengan nama folder sesuai domain yang anda sebutkan. Root folder website/blog anda ada di folder public yang ada di dalamnya.
Perintah kedua adalah membuat username, password dan database di MySQL server anda. Perintah ini harus digunakan setelah perintah yang pertama. Berguna jika anda ingin memindahkan blog/website anda dari tempat lama ke VPS.
Untuk anda yang ingin memasang wordpress baru, maka perintah ketiga ini dapat anda gunakan. Perintah ketiga ini tidak membutuhkan perintah pertama dan kedua. Sekali dijalankan, maka wordpress akan diinstall di /var/www/nama-domain.com/public, dimana nama-domain.com adalah nama domain yang anda sebutkan.

Nah, cukup mudah bukan? Jika ada yang ingin diketahui lebih lanjut, anda bisa mengutarakannya di kolom pendapat dibawah ini

2014-06-11T11:07:00.000+07:00

Hostname Configuration

Untuk melakukan konfigurasi hostname, harus dilakukan pada global EXEC Mode, seperti berikut.

Router>enable

Router#conf

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname IlmuJaringan-ROUTER

IlmuJaringan-ROUTER(config)#exit

IlmuJaringan-ROUTER#

%SYS-5-CONFIG_I: Configured from console by console

IlmuJaringan-ROUTER#

Router Password

Router>enable

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#enable password 123456

Jika ingin menerapkan password yang sudah dienkripsi pada saat akan memasuki privileged EXEC Mode, maka perintah yang dapat digunakan adalah sebagai berikut.

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#enable secret 567890

Router(config)#^Z

Jika enable password dan enable secret digunakan bersamaan, maka yang akan digunakan oleh router adalah password yang dikonfigurasikan oleh enable secret.

Port Console yang sering digunakan untuk konfigurasi router juga dapat diberikan password dengan menggunakan perintah sebagai berikut.

Router#

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#line console 0

Router(config-line)#password cisco

Router(config-line)#login

Router(config-line)#exit

Sedangkan untuk akses konfigurasi yang menggunakan telnet dapat diberikan password, dengan menggunakan perintah berikut ini.

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#line vty 0 4

Router(config-line)#password cisco

Router(config-line)#login

Router(config-line)#exit

Secara default konfigurasi password pada line console maupun telnet tidak dienkripsi sehingga dapat dengan mudah dibaca, seperti terlihat berikut ini.

Router#show running-config

Building configuration…

Current configuration : 518 bytes

version 12.2

no service timestamps log datetime msec

line con 0

password cisco

login

line vty 0 4

password cisco

login

end

Untuk membuat password terenkripsi dapat digunakan perintah berikut ini.

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#service password-encryption

Banner

Router(config)#banner motd #

Enter TEXT message. End with the character ‘#’.

*********************************************

WARNING !!! Forbiden Access to this Device

*********************************************

Interface Configuration

Untuk mengkonfigurasikan interface Router Cisco, ada baiknya melihat terlebih dahulu interface apa saja yang dimiliki router tersebut. Perintah yang dapat digunakan adalah sebagai berikut

Router#show interface

FastEthernet0/0 is administratively down, line protocol is down (disabled)

Hardware is Lance, address is 0060.3e14.7701 (bia 0060.3e14.7701)

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

ARP type: ARPA, ARP Timeout 04:00:00,

Last input 00:00:08, output 00:00:05, output hang never

Last clearing of “show interface” counters never

Input queue: 0/75/0 (size/max/drops); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 input packets with dribble condition detected

0 packets output, 0 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

FastEthernet0/1 is administratively down, line protocol is down (disabled)

Hardware is Lance, address is 0060.3e14.7702 (bia 0060.3e14.7702)

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

ARP type: ARPA, ARP Timeout 04:00:00,

Last input 00:00:08, output 00:00:05, output hang never

Last clearing of “show interface” counters never

Input queue: 0/75/0 (size/max/drops); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 input packets with dribble condition detected

0 packets output, 0 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#interface f0/0

Router(config-if)#ip address 192.168.0.1 255.255.255.0

Router(config-if)#no shutdown

Router(config-if)#exit

Router(config)#

Router(config)#interface f0/1

Router(config-if)#ip address 192.168.1.1 255.255.255.0

Router(config-if)#no shutdown

Router(config-if)#exit

Saving Configuration

Router#copy running-config startup-config

Destination filename [startup-config]?

Building configuration…

[OK]

Router#

Atau dapat juga menggunakan perintah singkat seperti berikut ini.

Router#write

Building configuration…

[OK]

Basic Routing Table

Router#show ip route

Codes: C – connected, S – static, I – IGRP, R – RIP, M – mobile, B – BGP

D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area

N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2

E1 – OSPF external type 1, E2 – OSPF external type 2, E – EGP

i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area

* – candidate default, U – per-user static route, o – ODR

P – periodic downloaded static route

Gateway of last resort is not set

C 192.168.0.0/24 is directly connected, FastEthernet0/0

C 192.168.1.0/24 is directly connected, FastEthernet0/1

2014-01-01T11:10:00.000+07:00

Topologi

Dalam proyek ini akan dibangun sambungan line PABX baru melalui jalur wireless dari Main Office ke Remote Office A dan Remote Office B untuk itu dibutuhkan SPA400, (Internet Telephony Gateway) dan PAP2T (Internet Phone Adapters) serta tentu saja Asterisk. SPA400 ini menghubungkan jaringan telpon analog (PSTN atau PABX) ke jaringan VOIP (Asterisk). PAP2T menghubungkan pesawat telpon ke jaringan VOIP. Asterisk dikonfigurasi agar nomor extension PABX tertentu selalu melalui port tertentu di SPA400 (incoming dan outgoing).

Topologi

Router dan Server

Mikrotik RB750 : 192.168.51.190
Server Linux (CentOS 5.4) : 192.168.51.253

Perangkat VOIP

SPA400 (Internet Telephony Gateway w/ 4 FXO ports)

No Nama IP Address Line 1 Line 2 Line 3 Line 4 UserID

1 SPA400-1 192.168.51.185 310 311 320 321 9000

2 SPA400-2 192.168.51.172 - 312 - - 9001
PAP2T (Internet Phone Adapters with 2 VoIP Ports)

No Nama IP Address Phone 1 (VOIP 1) Phone 2 (VOIP 2)

1 PAP2T-1 192.168.51.186 321 (2000) 311 (2001)

1 PAP2T-2 192.168.51.187 310 (2002) 320 (2003)

3 PAP2T-3 192.168.51.173 312 (2004) -

Instalasi Asterisk

Berikut ini instalasi asterisk di centos 5.4.

Buat file /etc/yum.repos.d/centos-asterisk.repo:

[asterisk-tested] 
name=CentOS-$releasever - Asterisk - Tested 
baseurl=http://packages.asterisk.org/centos/$releasever/tested/$basearch/ 
enabled=0 
gpgcheck=0 
#gpgkey=http://packages.asterisk.org/RPM-GPG-KEY-Digium 

[asterisk-current] 
name=CentOS-$releasever - Asterisk - Current 
baseurl=http://packages.asterisk.org/centos/$releasever/current/$basearch/ 
enabled=1 
gpgcheck=0 
#gpgkey=http://packages.asterisk.org/RPM-GPG-KEY-Digium

Buat file /etc/yum.repos.d/centos-digium.repo:

[digium-tested] 
name=CentOS-$releasever - Digium - Tested 
baseurl=http://packages.digium.com/centos/$releasever/tested/$basearch/ 
enabled=0 
gpgcheck=0 
#gpgkey=http://packages.digium.com/RPM-GPG-KEY-Digium 

[digium-current] 
name=CentOS-$releasever - Digium - Current 
baseurl=http://packages.digium.com/centos/$releasever/current/$basearch/ 
enabled=1 
gpgcheck=0 
#gpgkey=http://packages.digium.com/RPM-GPG-KEY-Digium

Instal asterisk

Konfigurasi Asterisk

Buat file /etc/asterisk/sip.conf

[general] 
port = 5060 
bindaddr = 0.0.0.0 
context = others 
register => 9000@192.168.51.185/9000 
register => 9001@192.168.51.172/9001 

[2000] 
type=friend 
defaultuser=2000 
context=ph2000 
secret=1234 
host=dynamic 
dtmfmode=rfc2833 
canreinvite=no 
disallow=all 
allow=alaw 
allow=ulaw 

[2001] 
type=friend 
defaultuser=2001 
context=ph2001 
secret=1234 
host=dynamic 
dtmfmode=rfc2833 
canreinvite=no 
disallow=all 
allow=alaw 
allow=ulaw 

[2002] 
type=friend 
defaultuser=2002 
context=ph2002 
secret=1234 
host=dynamic 
dtmfmode=rfc2833 
canreinvite=no 
disallow=all 
allow=alaw 
allow=ulaw 

[2003] 
type=friend 
defaultuser=2003 
context=ph2003 
secret=1234 
host=dynamic 
dtmfmode=rfc2833 
canreinvite=no 
disallow=all 
allow=alaw 
allow=ulaw 

[2004] 
type=friend 
defaultuser=2004 
context=ph2004 
secret=1234 
host=dynamic 
dtmfmode=rfc2833 
canreinvite=no 
disallow=all 
allow=alaw 
allow=ulaw 

[9000] 
;type=peer 
type=friend 
user=9000 
host=192.168.51.185 
dtmfmode=rfc2833 
canreinvite=no 
context=from-spa400-1 
insecure=port,invite 
disallow=all 
allow=alaw 
allow=ulaw 

[9001] 
;type=peer 
type=friend 
user=9001 
host=192.168.51.172 
dtmfmode=rfc2833 
canreinvite=no 
context=from-spa400-2 
insecure=port,invite 
disallow=all 
allow=alaw 
allow=ulaw

Buat File /etc/asterisk/extension.conf:

[globals] 
TRUNK1=SIP/9000 
TRUNK2=SIP/9001 

[others] 

[trunklocal] 
include => fun-stuff 
exten => _200[0-4],1,Dial(SIP/${EXTEN},15) 
exten => _200[0-4],2,VoiceMail(${EXTEN},u) 
exten => h,1,Hangup 

; 321 
[ph2000] 
include => trunklocal 
exten => _XXX,1,Dial(${TRUNK1}/L1${EXTEN},15) 
exten => _70X.,1,Dial(${TRUNK1}/L1${EXTEN},15) 
exten => _83X.,1,Dial(${TRUNK1}/L1${EXTEN},15) 
exten => h,1,Hangup 

; 311 
[ph2001] 
include => trunklocal 
exten => _XXX,1,Dial(${TRUNK1}/L2${EXTEN},15) 
exten => _70X.,1,Dial(${TRUNK1}/L2${EXTEN},15) 
exten => _83X.,1,Dial(${TRUNK1}/L2${EXTEN},15) 
exten => h,1,Hangup 

; 310 
[ph2002] 
include => trunklocal 
exten => _XXX,1,Dial(${TRUNK1}/L3${EXTEN},15) 
exten => _70X.,1,Dial(${TRUNK1}/L3${EXTEN},15) 
exten => _83X.,1,Dial(${TRUNK1}/L3${EXTEN},15) 
exten => h,1,Hangup 

; 320 
[ph2003] 
include => trunklocal 
exten => _XXX,1,Dial(${TRUNK1}/L4${EXTEN},15) 
exten => _70X.,1,Dial(${TRUNK1}/L4${EXTEN},15) 
exten => _83X.,1,Dial(${TRUNK1}/L4${EXTEN},15) 
exten => h,1,Hangup 

; 312 
[ph2004] 
include => trunklocal 
exten => _XXX,1,Dial(${TRUNK2}/L2${EXTEN},15) 
exten => _70X.,1,Dial(${TRUNK2}/L2${EXTEN},15) 
exten => _83X.,1,Dial(${TRUNK2}/L2${EXTEN},15) 
exten => h,1,Hangup 

[from-trunk-1] 
exten => 321,1,Dial(SIP/2000,15) 
;exten => 321,2,VoiceMail(2000,u) 
;exten => 321,2,Hangup 
exten => 311,1,Dial(SIP/2001,15) 
;exten => 311,2,VoiceMail(2001,u) 
;exten => 311,2,Hangup 
exten => 310,1,Dial(SIP/2002,15) 
;exten => 310,2,VoiceMail(2002,u) 
;exten => 310,2,Hangup 
exten => 320,1,Dial(SIP/2003,15) 
;exten => 320,2,VoiceMail(2003,u) 
;exten => 320,2,Hangup 
exten => h,1,Hangup 
;exten => _X.,1,Congestion() 

[from-trunk-2] 
exten => 312,1,Dial(SIP/2004,15) 
;exten => 312,2,VoiceMail(2004,u) 
;exten => 312,2,Hangup 
exten => h,1,Hangup 
;exten => _X.,1,Congestion() 

[from-spa400-1] 
exten => _X.,1,Goto(from-trunk-1,${CUT(CUT(SIP_HEADER(To),@,1),:,2)},1) 

[from-spa400-2] 
exten => _X.,1,Goto(from-trunk-2,${CUT(CUT(SIP_HEADER(To),@,1),:,2)},1) 

[fun-stuff] 
exten => 500,1,Answer() 
exten => 500,2,Playback(demo-echotest) 
exten => 500,3,Echo 
exten => 500,4,Playback(demo-echodone) 
exten => 500,5,Hangup

Buat file /etc/asterisk/voicemail.conf:

[general] 
format = wav 
[default] 
2000 => 4711,voicemail,2000@domain.com
2001 => 0815,voicemail,2001@domain.com
2002 => 0915,voicemail,2002@domain.com
2003 => 1015,voicemail,2003@domain.com
2004 => 1115,voicemail,2004@domain.com

Jalankan asterisk.
```
/etc/init.d/asterisk start
```

Konfigurasi SPA400

SPA400-1
- User ID : 9000
- IP Address : 192.168.51.185/255.255.255.192
- Gateway : 192.168.51.190
- Port ID
  - Port ID 1 : 321
  - Port ID 2 : 311
  - Port ID 3 : 310
  - Port ID 4 : 320
SPA400-2
- User ID : 9001
- IP Address : 192.168.51.172/255.255.255.192
- Gateway : 192.168.51.190
- Port ID
  - Port ID 1 : OFF1
  - Port ID 2 : 312
  - Port ID 3 : OFF3
  - Port ID 4 : OFF4
Konfigurasi Voice atau PSTN
Setelah itu hubungkan line pabx sesuai nomor ext ke line1 s/d line4 di SPA400-1 dan line2 di SPA400-2. Status masing-masing SPA400 diperlihatkan pada gambar-gambar di bawah ini.

Pastikan bahwa SIP registration status menunjukkan Registered (apabila asterisk sudah running). Kemudian lihat Battery Level di Line 1 s/d 4 (SPA400-1), apabila semua line extension PABX telah disambungkan ke port-port line 1 s/d 4 di SPA400-1 maka akan ditunjukkan besar tegangan tertentu seperti 27V.Line status menunjukkan apakah ada komunikasi voip atau tidak. Jika ada komunikasi dan pembicaraan sedang berlangsung maka status dari line yang bersangkutan akan berisi Off-Hook dan tegangan line tersebut akan senantiasa < 10V. Misal jika ada panggilan melalui line 1 kemudian terjadi pembicaraan telpon maka status line 1 akan menunjukkan Off-Hook dan tegangan line 1 akan senantiasa < 10V.Apabila USB Capacity status menunjukkan error atau tidak sesuai nilai di atas, itu berarti usb flash disk belum dicolokkan ke port usb di SPA400. Matikan dahulu SPA400 sebelum mencolokkan usb.Saat memasukkan extension PABX ke port-port line di SPA400 selalu monitor battery level seperti gambar di atas. Apabila ada keanehan seperti semua line menunjukkan level tegangan namun yang dimasukkan hanya 3 line atau kurang dari itu maka matikan SPA400, tunggu sesaat kemudian hidupkan kembali.

Konfigurasi PAP2T

Konfigurasi IP Address
Untuk konfigurasi IP Address PAP2T gunakan Interactive Voice Response Menu dengan cara hubungkan pesawat telpon ke salah satu port phone di PAP2T kemudian dial ****. Jangan tekan tombol apa pun sampai terdengar suara “Configuration menu. Please enter option followed by the # (pound) key or hang up to exit.”

Command	Description
100#	Check DHCP feature status (wheter or not unit obtains ip via dhcp)
101#	Change DHCP feature (1 to enable, 0 to disable)
110#	Announce IP Address of the unit
111#	To set a static IP address, the DHCP feature must be disabled . If the DHCP feature is enabled, you will hear, “Invalid Option”. Enter the IP address using the numbers on your telephone keypad. Use the * (star) key to enter a decimal point.
120#	Announce netmask of the unit
121#	To set the network mask, the DHCP feature must be disabled . If the DHCP feature is enabled, you will hear, “Invalid Option”. Enter the network mask using numbers on your telephone keypad. Use the * (star) key to enter a decimal point.
130#	Announce default route of the unit
131#	To set a static gateway IP address, the DHCP feature must be disabled. If the DHCP feature is enabled, you will hear, “Invalid Option”. Enter the IP address using numbers on your telephone keypad. Use the * (star) key to enter a decimal point.
150#	Gives firmware version
732668#	Reboot the unit

No	Nama	IP Address	Netmask	Gateway
1	PAP2T-1	192.168.51.186	255.255.255.192	192.168.51.190
2	PAP2T-2	192.168.51.187	255.255.255.192	192.168.51.190
3	PAP2T-3	192.168.51.173	255.255.255.192	192.168.51.190

Line Configuration
Untuk setup line configuration login ke alamat web PAP2T http://192.168.51.187.
Lalu klik link Admin Login:

Line Configuration Global untuk PAP2T

Proxy : 192.168.51.253

Register : Yes

Register Expires : 3600

Make Call Without Reg : No

Ans Call Without Reg : No

Preferred Codec : G711a

Line Configuration PAP2T-1

Line Line Enable SIP Port Display Name User ID Password Use Auth ID

1 yes 5060 2000 2000 1234 no

2 yes 5061 2001 2001 1234 no

Line Configuration PAP2T-2

Line Line Enable SIP Port Display Name User ID Password Use Auth ID

1 yes 5060 2002 2002 1234 no

2 yes 5061 2003 2003 1234 no

Line Configuration PAP2T-3

Line Line Enable SIP Port Display Name User ID Password Use Auth ID

1 yes 5060 2004 2004 1234 no

Berikut ini gambar-gambar contoh konfigurasi line 1 dan line 2 PAP2T-2.

Test VOIP

Setelah semua unit PAP2T dipasang dengan benar sesuai seting di atas maka selanjutnya jalankan browser dan buka status PAP2T-1 di http://192.168.51.186
Pastikan bahwa status registrasi line 1 dan line 2 sudah Online seperti gambar di bawah:
Lakukan langkah yang sama untuk mencek status PAP2T yang lain.
Angkat pesawat telpon yang tersambung ke PAP2T dan pastikan mendengar nada dialtone.
Lakukan test dial ke nomor VOIP. Misal jika dari pesawat 2000 dial ke 2001, 2002, 2003 dan 2004.
Lakukan test dial ke nomor EXT. Misal jika dari ext 310 dial ke ext 311, 312, 320 dan 321. Lakukan pula ke nomor EXT di Main Office.
Minta teman di Main Office untuk telpon ke salah satu nomor extension (310, 311, 312, 320 atau 321).
Apabila ada masalah seperti sambungan sibuk yang ditunjukkan dengan tegangan pada sambungan drop di angka < 10V padahal sudah tidak ada percakapan di sambungan tersebut maka reboot SPA400 di Menu Administration / Reboot.

Monitor Asterisk

Setelah logon ke server linux sebagai user root jalankan perintah di bawah:
```
asterisk -rvvvv
```

Asterisk akan menampilkan output sebagai berikut:

Asterisk 1.6.2.19, Copyright (C) 1999 - 2010 Digium, Inc. and others. 
Created by Mark Spencer  
Asterisk comes with ABSOLUTELY NO WARRANTY; type 'core show warranty' for details. 
This is free software, with components licensed under the GNU General Public 
License version 2 and other licenses; you are welcome to redistribute it under 
certain conditions. Type 'core show license' for details. 
========================================================================= 
  == Parsing '/etc/asterisk/asterisk.conf':   == Found 
  == Parsing '/etc/asterisk/extconfig.conf':   == Found 
Connected to Asterisk 1.6.2.19 currently running on server (pid = 3612) 
Verbosity is at least 4

Jalankan perintah sip show peers di command line asterisk untuk melihat sip peers.

server*CLI> sip show peers 
Name/username              Host            Dyn Nat ACL Port     Status     
2000/2000                  192.168.51.186   D          5060     Unmonitored 
2001/2001                  192.168.51.186   D          5061     Unmonitored 
2002/2002                  192.168.51.187   D          5060     Unmonitored 
2003/2003                  192.168.51.187   D          5061     Unmonitored 
2004/2004                  192.168.51.173   D          5060     Unmonitored 
9000                       192.168.51.185              5060     Unmonitored 
9001                       192.168.51.172              5060     Unmonitored 
7 sip peers [Monitored: 0 online, 0 offline Unmonitored: 7 online, 0 offline] 
server*CLI>

Jalankan sip show registry untuk melihat status sip registration.

server*CLI> sip show registry
Host                  dnsmgr Username  Refresh State       Reg.Time                 
192.168.51.172:5060   N      9001          105 Registered  Thu, 30 Aug 2012 08:23:36 
192.168.51.185:5060   N      9000          105 Registered  Thu, 30 Aug 2012 08:24:07 
2 SIP registrations.

Tes dial ke no extension 312 dan perhatikan log di asterisk saat panggilan masuk (ringing), panggilan dijawab (answered) dan panggilan berakhir (hangup).

server*CLI> 
  == Using SIP RTP CoS mark 5 
    -- Executing [9001@from-spa400-2:1] Goto("SIP/9001-0000001a", "from-trunk-2,312,1") in new stack 
    -- Goto (from-trunk-2,312,1) 
    -- Executing [312@from-trunk-2:1] Dial("SIP/9001-0000001a", "SIP/2004,15") in new stack 
  == Using SIP RTP CoS mark 5 
    -- Called 2004 
    -- SIP/2004-0000001b is ringing 
    -- SIP/2004-0000001b answered SIP/9001-0000001a 
    -- Packet2Packet bridging SIP/9001-0000001a and SIP/2004-0000001b 
    -- Executing [h@from-trunk-2:1] Hangup("SIP/9001-0000001a", "") in new stack 
  == Spawn extension (from-trunk-2, h, 1) exited non-zero on 'SIP/9001-0000001a' 
  == Spawn extension (from-trunk-2, 312, 1) exited non-zero on 'SIP/9001-0000001a' 
    -- Executing [h@from-trunk-2:1] Hangup("SIP/9001-0000001a", "") in new stack 
  == Spawn extension (from-trunk-2, h, 1) exited non-zero on 'SIP/9001-0000001a' 
server*CLI>

Catatan: Panggilan yang melalui SPA400 akan diteruskan ke asterisk setelah 3 nada dering (default).

How to Installing and Configure Unbound on Ubuntu Server 12.04

2013-10-25T13:06:00.003+07:00

Unbound is a validating, recursive, and caching DNS resolver. created with C programming and Developed by NLnetlabs . Unbound’s design is a set of modular components which incorporate features including enhanced security (DNSSEC) validation, Internet Protocol Version 6 (IPv6), and a client resolver library API as an integral part of the architecture. Originally written for Posix-compatible Unix-like operating system, Unbound currently runs on FreeBSD, OpenBSD, NetBSD, and Linux.

Unbound now available in new version 1.4.18, it was released on August 2 2012. On ubuntu server, unbound packge is available in official ubuntu repository but still in version 1.4.16. The install and configuration of Unbound on Ubuntu Server 12.04 is incredibly easy. Follow the guide How to Installing and Configure Unbound on Ubuntu Server 12.04

Installing Unbound

Login to your ubuntu server using ssh. before installing unbound, make sure your package repositories and installed programs are up to date.

sudo apt-get update

install unbound:

sudo apt-get install unbound

Configure Unbound

Unbound configuration file will be located at /etc/unbound/unbound.conf.

sudo -i

cd /etc/unbound

Download the latest root DNS hints file from

wget ftp://ftp.internic.net/domain/named.cache

Run unbound-control-setup to generate the necessary TLS key files

unbound-control-setup

Change owner all file unbound_* in the directory /etc/unbound to (unbound:root = user unbound : group root)

chown unbound:root unbound_*

Change permissions all file unbound_* to 440

chown unbound:root unbound_*

Backup old unbound configuration with following command

mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.default

Create new file unbound configuration, just copy and paste these config in to terminal:

cat > /etc/unbound/unbound.conf <<-EOF
server:
access-control: 127.0.0.0/8 allow
access-control: 192.168.42.0/24 allow
auto-trust-anchor-file: "/var/lib/unbound/root.key"
verbosity: 1
statistics-interval: 120
num-threads: 1
interface: 0.0.0.0
outgoing-range: 512
num-queries-per-thread: 1024
msg-cache-size: 16m
rrset-cache-size: 32m
msg-cache-slabs: 4
rrset-cache-slabs: 4
cache-max-ttl: 86400
infra-host-ttl: 60
infra-lame-ttl: 120
infra-cache-numhosts: 10000
infra-cache-lame-size: 10k
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
do-daemonize: yes
logfile: ""
use-syslog: no
identity: "DNS"
version: "1.4"
hide-identity: yes
hide-version: yes
harden-glue: yes
do-not-query-address: 127.0.0.1/8
do-not-query-localhost: yes
module-config: "iterator"
local-zone: "localhost." static
local-data: "localhost. 10800 IN NS localhost."
local-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
local-data: "localhost. 10800 IN A 127.0.0.1"
local-zone: "127.in-addr.arpa." static
local-data: "127.in-addr.arpa. 10800 IN NS localhost."
local-data: "127.in-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 2 3600 1200 604800 10800"
local-data: "1.0.0.127.in-addr.arpa. 10800 IN PTR localhost."
local-zone: "ubuntuprecise.net." static
local-data: "ubuntuprecise.net. 86400 IN NS ns1.ubuntuprecise.net."
local-data: "ubuntuprecise.net. 86400 IN SOA ubuntuprecise.net. proxy.ubuntuprecise.net. 3 3600 1200 604800 86400"
local-data: "ubuntuprecise.net. 86400 IN A 192.168.34.4"
local-data: "www.ubuntuprecise.net. 86400 IN A 192.168.34.4"
local-data: "ns1.ubuntuprecise.net. 86400 IN A 192.168.34.4"
local-data: "mail.ubuntuprecise.net. 86400 IN A 192.168.34.4"
local-data: "ubuntuprecise.net. 86400 IN MX 10 mail.ubuntuprecise.net."
local-data: "ubuntuprecise.net. 86400 IN TXT v=spf1 a mx ~all"
local-zone: "42.168.192.in-addr.arpa." static
local-data: "42.168.192.in-addr.arpa. 10800 IN NS ubuntuprecise.net."
local-data: "42.168.192.in-addr.arpa. 10800 IN SOA ubuntuprecise.net. proxy.ubuntuprecise.net. 4 3600 1200 604800 864000"
local-data: "1.42.168.192.in-addr.arpa. 10800 IN PTR ubuntuprecise.net."
forward-zone:
name: "."
forward-addr: 8.8.8.8
forward-addr: 8.8.4.4
forward-addr: 208.67.222.222
forward-addr: 208.67.220.220
remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-interface: 192.168.42.1
control-port: 953
server-key-file: "/etc/unbound/unbound_server.key"
server-cert-file: "/etc/unbound/unbound_server.pem"
control-key-file: "/etc/unbound/unbound_control.key"
control-cert-file: "/etc/unbound/unbound_control.pem"
EOF

Check unbound configuration with following command:

unbound-checkconf /etc/unbound/unbound.conf

Restart unbound service

service unbound restart

When you restart unbound and get an error messege like this:

* Restarting recursive DNS server unbound

[1351477671] unbound[20492:0] error: bind: address already in use
[1351477671] unbound[20492:0] fatal error: could not open ports

You need stop dnsmasq service.

service dnsmasq stop

If you have installed squid proxy server on your machine, add this option on squid file configuration. then restart squid server.

dns_nameservers 127.0.0.1 192.168.42.1

service squid3 restart

use this command to check unbound performance:

unbound-control stats

Ubuntu Linux and Cisco switch link aggregation (load balancing, bonding)

2013-10-25T09:03:00.001+07:00

Link aggregation between Cisco 3750 switch and Ubintu 9.10
Ubuntu configuration:
Install ifenslave — Attach and detach slave network devices to a bonding device.

apt-get install  ifenslave

Edit or create file /etc/modprobe.d/aliases.conf

alias bond0 bonding
options bonding mode=4 miimon=100

where mode 4 – IEEE 802.3ad Dynamic link aggregation. Creates aggregation groups that share the same speed and
duplex settings. Utilizes all slaves in the active aggregator according to the 802.3ad specification.
Edit /etc/network/interfaces.

auto bond0
iface bond0 inet static
        address 172.20.10.10
        netmask 255.255.255.0
        network 172.20.10.0
        broadcast 172.20.10.255
        post-up ifenslave bond0 eth0 eth1
        gateway 172.20.10.254
        dns-nameservers 172.20.10.254
        dns-search axarva.co.id

UPDATE (02.01.2012): Ubuntu 11.10 (oneiric).

1. Edit or create file /etc/modprobe.d/aliases.conf

alias netdev-bond0 bonding
options bonding mode=4 miimon=100

2. To run bonding first put module “bonding” in “/etc/modules” :

# /etc/modules: kernel modules to load at boot time.
#
# This file contains the names of kernel modules that should be loaded
# at boot time, one per line. Lines beginning with "#" are ignored.
loop
lp
rtc
bonding

In “/etc/network/interfaces”

auto bond0
iface bond0 inet static
        slaves eth0 eth1
        bond_mode 4
        bond_miimon 100
        address 172.20.10.10
        netmask 255.255.255.0
        network 172.20.10.0
        broadcast 172.20.10.255
        post-up ifenslave bond0 eth0 eth1

Cisco configuration ( Gi1/0/1 and Gi1/0/2 will be aggregated ):

cisco-3750(config)#interface range GigabitEthernet 1/0/1, GigabitEthernet 1/0/2
cisco-3750(config-if-range)#switchport trunk encapsulation dot1q
cisco-3750(config-if-range)#switchport trunk allowed vlan 10,20
cisco-3750(config-if-range)#switchport mode trunk
cisco-3750(config-if-range)#channel-group 1 mode active
Creating a port-channel interface Port-channel 1
cisco-3750(config-if-range)#end
cisco-3750#

Configuration of interface Port-Channel 1 must be exactly the same as Gi1/0/1 and Gi1/0/2.

cisco-3750#sh ru int Po1
Building configuration...
Current configuration : 159 bytes
!
interface Port-channel1
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,20
end

If you want to modify configuration of aggregated interfaces, modify only configuration of Port-Channel interface.
And the last step is to set load-balance algorithm:

cisco-3750(config)#port-channel load-balance src-dst-ip
cisco-3750#sh etherchannel load-balance
EtherChannel Load-Balancing Operational State (src-dst-ip):
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address

cisco-3750#show etherchannel summary
Flags:  D - down        P - in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/0/1(P)  Gi1/0/2(P)

cisco-3750#
cisco-3750#show etherchannel protocol
                Channel-group listing:
                ----------------------
Group: 1
----------
Protocol:  LACP

May be useful for a network of friends, survivors try.

IPTABLES

2013-09-05T08:04:00.000+07:00

Setelah sekian lama tidak tidak bekerja dengan system operasi ini, karena sudah dimanjakan dengan ada Cisco, Junos, Vyatta, Mikrotik, maupun dengan dengan OS yang sekarang sudah banyak dipergunakan oleh temen-temen yang bekerja di networking baik di skala besar maupun kecil.

Karena sudah tidak ada kegiatan yang apapun, akhirnya buka-buka kamus lama mengenai IPTABLES kembali.

A. IPTABLES

Iptables adalah suatu tools dalam sistem operasi linux yang berfungsi sebagai alat untuk melakukan filter (penyaringan) terhadap trafic/lalu lintas data. Secara sederhana digambarkan sebagai pengatur traffic. Dengan iptables inilah kita akan mengatur semua traffic ke dalam network kita, baik yang masuk ke router, keluar dari komputer, ataupun traffic yang sekedar melewati komputer kita.

Membahas prinsip dasar firewall iptables, mengelola akses internet berdasarkan IP Address, port aplikasi dan MAC address. Firewall IPTables packet filtering memiliki tiga aturan (policy), yaitu:

- INPUT
Mengatur paket data yang memasuki firewall dari intranet maupun internet, kita bisa mengelola komputer mana saja yang bisa
mengakses firewall. Misal: Hanya komputer IP 192.168.1.100 yang bisa SSH ke firewall dan yang lain tidak boleh.

- OUTPUT
Mengatur paket data yang keluar dari firewall ke arah intranet maupun internet. Biasanya output tidak diset, karena bisa
membatasi kemampuan firewall itu sendiri.

- FORWARD
Mengatur paket data yang melintasi firewall dari internet ke intranet maupun sebaliknya. Policy forward paling banyak dipakai
saat ini untuk mengatur koneksi internet berdasarkan port, mac address dan alamat IP Selain aturan (policy) firewall iptables
juga mempunyai parameter yang disebut dengan TARGET, yaitu status yang menentukkan koneksi di iptables diizinkan lewat atau
tidak. TARGET ada tiga macam yaitu:

a. ACCEPT
Akses diterima dan diizinkan melewati firewall

b. REJECT
Akses ditolak, koneksi dari komputer klien yang melewati firewall langsung terputus, biasanya terdapat pesan “Connection
Refused”. Target Reject tidak menghabiskan bandwidth internet karena akses langsung ditolak, hal ini berbeda dengan DROP.

c.DROP
Akses diterima tetapi paket data langsung dibuang oleh kernel, sehingga pengguna tidak mengetahui kalau koneksinya dibatasi
oleh firewall, pengguna melihat seakan–akan server yang dihubungi mengalami permasalahan teknis. Pada koneksi internet yang
sibuk dengan trafik tinggi Target Drop sebaiknya jangan digunakan.

Berikut ini contoh penggunaan firewall iptables untuk mengelolak akses internet;

Policy INPUT

IP Firewall = 192.168.1.1
IP Administrator = 192.168.1.10
IP Umum = 192.168.1.20-254

Membatasi port number
iptables -A INPUT -i eth1 -s 192.168.1.200 -d 192.168.1.1 -p tcp -dport 22-j REJECT

Contoh di atas melarang komputer klien dengan IP 192.168.1.200 mengakses port 22 (ssh) firewall yang memiliki IP 192.168.1.1

Policy FORWARD
1. Membatasi orang mengakses port aplikasi P2P (Limewire, GnuTella & Bearshare)

iptables -A FORWARD -p tcp -dport 6340:6350 -j REJECT
iptables -A FORWARD -p -dport 6340:6350 -j REJECT1
-p tcp (koneksi menggunakan protokol TCP)
-p udp (koneksi menggunakan protokol UDP)
-dport 6340:6350 (melarang akses port 6340 sampai dengan 6350)

2. Membatasi koneksi satu alamat IP

iptables -A FORWARD -s 192.168.1.99 -d 0/0 -j REJECT

-d 0/0 berarti ke semua tujuan

3. Membatasi koneksi berdasarkan range IP

iptables -A FORWARD -m iprange -src-range 192.168.1.100-192.168.1.150 -d 0/0 -j REJECT

4. Membatasi koneksi internet berdasarkan MAC Address

iptables -A FORWARD -m mac -mac-source 00:30:18:AC:14:41 -d 0/0 -j REJECT

B. NAT (Network Address Translation)
Pada bagian ini kita membahas mengenai Network Address Translation, biasa disebut dengan NAT. Fungsi utama dari NAT adalah untuk melakukan translasi alamat dari satu alamat ke alamat IP yang lain, biasanya dipakai pada internet gateway. Selain melakukan translasi alamat IP, iptables juga bisa melakukan NAT alamat Port aplikasi, bisa disebut juga dengan Port Address Translation (PAT). PAT digunakan untuk membangun beberapa server seperti mail, web, database maupun datacenter yang diakses melalui internet hanya dengan satu alamat IP publik.

Tabel NAT
Selain sebagai IP Filtering / Firewall, iptables juga bisa difungsikan untuk translasi alamat, ditandai dengan opsi -t nat pada perintah iptables.

iptables -t nat ..

prinsip dasar NAT di bagi menjadi dua bagian, yang pertama adalah POSTROUTING, yaitu melakukan NAT paket data yang keluar dari firewall, kebanyakan postrouting dipakai untuk translasi alamat IP.

Yang kedua adalah PREROUTING, untuk melakukan NAT paket data yang memasuki firewall, kebanyakan digunakan untuk transparency proxy server dan membangun beberapa server dengan satu IP publik.

1. POSTROUTING
Translasi alamat yang keluar dari firewall, berarti kita melihat paket data yang keluar dari kartu LAN.

iptables -t NAT -A POSTROUTING -o eth0 -s 192.168.1.0/24 -d 0/0 -j SNAT -to 202.154.6.55
iptables -t NAT -A POSTROUTING -o eth0 -s 192.168.1.0/24 -d 0/0 -j MASQUERADE

contoh diatas berarti jaringan subnet 192.168.1.0/24 jika menghubungi web server yang berada di internet dikenali dari IP 202.154.6.55. Target MASQUERADE berarti IP NAT disesuaikan dengan alamat IP kartu LAN eth0, jika IP eth0 dirubah kita tidak perlu merubah settingan iptables.

2. PREROUTING
Translasi alamat yang memasuki kartu jaringan, kita juga bisa membelokkan paket data ke port tertentu untuk membangun server internet hanya dengan satu IP publik.

iptables -t nat -A PREROUTING – eth0 -p tcp -dport 25 -j DNAT -to 192.168.1.20:25
iptables -t nat -A PREROUTING – eth0 -p tcp -dport 110 -j DNAT -to 192.168.1.20:110
iptables -t nat -A PREROUTING – eth0 -p tcp -dport 80 -j DNAT -to 192.168.1.30:80

Pada contoh diatas kita mempunyai 2 server, 192.168.1.20 (mail server) dan 192.168.1.30 (web server). Koneksi dari internet ke port 25 dan 110 secara otomatis diarahkan ke alamat IP 192.168.1.20 (IP Lokal / LAN). Akses port 80 (web server) diarahkan ke IP lokal 192.168.1.30

List NAT
Untuk melihat NAT yang baru saja kita setting menggunakan perintah:

iptables -t nat -L -v
root@kolaMcc $ iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 1833K packets, 141M bytes)
pkts bytes target prot opt in out source destination
199K 9636K REDIRECT tcp – eth2 any anywhere anywhere tcp dpt:http redir ports 3128
0 0 REDIRECT tcp-eth1 any anywhere anywhere tcp dpt:36 redir ports 10000
0 0 REDIRECT tcp-eth1 any anywhere anywhere tcp dpt:time redir ports 20000
0 0 DNAT tcp-eth1 any anywhere anywhere tcp dpt:33 to:192.168.1.100:22

Menghapus NAT

root@kolaMcc $ iptables -t nat -L -viptables -t nat -F
root@kolaMcc $ iptables -t nat -L -viptables -t nat -Z

2013-08-28T01:37:00.000+07:00

Setting Ro. Jakarta
[elang@Pus1nk-JKT] > /interface set ether1 name=ether1<->WAN
[elang@Pus1nk-JKT] > /interface set ether2 name=ether2<->LAN
[elang@Pus1nk-JKT] > /ip address add address=10.10.10.6/30 interface=ether1<->WAN
[elang@Pus1nk-JKT] > /ip address add address=172.21.0.1/22 interface=ether2<->LAN
[elang@Pus1nk-JKT] > /ip route add gateway=10.10.10.5
[elang@Pus1nk-JKT] > /ip dns set primary-dns=10.10.10.254 secondary-dns=10.10.10.252
[elang@Pus1nk-JKT] > /ip dns set allow-remote-requests=yes
(tunnel JKT<->BDG)
[elang@Pus1nk-JKT] > /interface ipip enable JKT<->BDG
[elang@Pus1nk-JKT] > /ip address add address=10.20.30.1/30 interface=JKT<->BDG
[elang@Pus1nk-JKT] > /ip route add dst-address=172.21.0.0/22 gateway=10.20.30.2

Setting Ro. Bandung
[elang@Pus1nk-BDG] > /interface set ether1 name=ether1<->WAN
[elang@Pus1nk-BDG] > /interface set ether2 name=ether2<->LAN
[elang@Pus1nk-BDG] > /ip address add address=20.20.20.2/30 interface=ether1<->WAN
[elang@Pus1nk-BDG] > /ip address add address=172.22.0.1/23 interface=ether2<->LAN
[elang@Pus1nk-BDG] > /ip route add gateway=20.20.20.1
[elang@Pus1nk-BDG] > /ip dns set primary-dns=20.20.20.250 secondary-dns=20.20.20.252
[elang@Pus1nk-BDG] > /ip dns set allow-remote-requests=yes
(tunnel JKT<->BDG)
[elang@Pus1nk-BDG] > /interface ipip enable JKT<->BDG
[elang@Pus1nk-BDG] > /ip address add address=10.20.30.2/30 interface=JKT<->BDG
[elang@Pus1nk-BDG] > /ip route add dst-address=172.22.0.0/23 gateway=10.20.30.1

Setting Ro. Surabaya
[elang@Pus1nk-BDG] > /interface set ether1 name=ether1<->WAN
[elang@Pus1nk-BDG] > /interface set ether2 name=ether2<->LAN
[elang@Pus1nk-BDG] > /ip address add address=30.30.30.2/30 interface=ether1<->WAN
[elang@Pus1nk-BDG] > /ip address add address=172.31.0.1/23 interface=ether2<->LAN
[elang@Pus1nk-BDG] > /ip route add gateway=30.30.30.1
[elang@Pus1nk-BDG] > /ip dns set primary-dns=30.30.30.250 secondary-dns=30.30.30.252
[elang@Pus1nk-BDG] > /ip dns set allow-remote-requests=yes
(tunnel-JKT)
[elang@Pus1nk-BDG] > /interface ipip enable JKT<->SBY
[elang@Pus1nk-BDG] > /ip address add address=10.20.30.6/30 interface=JKT<->SBY
[elang@Pus1nk-BDG] > /ip route add dst-address=172.31.0.0/23 gateway=10.20.30.5

Tunnel Menggunakan EoIP

2013-08-28T01:17:00.000+07:00

Setelah melihat teman kebingungan untuk melakukan Tunnel dengan menggunakan EoIP, jadinya saya berkeingian untuk membuat corat-coretan sedikit.

Dengan asumsi kita mempunyai router induk di jakarta dan beberapa kantor cabang di beberapa daerah;

Setting Ro. Jakarta
[elang@Pus1nk-JKT] > /interface set ether1 name=ether1<->WAN
[elang@Pus1nk-JKT] > /interface set ether2 name=ether2<->LAN
[elang@Pus1nk-JKT] > /ip address add address=10.10.10.6/30 interface=ether1<->WAN
[elang@Pus1nk-JKT] > /ip address add address=172.21.0.1/22 interface=ether2<->LAN
[elang@Pus1nk-JKT] > /ip route add gateway=10.10.10.5
[elang@Pus1nk-JKT] > /ip dns set primary-dns=10.10.10.254 secondary-dns=10.10.10.252
[elang@Pus1nk-JKT] > /ip dns set allow-remote-requests=yes
(tunnel-BDG)
[elang@Pus1nk-JKT] > /interface eoip add name=EoIP-JKT<->BDG remote-address=20.20.20.2 tunnel-id=22
[elang@Pus1nk-JKT] > /ip address add address=10.20.30.1/30 interface=EoIP-JKT<->BDG
[elang@Pus1nk-JKT] > /ip route add dst-address=172.21.0.0/22 gateway=10.20.30.2
(tunnel-SBY)
[elang@Pus1nk-JKT] > /interface eoip add name=EoIP-JKT<->SBY remote-address=10.10.10.11 tunnel-id=31
[elang@Pus1nk-JKT] > /ip address add address=10.20.30.5/30 interface=EoIP-JKT<->SBY
[elang@Pus1nk-JKT] > /ip route add dst-address=172.21.0.0/22 gateway=10.20.30.6

Setting Ro. Bandung
[elang@Pus1nk-BDG] > /interface set ether1 name=ether1<->WAN
[elang@Pus1nk-BDG] > /interface set ether2 name=ether2<->LAN
[elang@Pus1nk-BDG] > /ip address add address=20.20.20.2/30 interface=ether1<->WAN
[elang@Pus1nk-BDG] > /ip address add address=172.22.0.1/23 interface=ether2<->LAN
[elang@Pus1nk-BDG] > /ip route add gateway=20.20.20.1
[elang@Pus1nk-BDG] > /ip dns set primary-dns=20.20.20.250 secondary-dns=20.20.20.252
[elang@Pus1nk-BDG] > /ip dns set allow-remote-requests=yes
(tunnel-JKT)
[elang@Pus1nk-BDG] > /interface eoip add name=EoIP-JKT<->BDG remote-address=10.10.10.6 tunnel-id=22
[elang@Pus1nk-BDG] > /ip address add address=10.20.30.2/30 interface=EoIP-JKT<->BDG
[elang@Pus1nk-BDG] > /ip route add dst-address=172.22.0.0/23 gateway=10.20.30.1

Setting Ro. Surabaya
[elang@Pus1nk-BDG] > /interface set ether1 name=ether1<->WAN
[elang@Pus1nk-BDG] > /interface set ether2 name=ether2<->LAN
[elang@Pus1nk-BDG] > /ip address add address=30.30.30.2/30 interface=ether1<->WAN
[elang@Pus1nk-BDG] > /ip address add address=172.31.0.1/23 interface=ether2<->LAN
[elang@Pus1nk-BDG] > /ip route add gateway=30.30.30.1
[elang@Pus1nk-BDG] > /ip dns set primary-dns=30.30.30.250 secondary-dns=30.30.30.252
[elang@Pus1nk-BDG] > /ip dns set allow-remote-requests=yes
(tunnel-JKT)
[elang@Pus1nk-BDG] > /interface eoip add name=EoIP-JKT<->SBY remote-address=10.10.10.11 tunnel-id=22
[elang@Pus1nk-BDG] > /ip address add address=10.20.30.6/30 interface=EoIP-JKT<->SBY
[elang@Pus1nk-BDG] > /ip route add dst-address=172.31.0.0/23 gateway=10.20.30.5

Silahkan mencoba sendiri . . . .

Load Balancing dan Fail Over

2013-04-21T00:10:00.000+07:00

Sudah cukup banyak load balancing dan fail over di bahas di FMI (Forum Mikrotik Indonesia) seperti pada beberapa tautan yang saya simpan di bawah ini:

Koneksi ke internet yang digunakan adalah 1 link dedicated ke cbn via fiber optic atau FO dan 2 link ke speedy via modem adsl. Pemodelan koneksi adalah sbb:

Koneksi ke cbn dianggap stabil.
Koneksi ke cbn hanya digunakan oleh server mail saja.
Koneksi ke cbn adalah default gateway mikrotik.
Koneksi ke internet seperti browsing dll dilewatkan ke speedy.
Koneksi ke speedy dianggap tidak stabil dan perlu dibuat fail over sehingga jika salah satu speedy putus maka koneksi akan melalui 1 speedy.
Koneksi internet user ke tcp port 80 (browsing) akan dilewatkan server proxy. Koneksi dari proxy keluar akan melalui load balancing nth.
Koneksi internet user selain browsing di atas akan melalui load balancing pcc.
Mikrotik bisa diakses dari luar baik melalui link CBN maupun speedy.

Network Topologi

/interface ethernet

set 0 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \
    disabled=no full-duplex=yes l2mtu=1598 mac-address=\
    XX:XX:XX:XX:XX:B0 master-port=none mtu=1500 name=CBN speed=100Mbps
set 1 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \
    disabled=no full-duplex=yes l2mtu=1598 mac-address=\
    XX:XX:XX:XX:XX:AF master-port=none mtu=1500 name=LAN speed=100Mbps
set 2 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \
    disabled=no full-duplex=yes l2mtu=1598 mac-address=\
    XX:XX:XX:XX:XX:B1 master-port=none mtu=1500 name=ETH-SPEEDY1 speed=100Mbps
set 3 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \
    disabled=no full-duplex=yes l2mtu=1598 mac-address=\
    XX:XX:XX:XX:XX:B2 master-port=none mtu=1500 name=ETH-SPEEDY2 speed=100Mbps
set 4 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \
    disabled=no full-duplex=yes l2mtu=1598 mac-address=\
    XX:XX:XX:XX:XX:B5 master-port=none mtu=1500 name=SERVER speed=100Mbps

/interface pppoe-client

add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 comment="" \
    dial-on-demand=no disabled=no interface=SPEEDY1 max-mru=1480 \
    max-mtu=1480 mrru=disabled name=SPEEDY1 password=xxxxxx profile=\
    default service-name="" use-peer-dns=no user=12260420xxxx@telkom.net
add ac-name="" add-default-route=no allow=pap,chap,mschap1,mschap2 comment="" \
    dial-on-demand=no disabled=no interface=SPEEDY2 max-mru=1480 \
    max-mtu=1480 mrru=disabled name=SPEEDY2 password=xxxxxx profile=\
    default service-name="" use-peer-dns=no user=12260420xxxx@telkom.net

Perhatikan bahwa default route tidak diset di kedua koneksi speedy.

/ip address

add address=202.158.1.2/30 broadcast=202.158.1.3 comment="" disabled=no \
    interface=CBN network=202.158.1.0
add address=192.168.0.254/24 broadcast=192.168.0.255 comment="" disabled=\
    no interface=LAN network=192.168.0.0
add address=192.168.1.253/24 broadcast=192.168.1.255 comment="" disabled=no \
    interface=ETH-SPEEDY1 network=192.168.1.0
add address=192.168.2.253/24 broadcast=192.168.2.255 comment="" disabled=no \
    interface=ETH-SPEEDY2 network=192.168.2.0
add address=192.168.100.254/24 broadcast=192.168.100.255 comment="" disabled=no \
    interface=SERVER network=192.168.100.0

/ip route

add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
    202.158.1.1 routing-mark=CBN scope=30 target-scope=10
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=SPEEDY1 \
    routing-mark=speedy1 scope=30 target-scope=10
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=SPEEDY2 \
    routing-mark=speedy2 scope=30 target-scope=10
add comment="CBN as default gateway" disabled=no distance=1 \
    dst-address=0.0.0.0/0 gateway=202.158.1.1 scope=30 target-scope=10
add comment="network speedy" disabled=no distance=1 dst-address=202.134.0.0/16 gateway=\
    SPEEDY1,SPEEDY2 scope=30 target-scope=10

/ip firewall address-list

#
# Local network
#
add address=192.168.1.0/24 comment=speedy1 disabled=no list=local
add address=192.168.2.0/24 comment=speedy2 disabled=no list=local
add address=192.168.100.0/24 comment=server disabled=no list=local
add address=192.168.0.0/24 comment=lan disabled=no list=local
#
# Users (Clients)
#
add address=192.168.0.0/24 comment="" disabled=no list=lan
#
# Server
#
add address=192.168.100.0/24 comment="" disabled=no list=server
add address=192.168.100.200 comment="" disabled=no list=server-mail
add address=192.168.100.201 comment="" disabled=no list=server-proxy

/ip firewall nat

#
# DNS TRANSPARENT
#
add action=dst-nat chain=dstnat comment="DNS transparent" disabled=no \
    dst-port=53 protocol=tcp src-address-list=lan to-addresses=\
    192.168.100.200 to-ports=53
add action=dst-nat chain=dstnat comment="" disabled=no dst-port=53 protocol=\
    udp src-address-list=lan to-addresses=192.168.100.200 to-ports=53
#
# DSTNAT to Server Mail
#
add action=dst-nat chain=dstnat comment="SMTP" disabled=no \
    dst-address=202.158.1.2 dst-port=25 protocol=tcp to-addresses=\
    192.168.100.200 to-ports=25
add action=dst-nat chain=dstnat comment=WEB disabled=no dst-address=\
    202.158.1.2 dst-port=80 protocol=tcp to-addresses=192.168.100.200 \
    to-ports=808
add action=dst-nat chain=dstnat comment=POP3 disabled=no dst-address=\
    202.158.1.2 dst-port=110 protocol=tcp to-addresses=192.168.100.200 \
    to-ports=110
add action=dst-nat chain=dstnat comment=IMAP disabled=no dst-address=\
    202.158.1.2 dst-port=143 protocol=tcp to-addresses=192.168.100.200 \
    to-ports=143
add action=dst-nat chain=dstnat comment=HTTPS disabled=no dst-address=\
    202.158.1.2 dst-port=443 protocol=tcp to-addresses=192.168.100.200 \
    to-ports=443
#
# PROXY TRANSPARENT
#
add action=dst-nat chain=dstnat comment="PROXY TRANSPARENT for clients" \
    disabled=no dst-address-list=!local dst-port=80 in-interface=LAN \
    protocol=tcp src-address-list=lan to-addresses=192.168.100.201 \
    to-ports=8080
#
# MASQUERADE To Internet
#
add action=masquerade chain=srcnat comment="" disabled=no out-interface=CBN
add action=masquerade chain=srcnat comment="" disabled=no out-interface=SPEEDY1
add action=masquerade chain=srcnat comment="" disabled=no out-interface=SPEEDY2
#
# MASQUERADE To Modem ADSL
#
add action=masquerade chain=srcnat comment="" disabled=no out-interface=ETH-SPEEDY1
add action=masquerade chain=srcnat comment="" disabled=no out-interface=ETH-SPEEDY2

/ip firewall mangle

#
# MARK PACKET DOWN Proxy Cache Hits Mark
#
add action=mark-packet chain=forward comment="Proxy Cache Hits Mark" \
    disabled=no dscp=12 new-packet-mark=proxy-hit passthrough=no protocol=tcp \
    src-port=8080
#
# MARK PACKET DOWN from server proxy as internet connection
#
add action=mark-packet chain=forward comment=\
    "MARK PACKET clients-down from proxy" disabled=no dst-address-list=\
    lan new-packet-mark=clients-down passthrough=no protocol=tcp \
    src-address-list=server-proxy src-port=8080
#
# MARK PACKET UP local connection
#
add action=mark-packet chain=prerouting comment=\
    "MARK PACKETS server to local as server-up" disabled=no \
    dst-address-list=local new-packet-mark=server-up passthrough=no \
    src-address-list=server
#
# MARK ROUTING cbn from server mail
#
add action=mark-routing chain=prerouting comment=\
    "MARK routing for server mail via cbn" disabled=no \
    new-routing-mark=CBN passthrough=no src-address-list=server-mail
#
# MARK PACKET UP DIRECT to server proxy as internet connection
#
add action=mark-packet chain=prerouting comment=\
    "MARK PACKET DIRECT to proxy clients-up" disabled=no dst-address-list=\
    server-proxy dst-port=8080 new-packet-mark=clients-up passthrough=no \
    protocol=tcp src-address-list=lan
#
# MARK PACKET UP local connection
#
add action=mark-packet chain=prerouting comment="MARK PACKET LOCAL local-up" \
    disabled=no dst-address-list=local in-interface=LAN new-packet-mark=clients-local-up \
    passthrough=no src-address-list=lan
#
# MARK PACKET UP REDIRECT to server proxy as internet connection
#
add action=mark-packet chain=prerouting comment=\
    "MARK PACKET tcp port 80 REDIRECT to proxy clients-up" disabled=no \
    dst-address-list=!local dst-port=80 new-packet-mark=clients-up \
    passthrough=no protocol=tcp src-address-list=lan
#
# MARK CONNECTION from internet via cbn/speedy to mikrotik
#
add action=mark-connection chain=input comment=\
    "ACCEPT connection from cbn" connection-state=new disabled=no \
    in-interface=CBN new-connection-mark=cbn_rt_con passthrough=yes
add action=mark-routing chain=output comment="" connection-mark=cbn_rt_con \
    disabled=no new-routing-mark=CBN passthrough=no
add action=mark-connection chain=input comment=\
    "ACCEPT connection from speedy1" connection-state=new disabled=\
    no in-interface=SPEEDY1 new-connection-mark=speedy1_rt_con passthrough=\
    yes
add action=mark-routing chain=output comment="" connection-mark=\
    speedy1_rt_con disabled=no new-routing-mark=speedy1 passthrough=no
add action=mark-connection chain=input comment=\
    "ACCEPT connection from speedy2" connection-state=new disabled=\
    no in-interface=SPEEDY2 new-connection-mark=speedy2_rt_con passthrough=\
    yes
add action=mark-routing chain=output comment="" connection-mark=\
    speedy2_rt_con disabled=no new-routing-mark=speedy2 passthrough=no
#
# MARK PACKET DOWN local connection
#
add action=mark-packet chain=forward comment=\
    "MARK PACKET LOCAL clients-local-down" disabled=no dst-address-list=\
    lan new-packet-mark=clients-local-down passthrough=no \
    src-address-list=local
#
# MARK PACKET DOWN internet connection
#
add action=mark-packet chain=forward comment=\
    "MARK PACKET clients-down" disabled=no dst-address-list=\
    lan new-packet-mark=clients-down passthrough=no
#
# MARK PACKET UP internet connection (classified by connection marking)
#
add action=mark-packet chain=forward comment="MARK PACKET clients-up" \
    connection-mark=speedy1_con disabled=no new-packet-mark=clients-up \
    passthrough=no src-address-list=lan
add action=mark-packet chain=forward comment="MARK PACKET clients-up" \
    connection-mark=speedy2_con disabled=no new-packet-mark=clients-up \
    passthrough=no src-address-list=lan
#
# LOAD BALANCING NTH server proxy
#
add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Proxy \
    connection-state=new disabled=no dst-address-list=!local \
    new-connection-mark=speedy1_pr_con nth=2,1 passthrough=yes \
    src-address-list=server-proxy
add action=mark-routing chain=prerouting comment=LB_PCC_NTH_Proxy \
    connection-mark=speedy1_pr_con disabled=no dst-address-list=!local \
    new-routing-mark=speedy1 passthrough=no src-address-list=server-proxy
add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Proxy \
    connection-state=new disabled=no dst-address-list=!local \
    new-connection-mark=speedy2_pr_con nth=1,1 passthrough=yes \
    src-address-list=server-proxy
add action=mark-routing chain=prerouting comment=LB_PCC_NTH_Proxy \
    connection-mark=speedy2_pr_con disabled=no dst-address-list=!local \
    new-routing-mark=speedy2 passthrough=no src-address-list=server-proxy
#
# LOAD BALANCING PCC clients
#
add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Clients \
    connection-state=new disabled=no dst-address-list=!local \
    dst-address-type=!local new-connection-mark=speedy1_con passthrough=yes \
    per-connection-classifier=both-addresses:2/0 src-address-list=lan
add action=mark-routing chain=prerouting comment=LB_PCC_NTH_Clients \
    connection-mark=speedy1_con disabled=no dst-address-list=!local \
    new-routing-mark=speedy1 passthrough=no src-address-list=lan
add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Clients \
    connection-state=new disabled=no dst-address-list=!local \
    dst-address-type=!local new-connection-mark=speedy2_con passthrough=yes \
    per-connection-classifier=both-addresses:1/0 src-address-list=lan
add action=mark-routing chain=prerouting comment=LB_PCC_NTH_Clients \
    connection-mark=speedy2_con disabled=no dst-address-list=!local \
    new-routing-mark=speedy2 passthrough=no src-address-list=lan

/queue type

set default kind=pfifo name=default pfifo-limit=50
set ethernet-default kind=pfifo name=ethernet-default pfifo-limit=50
set wireless-default kind=sfq name=wireless-default sfq-allot=1514 \
    sfq-perturb=5
set synchronous-default kind=red name=synchronous-default red-avg-packet=1000 \
    red-burst=20 red-limit=60 red-max-threshold=50 red-min-threshold=10
set hotspot-default kind=sfq name=hotspot-default sfq-allot=1514 sfq-perturb=5
add kind=pcq name=pcq-download pcq-classifier=dst-address pcq-limit=20 \
    pcq-rate=0 pcq-total-limit=1000
add kind=pcq name=pcq-upload pcq-classifier=src-address pcq-limit=20 \
    pcq-rate=0 pcq-total-limit=1000
set default-small kind=pfifo name=default-small pfifo-limit=10

Untuk bandwidth management hanya trafik upstream dan downstream dari dan ke internet melalui koneksi dua speedy yang diatur. Nama packetnya adalah clients-up untuk trafik upstream dan clients-down untuk downstream. Ada pun pengaturan bandwidthnya sbb:

Bandwidth Downstream

Root
  - Ceiling  : 3500kbps
  - Rate     :     0kbps
Client
  - Ceiling  : 3500kbps
  - Rate     :      0kbps

Bandwidth Upstream

Root
  - Ceiling  : 512kbps
  - Rate     :    0kbps
Client
  - Ceiling  : 512kbps
  - Rate     :    0kbps

/queue tree

add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=512k name=UPSTREAM parent=global-out priority=8
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=512k name=clients-up packet-mark=clients-up parent=\
    UPSTREAM priority=1 queue=pcq-upload
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=3500k name=DOWNSTREAM parent=global-out priority=8
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=3500k name=clients-down packet-mark=clients-down parent=\
    DOWNSTREAM priority=1 queue=pcq-download

/system clock

set time-zone-name=Asia/Jakarta

/system clock manual

set dst-delta=+00:00 dst-end="jan/01/1970 00:00:00" dst-start=\
    "jan/01/1970 00:00:00" time-zone=+00:00

/tool graphing interface

add allow-address=0.0.0.0/0 disabled=no interface=CBN store-on-disk=yes
add allow-address=0.0.0.0/0 disabled=no interface=SPEEDY1 store-on-disk=yes
add allow-address=0.0.0.0/0 disabled=no interface=SPEEDY2 store-on-disk=yes
add allow-address=0.0.0.0/0 disabled=no interface=LAN store-on-disk=yes
add allow-address=0.0.0.0/0 disabled=no interface=SERVER store-on-disk=yes

/tool graphing resource

add allow-address=0.0.0.0/0 disabled=no store-on-disk=yes

Berikut ini script-script untuk load balancing dan fail over speedy. Penjelasan fungsi-fungsi script ada di bagian bawah:

1. param

#

# param

#

#

# Jumlah wan

#

:global wans 2;

#

# Interface speedy

#   1. SPEEDY1

#   2. SPEEDY2

#

:global iface "ETH-SPEEDY1, ETH-SPEEDY2";

#

# Nama koneksi

#

:global wan "SPEEDY1, SPEEDY2";

#

# Scoring

#

# No  speedy1  speedy2

# 0   off      off

# 2   on       off

# 4   off      on

# 6   on       on

:global scrs "2,4";

:global SCORE 0;

Penjelasan:

Variable global iface untuk menyimpan nama interface ethernet mikrotik yang terhubung ke modem ADSL speedy.
Variable global wan untuk menyimpan nama interface pppoe client (mikrotik) ke koneksi internet speedy.
Variable SCORE untuk menyimpan status koneksi yang berlangsung.

SCORE 0 berarti semua speedy tidak online.
SCORE 2 berarti hanya speedy1 yang online.
SCORE 4 berarti hanya speedy2 yang online.
SCORE 6 berarti hanya kedua speedy online bersamaan.

2. lb-detection

#

# lb-detection

#

:global SCORE;

:global wans;

:global scrs;

:global iface;

:global wan;

:local scrArr [:toarray $scrs];

:local ifaceArr [:toarray $iface];

:local wanArr [:toarray $wan];

:local score 0;

:local nth 0;

:local ifaceStatus "";

:local wanStatus "";

:for x from=1 to="$wans" \

do={ :local wanIface [:pick $ifaceArr ($x-1)];

     :local wanName [:pick $wanArr ($x-1)];

     /interface ethernet monitor "$wanIface" once do={ :set ifaceStatus $status };

     :if ( $ifaceStatus="link-ok" ) \

     do { /interface pppoe-client monitor "$wanName" once do={:set wanStatus $status };

          :if ( $wanStatus="connected" ) \

          do { :set score ($score+[:pick $scrArr ($x-1)]); :set nth ($nth+1);

             } else { :log warning "$wanName is disconnected"; }

        } else { :log warning "$wanIface is down"; }

   };

#:put $score;

#

:if ($SCORE!=$score) \

do { :local ptr [ /system logging find topics="info"];

   /system logging disable $ptr;

   :if ($score=6) do { /system script run LB_SPEEDY; }

   :if ($score=4) do { /system script run SPEEDY2; }

   :if ($score=2) do { /system script run SPEEDY1; }

   /system logging enable $ptr;

};

#

:set SCORE $score;

:put $SCORE;

Penjelasan:

Baris 4-8 membaca variable global yang telah dideklarasikan sewaktu booting dan melalui eksekusi script seperti variable SCORE.
Baris 9-15 mendeklarasikan variable local.
Baris 17-27 adalah inti dari load balancing detection.

Pertama mikrotik mendeteksi apakah link ke interface modem adsl (ETH-SPEEDY1 atau ETH-SPEEDY2) menunjukkan link-ok atau tidak. Jika tidak maka koneksi melalui modem ADSL tersebut dianggap putus seraya menampilkan pesan log interface_name is down dan tidak perlu cek koneksi internet speedy . Jika link ok maka lanjut ke langkah di bawah ini.
Selanjutnya mikrotik melihat status koneksi internet speedy jika menunjukkan connected maka nilai score bertambah 1. Jika statusnya disconnected mikrotik akan menampilkan isi log “PPPoE_Client_Name is disconnected”.

Baris 30-37, mikrotik akan menjalankan salah satu script ini, LB_SPEEDY, SPEEDY1 atau SPEEDY2, hanya jika nilai score baru berbeda dengan nilai SCORE lama.
Baris 39-40 nilai score baru disimpan ke variable global SCORE.

3. LB_SPEEDY

#

# LB_SPEEDY

#

# Hapus rule-rule mangle lama berdasarkan isi comment

/ip firewall mangle remove [ find comment="LB_PCC_NTH_Proxy"];

/ip firewall mangle remove [ find comment="LB_PCC_NTH_Clients"];

#

# Tambahkan rule-rule mangle baru

/ip firewall mangle

#

# LB_PCC_NTH_Proxy

#

#add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Proxy \

#    connection-state=new disabled=no dst-address-list=!local \

#    dst-address-type=!local new-connection-mark=speedy1_pr_con passthrough=\

#    yes per-connection-classifier=both-addresses:2/0 src-address-list=\

#    server-proxy

add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Proxy \

    connection-state=new disabled=no dst-address-list=!local \

    new-connection-mark=speedy1_pr_con nth=2,1 passthrough=\

    yes src-address-list=server-proxy

add action=mark-routing chain=prerouting comment="LB_PCC_NTH_Proxy" connection-mark=\

    speedy1_pr_con disabled=no dst-address-list=!local new-routing-mark=\

    speedy1 passthrough=no src-address-list=server-proxy

#add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Proxy \

#    connection-state=new disabled=no dst-address-list=!local \

#    dst-address-type=!local new-connection-mark=speedy2_pr_con passthrough=\

#    yes per-connection-classifier=both-addresses:1/0 src-address-list=\

#    server-proxy

add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Proxy \

    connection-state=new disabled=no dst-address-list=!local \

    new-connection-mark=speedy2_pr_con nth=1,1 passthrough=\

    yes src-address-list=server-proxy

add action=mark-routing chain=prerouting comment="LB_PCC_NTH_Proxy" connection-mark=\

    speedy2_pr_con disabled=no dst-address-list=!local new-routing-mark=\

    speedy2 passthrough=no src-address-list=server-proxy

#

# LB_PCC_NTH_Clients

#

add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Clients \

    connection-state=new disabled=no dst-address-list=!local \

    dst-address-type=!local new-connection-mark=speedy1_con passthrough=yes \

    per-connection-classifier=both-addresses:2/0 src-address-list=lan

add action=mark-routing chain=prerouting comment="LB_PCC_NTH_Clients" connection-mark=\

    speedy1_con disabled=no dst-address-list=!local new-routing-mark=speedy1 \

    passthrough=no src-address-list=lan

add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Clients \

    connection-state=new disabled=no dst-address-list=!local \

    dst-address-type=!local new-connection-mark=speedy2_con passthrough=yes \

    per-connection-classifier=both-addresses:1/0 src-address-list=lan

add action=mark-routing chain=prerouting comment="LB_PCC_NTH_Clients" connection-mark=\

    speedy2_con disabled=no dst-address-list=!local new-routing-mark=speedy2 \

    passthrough=no src-address-list=lan

#

/queue tree {

set DOWNSTREAM max-limit=3500k

set UPSTREAM max-limit=512k

}

4. SPEEDY1

#

# SPEEDY1

#

# Hapus rule-rule mangle lama berdasarkan isi comment

/ip firewall mangle remove [ find comment="LB_PCC_NTH_Proxy"];

/ip firewall mangle remove [ find comment="LB_PCC_NTH_Clients"];

#

# Tambahkan rule-rule mangle baru

/ip firewall mangle

#

# LB_PCC_NTH_Proxy

#

add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Proxy \

    connection-state=new disabled=no dst-address-list=!local \

    new-connection-mark=speedy1_pr_con passthrough=\

    yes src-address-list=server-proxy

add action=mark-routing chain=prerouting comment="LB_PCC_NTH_Proxy" connection-mark=\

    speedy1_pr_con disabled=no dst-address-list=!local new-routing-mark=\

    speedy1 passthrough=no src-address-list=server-proxy

#

# LB_PCC_NTH_Clients

#

add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Clients \

    connection-state=new disabled=no dst-address-list=!local \

    new-connection-mark=speedy1_con passthrough=yes \

    src-address-list=lan

add action=mark-routing chain=prerouting comment="LB_PCC_NTH_Clients" connection-mark=\

    speedy1_con disabled=no dst-address-list=!local new-routing-mark=speedy1 \

    passthrough=no src-address-list=

#

/queue tree {

set DOWNSTREAM max-limit=1750k

set UPSTREAM max-limit=256k

}

5. SPEEDY2

#

# SPEEDY2

#

#

/ip firewall mangle remove [ find comment="LB_PCC_NTH_Proxy"];

/ip firewall mangle remove [ find comment="LB_PCC_NTH_Clients"];

/ip firewall mangle

#

# LB_PCC_NTH_Proxy

#

add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Proxy \

    connection-state=new disabled=no dst-address-list=!local \

    new-connection-mark=speedy2_pr_con passthrough=\

    yes src-address-list=server-proxy

add action=mark-routing chain=prerouting comment="LB_PCC_NTH_Proxy" connection-mark=\

    speedy2_pr_con disabled=no dst-address-list=!local new-routing-mark=\

    speedy2 passthrough=no src-address-list=server-proxy

#

# LB_PCC_NTH_Clients

#

add action=mark-connection chain=prerouting comment=LB_PCC_NTH_Clients \

    connection-state=new disabled=no dst-address-list=!local \

    new-connection-mark=speedy2_con passthrough=yes \

    src-address-list=lan

add action=mark-routing chain=prerouting comment="LB_PCC_NTH_Clients" connection-mark=\

    speedy2_con disabled=no dst-address-list=!local new-routing-mark=speedy2 \

    passthrough=no src-address-list=lan

#

/queue tree {

set DOWNSTREAM max-limit=1750k

set UPSTREAM max-limit=256k

}

Penjelasan:

Saat mikrotik booting maka script param akan dieksekusi. Script ini menyimpan beberapa variable global dan penilaian atau scoring jumlah koneksi speedy yang online (tersambung ke internet). Nilai atau score 0 berarti semua speedy tidak online, 2 berarti speedy1 yang online, 4 hanya speedy2 yang online dan 6 jika semua speedy online. Mengapa perlu scoring? Tujuannya adalah agar seusai script lb-detection dijalankan setiap 30 detik maka hanya jika ada perubahan koneksi, salah satu dari script di bawah ini yang akan dijalankan:
- LB_SPEEDY jika 2 speedy online bersamaan.
- SPEEDY1 jika hanya speedy1 yang online.
- SPEEDY2 jika hanya speedy2 yang online.
Misal pertama kali semua speedy online, 30 detik kemudian script lb-detection dieksekusi, mikrotik melihat bahwa tidak ada perubahan koneksi alias SCORE baru tidak berbeda dengan SCORE lama, scriptLB_SPEEDY tidak akan dijalankan. Sekian menit atau jam kemudian salah satu koneksi speedy ada yang putus maka mikrotik akan meng-eksekusi salah satu script, SPEEDY1 atau SPEEDY2, karena melihat SCORE baru berbeda dengan SCORE lama.
Script LB_SPEEDY akan menjalankan load balancing nth dan pcc dengan dua koneksi speedy.
Script SPEEDY1 akan menjalankan koneksi ke internet dengan jalur speedy1.
Script SPEEDY2 akan menjalankan koneksi ke internet dengan jalur speedy2.

Dan ini schedule untuk menjalankan script di atas:
/system scheduler

#
# Script param akan dijalankan setiap mikrotik reboot
#
add comment="" disabled=no interval=0s name=startup-param on-event=param \
    policy=reboot,write,test start-time=startup
#
# Script lb-detectio (load balancing detection) dijalankan setiap 30 detik
#
add comment="" disabled=no interval=30s name=speedy-detection on-event=\
    lb-detection policy=reboot,read,write,test start-date=jan/01/1970 \
    start-time=00:00:10

Tool netwatch untuk monitoring koneksi dari mikrotik ke interface speedy:

/tool netwatch

add comment="interface speedy2" disabled=no down-script="" host=\
    192.168.2.254 interval=30s timeout=1s up-script=""
add comment="interface speedy1" disabled=no down-script="" host=\
    192.168.1.254 interval=30s timeout=1s up-script=""

Configuring Single-Hop EBGP Peers to Accept Remote Next Hops

2013-02-21T22:20:00.000+07:00

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Device R0

set interfaces fe-1/2/0 unit 1 family inet address 1.1.0.1/30set interfaces fe-1/2/1 unit 2 family inet address 1.1.1.1/30set interfaces lo0 unit 1 family inet address 10.255.14.179/32set protocols bgp group ext type externalset protocols bgp group ext export test_routeset protocols bgp group ext export agg_routeset protocols bgp group ext peer-as 65000set protocols bgp group ext multipathset protocols bgp group ext neighbor 1.1.0.2set protocols bgp group ext neighbor 1.1.1.2set policy-options policy-statement agg_route term 1 from protocol staticset policy-options policy-statement agg_route term 1 from route-filter 1.1.230.0/23 exactset policy-options policy-statement agg_route term 1 then acceptset policy-options policy-statement test_route term 1 from protocol staticset policy-options policy-statement test_route term 1 from route-filter 1.1.10.10/32 exactset policy-options policy-statement test_route term 1 then acceptset routing-options static route 1.1.10.10/32 rejectset routing-options static route 1.1.230.0/23 rejectset routing-options autonomous-system 65500

Device R1

set interfaces fe-1/2/0 unit 3 family inet address 1.1.0.2/30set interfaces fe-1/2/1 unit 4 family inet address 1.12.0.1/30set interfaces fe-1/2/2 unit 5 family inet address 1.1.1.2/30set interfaces lo0 unit 2 family inet address 10.255.71.24/32set protocols bgp accept-remote-nexthopset protocols bgp group ext type externalset protocols bgp group ext import agg_routeset protocols bgp group ext peer-as 65500set protocols bgp group ext multipathset protocols bgp group ext neighbor 1.1.0.1set protocols bgp group ext neighbor 1.1.1.1set protocols bgp group int type internalset protocols bgp group int local-address 10.255.71.24set protocols bgp group int neighbor 10.255.14.177set protocols ospf area 0.0.0.0 interface fe-1/2/1.4set protocols ospf area 0.0.0.0 interface 10.255.71.24set policy-options policy-statement agg_route term 1 from protocol bgpset policy-options policy-statement agg_route term 1 from route-filter 1.1.230.0/23 exactset policy-options policy-statement agg_route term 1 then next-hop 1.1.10.10set policy-options policy-statement agg_route term 1 then acceptset routing-options autonomous-system 65000

Device R2

set interfaces fe-1/2/0 unit 6 family inet address 1.12.0.2/30set interfaces lo0 unit 3 family inet address 10.255.14.177/32set protocols bgp group int type internalset protocols bgp group int local-address 10.255.14.177set protocols bgp group int neighbor 10.255.71.24set protocols ospf area 0.0.0.0 interface fe-1/2/0.6set protocols ospf area 0.0.0.0 interface 10.255.14.177set routing-options autonomous-system 65000

Device R0

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure Device R0:

Configure the interfaces.

[edit interfaces fe-1/2/0 unit 1]user@R0# set family inet address 1.1.0.1/30
[edit interfaces fe-1/2/1 unit 2]user@R0# set family inet address 1.1.1.1/30
[edit interfaces lo0 unit 1]user@R0# set family inet address 10.255.14.179/32
Configure EBGP.

[edit protocols bgp group ext]user@R0# set type externaluser@R0# set peer-as 65000user@R0# set neighbor 1.1.0.2user@R0# set neighbor 1.1.1.2
Enable multipath BGP between Device R0 and Device R1.

[edit protocols bgp group ext]user@R0# set multipath
Configure static routes to remote networks.
These routes are not part of the topology. The purpose of these routes is to demonstrate the functionality in this example.

[edit routing-options]user@R0# set static route 1.1.10.10/32 rejectuser@R0# set static route 1.1.230.0/23 reject
Configure routing policies that accept the static routes.

[edit policy-options policy-statement agg_route term 1]user@R0# set from protocol staticuser@R0# set from route-filter 1.1.230.0/23 exactuser@R0# set then accept
[edit policy-options policy-statement test_route term 1]user@R0# set from protocol staticuser@R0# set from route-filter 1.1.10.10/32 exactuser@R0# set then accept
Export the agg_route and test_route policies from the routing table into BGP.

[edit protocols bgp group ext]user@R0# set export test_routeuser@R0# set export agg_route
Configure the autonomous system (AS) number.

[edit routing-options]user@R0# set autonomous-system 65500

Results

From configuration mode, confirm your configuration by entering the show interfaces, show policy-options, show protocols, and show routing-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

user@R0# show interfaces

fe-1/2/0 {unit 1 {family inet {address 1.1.0.1/30;}}}

fe-1/2/1 {unit 2 {family inet {address 1.1.1.1/30;}}}

lo0 {unit 1 {family inet {address 10.255.14.179/32;}}}

user@R0# show policy-options

policy-statement agg_route {term 1 {from {protocol static;route-filter 1.1.230.0/23 exact;}then accept;}}

policy-statement test_route {term 1 {from {protocol static;route-filter 1.1.10.10/32 exact;}then accept;}}

user@R0# show protocols

bgp {group ext {type external;export [ test_route agg_route ];peer-as 65000;multipath;neighbor 1.1.0.2;neighbor 1.1.1.2;}}

user@R0# show routing-options

static {route 1.1.10.10/32 reject;route 1.1.230.0/23 reject;}

autonomous-system 65500;

If you are done configuring the device, enter commit from configuration mode.

Configuring Device R1

Step-by-Step Procedure

To configure Device R1:

Configure the interfaces.

[edit interfaces fe-1/2/0 unit 3]user@R1# set family inet address 1.1.0.2/30
[edit interfaces fe-1/2/1 unit 4]user@R1# set family inet address 1.12.0.1/30
[edit interfaces fe-1/2/2 unit 5]user@R1# set family inet address 1.1.1.2/30
[edit interfaces lo0 unit 2]user@R1# set family inet address 10.255.71.24/32
Configure OSPF.

[edit protocols ospf area 0.0.0.0]user@R1# set interface fe-1/2/1.4user@R1# set interface 10.255.71.24
Enable Device R1 to accept the remote next hop.

[edit protocols bgp]user@R1# set accept-remote-nexthop
Configure IBGP.

[edit protocols bgp group int]user@R1# set type internaluser@R1# set local-address 10.255.71.24user@R1# set neighbor 10.255.14.177
Configure EBGP.

[edit protocols bgp group ext]user@R1# set type externaluser@R1# set peer-as 65500user@R1# set neighbor 1.1.0.1user@R1# set neighbor 1.1.1.1
Enable multipath BGP between Device R0 and Device R1.

[edit protocols bgp group ext]user@R1# set multipath
Configure a routing policy that enables a single-hop external BGP peer (Device R1) to accept the remote next-hop 1.1.10.10 for the route to the 1.1.230.0/23 network.

[edit policy-options policy-statement agg_route term 1]user@R1# set from protocol bgpuser@R1# set from route-filter 1.1.230.0/23 exactuser@R1# set then next-hop 1.1.10.10user@R1# set then accept
Import the agg_route policy into the routing table on Device R1.

[edit protocols bgp group ext]user@R1# set import agg_route
Configure the autonomous system (AS) number.

[edit routing-options]user@R1# set autonomous-system 65000

Results

user@R1# show interfaces

fe-1/2/0 {unit 3 {family inet {address 1.1.0.2/30;}}}

fe-1/2/1 {unit 4 {family inet {address 1.12.0.1/30;}}}

fe-1/2/2 {unit 5 {family inet {address 1.1.1.2/30;}}}

lo0 {unit 2 {family inet {address 10.255.71.24/32;}}}

user@R1# show policy-options

policy-statement agg_route {term 1 {from {protocol bgp;route-filter 1.1.230.0/23 exact;}then {next-hop 1.1.10.10;accept;}}}

user@R1# show protocols

bgp {accept-remote-nexthop;group ext {type external;import agg_route;peer-as 65500;multipath;neighbor 1.1.0.1;neighbor 1.1.1.1;}group int {type internal;local-address 10.255.71.24;neighbor 10.255.14.177;}}

ospf {area 0.0.0.0 {interface fe-1/2/1.4;interface 10.255.71.24;}}

user@R1# show routing-optionsautonomous-system 65000;

If you are done configuring the device, enter commit from configuration mode.

Configuring Device R2

Step-by-Step Procedure

To configure Device R2:

Configure the interfaces.

[edit interfaces fe-1/2/0 unit 6]user@R2# set family inet address 1.12.0.2/30
[edit interfaces lo0 unit 3]user@R2# set family inet address 10.255.14.177/32
Configure OSPF.

[edit protocols ospf area 0.0.0.0]user@R2# set interface fe-1/2/0.6user@R2# set interface 10.255.14.177
Configure IBGP.

[edit protocols bgp group int]user@R2# set type internaluser@R2# set local-address 10.255.14.177user@R2# set neighbor 10.255.71.24
Configure the autonomous system (AS) number.

[edit routing-options]user@R1# set autonomous-system 65000

Results

From configuration mode, confirm your configuration by entering the show interfaces, show protocols, and show routing-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

user@R2# show interfaces

fe-1/2/0 {unit 6 {family inet {address 1.12.0.2/30;}}}

lo0 {unit 3 {family inet {address 10.255.14.177/32;}}}

user@R2# show protocols

bgp {group int {type internal;local-address 10.255.14.177;neighbor 10.255.71.24;}}

ospf {area 0.0.0.0 {interface fe-1/2/0.6;interface 10.255.14.177;}}

user@R2# show routing-optionsautonomous-system 65000;

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Verifying That the Multipath Route with the Indirect Next Hop Is in the Routing Table

Purpose

Verify that Device R1 has a route to the 1.1.230.0/23 network.

Action

From operational mode, enter the show route 1.1.230.0 extensive command.

user@R1> show route 1.1.230.0 extensive

inet.0: 11 destinations, 13 routes (11 active, 0 holddown, 0 hidden)
Restart Complete
1.1.230.0/23 (2 entries, 1 announced)
TSI:
KRT in-kernel 1.1.230.0/23 -> {indirect(262142)}
Page 0 idx 1 Type 1 val 9168f6c
    Nexthop: 1.1.10.10
    Localpref: 100
    AS path: [65000] 65500 I
    Communities:
Path 1.1.230.0 from 1.1.0.1 Vector len 4.  Val: 1
        *BGP    Preference: 170/-101
                Next hop type: Indirect
                Address: 0x90c44d8
                Next-hop reference count: 4
                Source: 1.1.0.1
                Next hop type: Router, Next hop index: 262143
                Next hop: 1.1.0.1 via fe-1/2/0.3, selected
                Next hop: 1.1.1.1 via fe-1/2/2.5
                Protocol next hop: 1.1.10.10
                Indirect next hop: 91c0000 262142
                State: 
                Local AS: 65000 Peer AS: 65500
                Age: 2:55:31    Metric2: 0 
                Task: BGP_65500.1.1.0.1+64631
                Announcement bits (3): 2-KRT 3-BGP_RT_Background 4-Resolve tree 1 
                AS path: 65500 I
                Accepted Multipath
                Localpref: 100
                Router ID: 10.255.14.179
                Indirect next hops: 1
                        Protocol next hop: 1.1.10.10
                        Indirect next hop: 91c0000 262142
                        Indirect path forwarding next hops: 2
                                Next hop type: Router
                                Next hop: 1.1.0.1 via fe-1/2/0.3
                                Next hop: 1.1.1.1 via fe-1/2/2.5
                        1.1.10.10/32 Originating RIB: inet.0
                          Node path count: 1
                          Forwarding nexthops: 2
                                Nexthop: 1.1.0.1 via fe-1/2/0.3
                                Nexthop: 1.1.1.1 via fe-1/2/2.5
         BGP    Preference: 170/-101
                Next hop type: Indirect
                Address: 0x90c44d8
                Next-hop reference count: 4
                Source: 1.1.1.1
                Next hop type: Router, Next hop index: 262143
                Next hop: 1.1.0.1 via fe-1/2/0.3, selected
                Next hop: 1.1.1.1 via fe-1/2/2.5
                Protocol next hop: 1.1.10.10
                Indirect next hop: 91c0000 262142
                State: 
                Inactive reason: Not Best in its group - Update source
                Local AS: 65000 Peer AS: 65500
                Age: 2:55:27    Metric2: 0 
                Task: BGP_65500.1.1.1.1+53260
                AS path: 65500 I
                Accepted
                Localpref: 100
                Router ID: 10.255.14.179
                Indirect next hops: 1
                        Protocol next hop: 1.1.10.10
                        Indirect next hop: 91c0000 262142
                        Indirect path forwarding next hops: 2
                                Next hop type: Router
                                Next hop: 1.1.0.1 via fe-1/2/0.3
                                Next hop: 1.1.1.1 via fe-1/2/2.5
                        1.1.10.10/32 Originating RIB: inet.0
                          Node path count: 1
                          Forwarding nexthops: 2
                                Nexthop: 1.1.0.1 via fe-1/2/0.3
                                Nexthop: 1.1.1.1 via fe-1/2/2.5

Meaning

The output shows that Device R1 has a route to the 1.1.230.0 network with the multipath feature enabled (Accepted Multipath). The output also shows that the route has an indirect next hop of 1.1.10.10.

Deactivating and Reactivating the accept-remote-nexthop Statement

Purpose

Make sure that the multipath route with the indirect next hop is removed from the routing table when you deactivate the accept-remote-nexthopstatement.

Action

From configuration mode, enter the deactivate protocols bgp accept-remote-nexthop command.

user@R1# deactivate protocols bgp accept-remote-nexthop

user@R1# commit
From operational mode, enter the show route 1.1.230.0 command.

user@R1> show route 1.1.230.0
From configuration mode, reactivate the statement by entering the activate protocols bgp accept-remote-nexthop command.

user@R1# activate protocols bgp accept-remote-nexthop

user@R1# commit

From operational mode, reenter the show route 1.1.230.0 command.

user@R1> show route 1.1.230.0

inet.0: 11 destinations, 13 routes (11 active, 0 holddown, 0 hidden)
Restart Complete
+ = Active Route, - = Last Active, * = Both

1.1.230.0/23       *[BGP/170] 03:13:19, localpref 100
                      AS path: 65500 I
                    > to 1.1.0.1 via fe-1/2/0.3
                      to 1.1.1.1 via fe-1/2/2.5
                    [BGP/170] 03:13:15, localpref 100, from 1.1.1.1
                      AS path: 65500 I
                    > to 1.1.0.1 via fe-1/2/0.3
                      to 1.1.1.1 via fe-1/2/2.5

Meaning

When the accept-remote-nexthop statement is deactivated, the multipath route to the 1.1.230.0 network is removed from the routing table .

2013-02-21T22:19:00.001+07:00

Configuration

CLI Quick Configuration

set protocols bgp group external type externalset protocols bgp group external peer-as 65001set protocols bgp group external multipathset protocols bgp group external neighbor 10.0.1.1set protocols bgp group external neighbor 10.0.0.2set policy-options policy-statement loadbal from route-filter 10.0.0.0/16 orlongerset policy-options policy-statement loadbal then load-balance per-packetset routing-options forwarding-table export loadbalset routing-options autonomous-system 65000

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure the BGP peer sessions:

Configure the BGP group.

[edit protocols bgp group external]user@R1# set type externaluser@R1# set peer-as 65001user@R1# set neighbor 10.0.1.1user@R1# set neighbor 10.0.0.2
Enable the BGP group to use multiple paths.

[edit protocols bgp group external]user@R1# set multipath
Configure the load-balancing policy.

[edit policy-options policy-statement loadbal]user@R1# set from route-filter 10.0.0.0/16 orlongeruser@R1# set then load-balance per-packet
Apply the load-balancing policy.

[edit routing-options]user@R1# set forwarding-table export loadbal
Configure the local autonomous system (AS) number.

[edit routing-options]user@R1# set autonomous-system 65000

Results

From configuration mode, confirm your configuration by entering the show protocols, show policy-options, and show routing-optionscommands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

[edit]user@R1# show protocols

bgp {group external {type external;peer-as 65001;multipath;neighbor 10.0.1.1;neighbor 10.0.0.2;}}

[edit]user@R1# show policy-options

policy-statement loadbal {from {route-filter 10.0.0.0/16 orlonger;}then {load-balance per-packet;}}

[edit]user@R1# show routing-optionsautonomous-system 65000;

forwarding-table {export loadbal;}

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly:

Verifying Routes

Purpose

Verify that routes are learned from both routers in the neighboring AS.

Action

From operational mode, run the show route command.

user@R1> show route 10.0.2.0

inet.0: 12 destinations, 15 routes (12 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.0.2.0/30        *[BGP/170] 03:12:32, localpref 100
                      AS path: 65001 I
                      to 10.0.1.1 via ge-1/2/0.0
                    &gt; to 10.0.0.2 via ge-1/2/1.0
                    [BGP/170] 03:12:32, localpref 100
                      AS path: 65001 I
                    &gt; to 10.0.1.1 via ge-1/2/0.0

user@R1> show route 10.0.2.0 detail

inet.0: 12 destinations, 15 routes (12 active, 0 holddown, 0 hidden)
10.0.2.0/30 (2 entries, 1 announced)
        *BGP    Preference: 170/-101
                Next hop type: Router, Next hop index: 262142
                Next-hop reference count: 3
                Source: 10.0.0.2
                Next hop: 10.0.1.1 via ge-1/2/0.0
                Next hop: 10.0.0.2 via ge-1/2/1.0, selected
                State: 
                Local AS: 65000 Peer AS: 65001
                Age: 3:18:30 
                Task: BGP_65001.10.0.0.2+55402
                Announcement bits (1): 2-KRT 
                AS path: 65001 I
                Accepted Multipath
                Localpref: 100
                Router ID: 192.168.2.1
         BGP    Preference: 170/-101
                Next hop type: Router, Next hop index: 602
                Next-hop reference count: 5
                Source: 10.0.1.1
                Next hop: 10.0.1.1 via ge-1/2/0.0, selected
                State: 
                Inactive reason: Not Best in its group - Active preferred
                Local AS: 65000 Peer AS: 65001
                Age: 3:18:30 
                Task: BGP_65001.10.0.1.1+53135
                AS path: 65001 I
                Accepted
                Localpref: 100
                Router ID: 192.168.3.1

Meaning

The active path, denoted with an asterisk (*), has two next hops: 10.0.1.1 and 10.0.0.2 to the 10.0.2.0 destination. The 10.0.1.1 next hop is copied from the inactive path to the active path.

Verifying Forwarding

Purpose

Verify that both next hops are installed in the forwarding table.

Action

From operational mode, run the show route forwarding-table command.

user@R1> show route forwarding-table destination 10.0.2.0

Routing table: default.inet
Internet:
Destination        Type RtRef Next hop           Type Index NhRef Netif
10.0.2.0/30        user     0                    ulst 262142     2
                              10.0.1.1           ucst   602     5 ge-1/2/0.0
                              10.0.0.2           ucst   522     6 ge-1/2/1.0

Topologi jaringan dan desain htb

2013-02-18T15:55:00.001+07:00

Kriteria dalam pembuatan traffic control ini:

Traffic control hanya untuk trafik eggress dari device lan (eth0) dan wan (eth1).
Trafik dari local area network (lan) ke router dan sebaliknya tidak melalui traffic control.
Trafik dari internet ke lan (downstream) akan melalui traffic control, kecuali trafik dari port 80 (www) yang mempunyai tanda TOS 0×30 atau DSCP 12 (cache hit).
Setiap pc atau anggota lan akan memiliki class dan qdisc sendiri-sendiri.
Tidak ada class default untuk handle traffic untuk object yang tidak didefinisikan atau unclassified traffic.

Catatan: trafik ke internet port 80 akan melalui server proxy remote secara transparent.

Topologi network

Network LAN : 192.168.41.0/24
IP Router   : 192.168.41.1
IP Client   : 192.168.41.2 - 192.168.41.14
Device LAN  : eth0
Device WAN  : eth1

Alokasi bandwidth internet downstream

Root
  - Ceiling  : 2048kbps
  - Rate     : 2048kbps
Client
  - Ceiling  : 512kbps
  - Rate     : 512bps

Alokasi bandwidth internet upstream

Root
  - Ceiling  : 256kbps
  - Rate     : 256kbps
Client
  - Ceiling  : 256kbps
  - Rate     : 256kbps

Source Code tc-3.sh

001#!/bin/sh

002

003# File: tc-3.sh

004#

005# Deskripsi: Trafik control untuk membatasi downstream dan upstream dengan htb

006#

007# Kriteria:

008#   1. Traffic control hanya untuk trafik eggress dari device lan (eth0) dan wan (eth1).

009#   2. Trafik dari local area network (lan) ke router dan sebaliknya tidak melalui traffic control.

010#   3. Trafik dari internet ke lan atau downstream akan melalui traffic control, kecuali trafik

011#      dari port 80 (www) yang mempunyai tanda TOS 0×30 atau DSCP 12 (cache hit).

012#   4. Setiap pc atau anggota lan akan memiliki class dan qdisc sendiri-sendiri.

013#   5. Tidak ada class default untuk handle traffic untuk object yang tidak didefinisikan atau unclassified traffic.

014#

015# Created by Arief Yudhawarman (2009)

016# Email: awarmanff at yahoo.com

017#

018

019IPTABLES="/usr/sbin/iptables"

020TC="/sbin/tc"

021

022# parameter

023LAN="eth0"

024WAN="eth1"

025

026# Bandwidth

027# (kbps)

028# ROOT CLASS

029# Downstream

030RATEDW=384

031CEILDW=384

032# Upstream

033RATEUP=128

034CEILUP=128

035#

036# SUB CLASS

037# Downstream

038RATESUBDW=16

039CEILSUBDW=384

040# Upstream

041RATESUBUP=16

042CEILSUBUP=128

043

044# parameter

045LAN="eth0"

046WAN="eth1"

047

048#

049# IPTABLES

050# PACKET MANGLE

051#

052

053#

054# FLUSH table

055#

056$IPTABLES -F -t mangle

057

058#

059# PREROUTING

060#

061# Incoming traffic to WAN

062# 

063# packets cache hit with dscp 12 (tos 30) set mark to 5

064iptables -A PREROUTING -t mangle -i $WAN -p tcp --sport 80 -m dscp --dscp 12 -j MARK --set-mark 5

065iptables -A PREROUTING -t mangle -i $WAN -p tcp --sport 80 -m dscp --dscp 12 -j RETURN

066# others set mark to 6

067iptables -A PREROUTING -t mangle -i $WAN -j MARK --set-mark 6

068#

069# Incoming traffic to LAN

070#

071# mark packets to 7

072iptables -A PREROUTING -t mangle -i $LAN -j MARK --set-mark 7

073

074#

075# FORWARD

076#

077# Incoming traffic from outside (wan) forwarded to inside (lan)

078#

079# catch cache hit with fwmark 5 and set mark to 0x212

080iptables -A FORWARD -t mangle -p tcp -m mark --mark 5 -j MARK --set-mark 0x212

081#

082# mark packets based on destination ip

083for i in `seq 2 14`

084do

085  j=$((i+10))

086  iptables -A FORWARD -t mangle -d 192.168.41.$i -m mark --mark 6 -j MARK --set-mark $j

087done

088#

089# Incoming traffic from inside (lan) forwarded to outside (wan)

090#

091# catch fwmark 7 and set mark according to source ip

092for i in `seq 2 14`

093do

094  j=$((i+20))

095  iptables -A FORWARD -t mangle -s 192.168.41.$i -m mark --mark 7 -j MARK --set-mark $j

096done

097

098# 

099# TRAFFIC CONTROL

100#

101

102#

103# DOWNSTREAM

104#

105# Create qdisc & class

106tc qdisc del dev $LAN root

107tc qdisc add dev $LAN root handle 1:0 htb

108tc class add dev $LAN parent 1:0 classid 1:2 htb rate ${RATEDW}kbit ceil ${CEILDW}kbit quantum 1500 prio 6

109

110#

111# Sub class of parent 1:2

112#

113# IP Clients 192.168.41.2 - 192.168.41.14

114for i in `seq 2 14`

115do

116  j=$((i+10))

117  # create class per ip address

118  tc class add dev $LAN parent 1:1 classid 1:$j htb rate ${RATESUBDW}kbit \

119     ceil ${CEILSUBDW}kbit quantum 1500 prio 6

120  # attach qdisc

121  tc qdisc add dev $LAN parent 1:$j handle $j sfq perturb 10

122done

123

124#

125# Filter traffic

126#

127# IP Clients 192.168.41.2 - 192.168.41.14

128for i in `seq 2 14`

129do

130  j=$((i+10))

131  # Attach filter to flowid with specified handle (packet mark)

132  tc filter add dev $LAN protocol ip parent 1:0 prio 6 handle $j fw flowid 1:$j

133done

134

135#

136# UPSTREAM

137#

138# Create qdisc & class

139tc qdisc del dev $WAN root

140tc qdisc add dev $WAN root handle 1:0 htb

141tc class add dev $WAN parent 1:0 classid 1:2 htb rate ${RATEUP}kbit ceil ${CEILUP}kbit quantum 1500 prio 6

142

143#

144# Sub class of parent 1:2

145#

146# IP Clients 192.168.41.2 - 192.168.41.14

147for i in `seq 2 14`

148do

149  j=$((i+20))

150  # create class per ip address

151  tc class add dev $WAN parent 1:2 classid 1:$j htb rate ${RATESUBUP}kbit \

152     ceil ${CEILSUBUP}kbit quantum 1500 prio 6

153  # attach qdisc

154  tc qdisc add dev $WAN parent 1:$j handle $j sfq perturb 10

155done

156

157#

158# Filter traffic

159#

160# IP Clients 192.168.41.2 - 192.168.41.14

161for i in `seq 2 14`

162do

163  j=$((i+20))

164  # Attach filter to flowid with specified handle (packet mark)

165  tc filter add dev $WAN protocol ip parent 1:0 prio 6 handle $j fw flowid 1:$j

166done

Untuk memahami aliran paket atau traffic flow dalam router silahkan simak gambar di bawah:

Sumber: Manual mikrotik refman2.9.pdf.

Analisa paket mangle dan traffic control untuk trafik downstream
Perhatikan baris-baris yang tercetak tebal.

tc -s -d qdisc show dev eth0; iptables -L FORWARD -t mangle -nv| head -n 16

qdisc htb 1: r2q 10 default 0 direct_packets_stat 6144 ver 3.17
 Sent 31783127 bytes 49709 pkts (dropped 0, overlimits 5839) 
qdisc sfq 12: parent 1:12 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 5118517 bytes 15858 pkts (dropped 0, overlimits 0) 
qdisc sfq 13: parent 1:13 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 81859 bytes 206 pkts (dropped 0, overlimits 0) 
qdisc sfq 14: parent 1:14 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 6626893 bytes 6817 pkts (dropped 0, overlimits 0) 
qdisc sfq 15: parent 1:15 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 16: parent 1:16 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 17: parent 1:17 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 11525 bytes 45 pkts (dropped 0, overlimits 0) 
qdisc sfq 18: parent 1:18 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 8475558 bytes 11965 pkts (dropped 0, overlimits 0) 
qdisc sfq 19: parent 1:19 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 3277886 bytes 4621 pkts (dropped 0, overlimits 0) 
qdisc sfq 20: parent 1:20 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 21: parent 1:21 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 4558 bytes 23 pkts (dropped 0, overlimits 0) 
qdisc sfq 22: parent 1:22 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 23: parent 1:23 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 24: parent 1:24 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 3012356 bytes 4030 pkts (dropped 0, overlimits 0) 
Chain FORWARD (policy ACCEPT 1676K packets, 904M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 4921 4911K MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match 0x5 MARK set 0x212 
15858 4897K MARK       all  --  *      *       0.0.0.0/0            192.168.41.2        MARK match 0x6 MARK set 0xc 
  206 78975 MARK       all  --  *      *       0.0.0.0/0            192.168.41.3        MARK match 0x6 MARK set 0xd 
 6817 6531K MARK       all  --  *      *       0.0.0.0/0            192.168.41.4        MARK match 0x6 MARK set 0xe 
    0     0 MARK       all  --  *      *       0.0.0.0/0            192.168.41.5        MARK match 0x6 MARK set 0xf 
    0     0 MARK       all  --  *      *       0.0.0.0/0            192.168.41.6        MARK match 0x6 MARK set 0x10 
   45 10895 MARK       all  --  *      *       0.0.0.0/0            192.168.41.7        MARK match 0x6 MARK set 0x11 
11966 8308K MARK       all  --  *      *       0.0.0.0/0            192.168.41.8        MARK match 0x6 MARK set 0x12 
 4621 3213K MARK       all  --  *      *       0.0.0.0/0            192.168.41.9        MARK match 0x6 MARK set 0x13 
    0     0 MARK       all  --  *      *       0.0.0.0/0            192.168.41.10       MARK match 0x6 MARK set 0x14 
   23  4236 MARK       all  --  *      *       0.0.0.0/0            192.168.41.11       MARK match 0x6 MARK set 0x15 
    0     0 MARK       all  --  *      *       0.0.0.0/0            192.168.41.12       MARK match 0x6 MARK set 0x16 
    0     0 MARK       all  --  *      *       0.0.0.0/0            192.168.41.13       MARK match 0x6 MARK set 0x17 
 4030 2956K MARK       all  --  *      *       0.0.0.0/0            192.168.41.14       MARK match 0x6 MARK set 0x18

Analisa paket mangle dan traffic control untuk trafik upstream
Perhatikan baris-baris yang tercetak tebal.

tc -s -d qdisc show dev eth1; iptables -L FORWARD -t mangle -nv

qdisc htb 1: r2q 10 default 0 direct_packets_stat 191743 ver 3.17
 Sent 45055014 bytes 244485 pkts (dropped 0, overlimits 4314) 
qdisc sfq 22: parent 1:22 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 3539507 bytes 16353 pkts (dropped 0, overlimits 0) 
qdisc sfq 23: parent 1:23 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 55439 bytes 324 pkts (dropped 0, overlimits 0) 
qdisc sfq 24: parent 1:24 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 1213280 bytes 6968 pkts (dropped 0, overlimits 0)
qdisc sfq 25: parent 1:25 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 26: parent 1:26 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 27: parent 1:27 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 9806 bytes 56 pkts (dropped 0, overlimits 0) 
qdisc sfq 28: parent 1:28 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 2949492 bytes 15990 pkts (dropped 0, overlimits 0) 
qdisc sfq 29: parent 1:29 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 1039116 bytes 6678 pkts (dropped 0, overlimits 0) 
qdisc sfq 30: parent 1:30 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 31: parent 1:31 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 5156 bytes 39 pkts (dropped 0, overlimits 0) 
qdisc sfq 32: parent 1:32 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 33: parent 1:33 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 
qdisc sfq 34: parent 1:34 limit 128p quantum 1514b flows 128/1024 perturb 10sec 
 Sent 1071110 bytes 6334 pkts (dropped 0, overlimits 0)
Chain FORWARD (policy ACCEPT 1693K packets, 912M bytes)
 pkts bytes target     prot opt in     out     source               destination         
......
16471 3316K MARK       all  --  *      *       192.168.41.2         0.0.0.0/0           MARK match 0x7 MARK set 0x16 
  331 51239 MARK       all  --  *      *       192.168.41.3         0.0.0.0/0           MARK match 0x7 MARK set 0x17 
 7154 1125K MARK       all  --  *      *       192.168.41.4         0.0.0.0/0           MARK match 0x7 MARK set 0x18 
    0     0 MARK       all  --  *      *       192.168.41.5         0.0.0.0/0           MARK match 0x7 MARK set 0x19 
    1    40 MARK       all  --  *      *       192.168.41.6         0.0.0.0/0           MARK match 0x7 MARK set 0x1a 
   56  9022 MARK       all  --  *      *       192.168.41.7         0.0.0.0/0           MARK match 0x7 MARK set 0x1b 
17496 2811K MARK       all  --  *      *       192.168.41.8         0.0.0.0/0           MARK match 0x7 MARK set 0x1c 
 7498  986K MARK       all  --  *      *       192.168.41.9         0.0.0.0/0           MARK match 0x7 MARK set 0x1d 
    0     0 MARK       all  --  *      *       192.168.41.10        0.0.0.0/0           MARK match 0x7 MARK set 0x1e 
   39  4610 MARK       all  --  *      *       192.168.41.11        0.0.0.0/0           MARK match 0x7 MARK set 0x1f 
    0     0 MARK       all  --  *      *       192.168.41.12        0.0.0.0/0           MARK match 0x7 MARK set 0x20 
    0     0 MARK       all  --  *      *       192.168.41.13        0.0.0.0/0           MARK match 0x7 MARK set 0x21 
 6913 1019K MARK       all  --  *      *       192.168.41.14        0.0.0.0/0           MARK match 0x7 MARK set 0x22

Hal yang menarik di sini adalah

Semua paket yang lewat chain FORWARD table mangle dengan tujuan lan mempunyai jumlah paket yang sama dengan yang tercatat di qdisc dev eth0 (lan).
Semua paket yang lewat chain FORWARD table mangle dengan tujuan wan mempunyai jumlah paket yang senantiasa sama atau lebih besar dengan yang tercatat di qdisc dev eth1 (wan). Hal ini karena ada beberapa paket yang di-DROP di chain FORWARD table default. Terlihat pada gambar trafik flow di atas, setelah paket melewati chain FORWARD table mangle selanjutnya akan masuk chain FORWARD table filter.
Jika ingin membatasi trafik upstream dari lan tanpa melewati chain FORWARD, maka ini bisa dilakukan di chain PREROUTING table mangle.

BGP dengan Mikrotik RouterOS + Juniper Olive

2013-02-18T15:42:00.001+07:00

Jaringan pada gambar di atas terdiri atas 4 buah router sebagai berikut :

Palembang : MikroTik RouterOS 3.13
Prabumulih : Juniper Olive 8.5R1
Muaraenim : MikroTik RouterOS 3.13
Baturaja : MikroTik RouterOS 3.13

Router Palembang

Pertama kita lakukan konfigurasi pada router Palembang. Mulai dengan mengganti hostname,

> /system identity set name=Palembang

Lalu set alamat IP,

> /ip address add interface=ether1 address=192.168.100.1/30
> /ip address add interface=ether2 address=192.168.100.13/30
> /ip address add interface=ether3 address=10.10.0.1/16

Set router AS number router ID,

> /routing bgp instance set default as=64501 router-id=10.10.0.1

Dan terakhir set network yang routing-nya akan di-advertise oleh BGP dan dua buah peering dengan router Prabumulih (AS 64502) dan Baturaja (AS 64504),

> /routing bgp network add network=10.10.0.0/16
> /routing bgp peer add name=as_64502 remote-address=192.168.100.2 remote-as=64502
> /routing bgp peer add name=as_64504 remote-address=192.168.100.14 remote-as=64504

Router Prabumulih

Setting dilakukan pada configuration-mode, pertama ubah hostname

[edit]
# set system host-name Prabumulih

Lalu set alamat IP,

[edit]
# set interfaces em0 unit 0 family inet address 192.168.100.2/30
# set interfaces em1 unit 0 family inet address 192.168.100.5/30
# set interfaces em2 unit 0 family inet address 10.20.0.1/16

Set router AS number router ID,

[edit]
# set routing-options autonomous-system 64502
# set routing-options router-id 10.20.0.1

Set peering dengan router Palembang (AS 64501) dan Muaraenim (AS 64503)


[edit]
# set protocol bgp group as_64501 type external
# set protocol bgp group as_64501 neighbor 192.168.100.1
# set protocol bgp group as_64501 peer-as 64501

# set protocol bgp group as_64503 type external
# set protocol bgp group as_64503 neighbor 192.168.100.6
# set protocol bgp group as_64503 peer-as 64503

Buat export policy,

[edit policy-options]
# set policy-statement as_all_export term 1 from protocol direct
# set policy-statement as_all_export term 1 from route-filter 10.20.0.0/16 exact
# set policy-statement as_all_export term 1 then accept

Terapkan policy pada semua BGP group,

[edit]
# set protocol bgp group as_64501 export as_all_export
# set protocol bgp group as_64503 export as_all_export

Dan lakukan commit,

[edit]
# commit

Router Muaraenim

Konfigurasi untuk router Muaraenim sebagai berikut:

/system identity set name=Muaraenim

/ip address add interface=ether1 address=192.168.100.6/30
/ip address add interface=ether2 address=192.168.100.10/30
/ip address add interface=ether3 address=10.30.0.1/16

/routing bgp instance set default as=64503 router-id=10.30.0.1
/routing bgp network add network=10.30.0.0/16

/routing bgp peer add name=as_64502 remote-address=192.168.100.5 remote-as=64502
/routing bgp peer add name=as_64504 remote-address=192.168.100.9 remote-as=64504

Router Baturaja

Konfigurasi untuk router Baturaja sebagai berikut:

/system identity set name=Baturaja

/ip address add interface=ether1 address=192.168.100.9/30
/ip address add interface=ether2 address=192.168.100.14/30
/ip address add interface=ether3 address=10.40.0.1/16

/routing bgp instance set default as=64504 router-id=10.40.0.1
/routing bgp network add network=10.40.0.0/16

/routing bgp peer add name=as_64501 remote-address=192.168.100.1 remote-as=64501
/routing bgp peer add name=as_64503 remote-address=192.168.100.10 remote-as=64503

Check & recheck

Pada MikroTik RouterOS, cek status BGP peering,

> /routing bgp peering status

lalu cek routing table,

> /ip route print

lakukan ping,

[praban@Palembang] > /ping 10.20.0.1 src-address=10.10.0.1

dan traceroute,

[praban@Palembang] > /traceroute 10.20.0.1 src-address=10.10.0.1

Untuk Juniper Olive, cek status BGP peering,

> show bgp neighbor

cek routing table,

> show route

lakukan ping,

praban@Prabumulih> ping 10.10.0.1 source 10.20.0.1

dan traceroute,

praban@Prabumulih> traceroute 10.10.0.1 source 10.20.0.1

Virtualization With Xen On CentOS 6.3 (x86_64) (Paravirtualization & Hardware Virtualization)

2013-02-17T13:44:00.002+07:00

This tutorial provides step-by-step instructions on how to install Xen (version 4.1.x) on a CentOS 6.3 (x86_64) system.

Xen lets you create guest operating systems (*nix operating systems like Linux and FreeBSD), so called "virtual machines" or domUs, under a host operating system (dom0). Using Xen you can separate your applications into different virtual machines that are totally independent from each other (e.g. a virtual machine for a mail server, a virtual machine for a high-traffic web site, another virtual machine that serves your customers' web sites, a virtual machine for DNS, etc.), but still use the same hardware. This saves money, and what is even more important, it's more secure. If the virtual machine of your DNS server gets hacked, it has no effect on your other virtual machines. Plus, you can move virtual machines from one Xen server to the next one.

I will use CentOS 6.3 (x86_64) for both the host OS (dom0) and the guest OS (domU).

This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web.

This document comes without warranty of any kind! I want to say that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!

1 Preliminary Note

This guide will explain how to set up image-based virtual machines and also LVM-based virtual machines.

Make sure that SELinux is disabled or permissive:

vi /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
#       targeted - Only targeted network daemons are protected.
#       strict - Full SELinux protection.
SELINUXTYPE=targeted

If you had to modify /etc/sysconfig/selinux, please reboot the system:

reboot

2 Creating A Network Bridge

We need to set up a network bridge on our server so that our virtual machines can be accessed from other hosts as if they were physical systems in the network.

To do this, we install the package bridge-utils...

yum install bridge-utils

... and configure a bridge.

Create the file /etc/sysconfig/network-scripts/ifcfg-br0 (please use the IPADDR, PREFIX, GATEWAY, DNS1 and DNS2 values from the /etc/sysconfig/network-scripts/ifcfg-eth0 file); make sure you use TYPE=Bridge, not TYPE=Ethernet:

vi /etc/sysconfig/network-scripts/ifcfg-br0

DEVICE="br0"
NM_CONTROLLED="yes"
ONBOOT=yes
TYPE=Bridge
BOOTPROTO=none
IPADDR=192.168.0.100
PREFIX=24
GATEWAY=192.168.0.1
DNS1=8.8.8.8
DNS2=8.8.4.4
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
NAME="System bridge0"

Modify /etc/sysconfig/network-scripts/ifcfg-eth0 as follows (comment out BOOTPROTO, IPADDR, PREFIX, GATEWAY, DNS1, and DNS2 and add BRIDGE=br0):

vi /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE="eth0"
#BOOTPROTO=none
NM_CONTROLLED="yes"
ONBOOT=yes
TYPE="Ethernet"
UUID="73cb0b12-1f42-49b0-ad69-731e888276ff"
HWADDR=00:1E:90:F3:F0:02
#IPADDR=192.168.0.100
#PREFIX=24
#GATEWAY=192.168.0.1
#DNS1=8.8.8.8
#DNS2=8.8.4.4
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
NAME="System eth0"
BRIDGE=br0

Restart the network...

/etc/init.d/network restart

... and run

ifconfig

It should now show the network bridge (br0):

[root@server1 ~]# ifconfig
br0       Link encap:Ethernet  HWaddr 00:1E:90:F3:F0:02
          inet addr:192.168.0.100  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::21e:90ff:fef3:f002/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:27 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:460 (460.0 b)  TX bytes:2298 (2.2 KiB)
eth0      Link encap:Ethernet  HWaddr 00:1E:90:F3:F0:02
          inet6 addr: fe80::21e:90ff:fef3:f002/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:18455 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11861 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:26163057 (24.9 MiB)  TX bytes:1100370 (1.0 MiB)
          Interrupt:25 Base address:0xe000
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:5 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2456 (2.3 KiB)  TX bytes:2456 (2.3 KiB)
[root@server1 ~]#

3 Installing Xen

First check if your CPU supports hardware virtualization - if this is the case, the command

egrep '(vmx|svm)' --color=always /proc/cpuinfo

should display something, e.g. like this:

[root@server1 ~]# egrep '(vmx|svm)' --color=always /proc/cpuinfo
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr
      pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall
nx mmxext fxsr_opt rdtscp lm 3dnowext 3dnow pni cx16 lahf_lm
cmp_legacy svm extapic cr8_legacy misalignsse
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr
pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall
nx mmxext fxsr_opt rdtscp lm 3dnowext 3dnow pni cx16 lahf_lm
cmp_legacy svm extapic cr8_legacy misalignsse
[root@server1 ~]#

If nothing is displayed, then your processor doesn't support hardware virtualization. This means you can use only paravirtualization with Xen, but not hardware virtualization.

As CentOS 6 is based on RedHat 6, and RedHat has dropped support for Xen in version 6, we need to get Xen from a third-party repository. We can enable the repo as follows:

yum install http://au1.mirror.crc.id.au/repo/kernel-xen-release-6-3.noarch.rpm

To install Xen, we now simply run

yum install kernel-xen xen

This installs Xen and a Xen kernel on our CentOS system.

Before we can boot the system with the Xen kernel, please check your GRUB bootloader configuration. We open /boot/grub/menu.lst:

vi /boot/grub/menu.lst

The first listed kernel should be the Xen kernel that you've just installed:

[...]
title CentOS (2.6.32.57-2.el6xen.x86_64)
        root (hd0,0)
        kernel /vmlinuz-2.6.32.57-2.el6xen.x86_64 ro root=/dev/mapper/vg_server1-LogVol00 rd_NO_LUKS LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto  KEYBOARDTYPE=pc KEYTABLE=de rd_LVM_LV=vg_server1/LogVol01 rd_LVM_LV=vg_server1/LogVol00 rd_NO_DM rhgb quiet
        initrd /initramfs-2.6.32.57-2.el6xen.x86_64.img
[...]

We need to modify that section so that the Xen hypervisor gets loaded first. In the kernel /vmlinuz... line, replace the first word kernel with module. Do the same in the next line - replace the first word initrd with module in the initrd /initramfs... line. Then add the line kernel /xen.gz dom0_mem=1024M cpufreq=xen dom0_max_vcpus=1 dom0_vcpus_pin after the root line and before the first module line (if you have more than one CPU core, you can specify another number than 1 for dom0_max_vcpus). The final kernel section should look like this:

[...]
title CentOS (2.6.32.57-2.el6xen.x86_64)
        root (hd0,0)
        kernel /xen.gz dom0_mem=1024M cpufreq=xen dom0_max_vcpus=1 dom0_vcpus_pin
        module /vmlinuz-2.6.32.57-2.el6xen.x86_64 ro root=/dev/mapper/vg_server1-LogVol00 rd_NO_LUKS LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto  KEYBOARDTYPE=pc KEYTABLE=de rd_LVM_LV=vg_server1/LogVol01 rd_LVM_LV=vg_server1/LogVol00 rd_NO_DM rhgb quiet
        module /initramfs-2.6.32.57-2.el6xen.x86_64.img
[...]

Change the value of default to 0 (so that the first kernel (the Xen kernel) will be booted by default):

[...]
default=0
[...]

The complete /boot/grub/menu.lst should look something like this:

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/mapper/vg_server1-LogVol00
#          initrd /initrd-[generic-]version.img
#boot=/dev/sde
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.32.57-2.el6xen.x86_64)
        root (hd0,0)
        kernel /xen.gz dom0_mem=1024M cpufreq=xen dom0_max_vcpus=1 dom0_vcpus_pin
        module /vmlinuz-2.6.32.57-2.el6xen.x86_64 ro root=/dev/mapper/vg_server1-LogVol00 rd_NO_LUKS LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto  KEYBOARDTYPE=pc KEYTABLE=de rd_LVM_LV=vg_server1/LogVol01 rd_LVM_LV=vg_server1/LogVol00 rd_NO_DM rhgb quiet
        module /initramfs-2.6.32.57-2.el6xen.x86_64.img
title CentOS (2.6.32-279.el6.x86_64)
        root (hd0,0)
        kernel /vmlinuz-2.6.32-279.el6.x86_64 ro root=/dev/mapper/vg_server1-LogVol00 rd_NO_LUKS LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto  KEYBOARDTYPE=pc KEYTABLE=de rd_LVM_LV=vg_server1/LogVol01 rd_LVM_LV=vg_server1/LogVol00 rd_NO_DM rhgb quiet
        initrd /initramfs-2.6.32-279.el6.x86_64.img

Before we reboot, we install the libvirt and python-virtinst (which contains the virt-install tool which we will use later on to install Xen VMs) packages:

yum install libvirt python-virtinst

Because the libvirt package from CentOS 6/RedHat 6 has no support for Xen, we must rebuild it with Xen support. To do this, we install a few prerequisites now:

yum groupinstall 'Development Tools'

yum install python-devel xen-devel libxml2-devel xhtml1-dtds readline-devel ncurses-devel libtasn1-devel gnutls-devel augeas libudev-devel libpciaccess-devel yajl-devel sanlock-devel libpcap-devel libnl-devel avahi-devel libselinux-devel cyrus-sasl-devel parted-devel device-mapper-devel numactl-devel libcap-ng-devel netcf-devel libcurl-devel audit-libs-devel systemtap-sdt-devel libblkid-devel scrub

Let's find out our libvirt version:

rpm -qa | grep libvirt

[root@server1 ~]# rpm -qa | grep libvirt
libvirt-client-0.9.10-21.el6_3.3.x86_64
libvirt-0.9.10-21.el6_3.3.x86_64
libvirt-python-0.9.10-21.el6_3.3.x86_64
[root@server1 ~]#

It's 0.9.10, so we download the appropriate src.rpm package into /root/src and install it:

mkdir /root/src
cd /root/src
wget http://vault.centos.org/6.3/os/Source/SPackages/libvirt-0.9.10-21.el6.src.rpm
rpm -i libvirt-0.9.10-21.el6.src.rpm

The last command will show some warnings that you can ignore:

warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root

Next we patch Xen support into the libvirt sources:

wget http://pasik.reaktio.net/xen/patches/libvirt-spec-rhel6-enable-xen.patch
cd /root/rpmbuild/SPECS
cp -a libvirt.spec libvirt.spec.orig
patch -p0 < ~/src/libvirt-spec-rhel6-enable-xen.patch

Now we build a new libvirt package:

rpmbuild -bb libvirt.spec

At the end of the build process you should see something like this:

Wrote: /root/rpmbuild/RPMS/x86_64/libvirt-0.9.10-21.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/libvirt-client-0.9.10-21.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/libvirt-devel-0.9.10-21.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/libvirt-lock-sanlock-0.9.10-21.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/libvirt-python-0.9.10-21.el6.x86_64.rpm
Wrote: /root/rpmbuild/RPMS/x86_64/libvirt-debuginfo-0.9.10-21.el6.x86_64.rpm

Go to the directory where the new packages have been created (/root/rpmbuild/RPMS/x86_64/ in this case)...

cd /root/rpmbuild/RPMS/x86_64/

... and install the new libvirt packages (with Xen support) as follows:

rpm -Uvh --force libvirt-0.9.10-21.el6.x86_64.rpm libvirt-client-0.9.10-21.el6.x86_64.rpm libvirt-python-0.9.10-21.el6.x86_64.rpm

Afterwards, we reboot the system:

reboot

The system should now automatically boot the new Xen kernel. After the system has booted, we can check that by running

uname -r

[root@server1 ~]# uname -r
2.6.32.57-2.el6xen.x86_64
[root@server1 ~]#

So it's really using the new Xen kernel!

We can now run

xm list

to check if Xen has started. It should list Domain-0 (dom0):

[root@server1 ~]# xm list
Name ID Mem VCPUs State Time(s)
Domain-0 0 1024 1 r----- 18.9
[root@server1 ~]#

Instead of using the xm command, I will from now on use the virsh command to manage Xen VMs. This is the preferred way as we are using libvirt.

virsh list

should show this:

[root@server1 ~]# virsh list
Id Name State
----------------------------------------------------
0 Domain-0 running
[root@server1 ~]#

http://www.howtoforge.com/virtualization-with-xen-on-centos-6.3-x86_64-paravirtualization-and-hardware-virtualization

Konfigurasi DNS dengan Bind

2013-02-17T13:17:00.002+07:00

Konfigurasi DNS perlu dilakukan sebelum instalasi Server Mail dengan Zimbra Collocation Server. Di sini kita menggunakan Operating System Linux CentOS 5.4 yang sudah diinstal mengikuti panduan Instalasi Server Linux CLI dengan CentOS 5.4

Konfigurasi Domain & Hostname:

Domain :E14NG.net
Hostname : mumed.E14NG.NET
Zimbra^(*): mail.E14NG.net
MX (Mail Exchanger): mail.E14NG.net
DNS forwarders: 8.8.8.8, 8.8.8.4

^(*)Ini adalah nama server zimbra yang akan diinstal di server linux.

Konfigurasi IP:

IP Address: 10.20.30.2
Gateway : 10.20.30.5

Edit file konfigurasi named.conf

Pindah ke direktori /var/named/chroot/etc/. Kemudian buat file named.conf dengan vi atau nano.

options {
 directory "/var/named";
 // If there is a firewall between you and nameservers you want
 // to talk to, you may need to fix the firewall to allow multiple
 // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

 // If your ISP provided one or more IP addresses for stable
 // nameservers, you probably want to use them as forwarders.
 // Uncomment the following block, and insert the addresses replacing
 // the all-0's placeholder.

 forwarders {
   8.8.8.8, 8.8.8.4;
 };

 auth-nxdomain no;    # conform to RFC1035
 listen-on-v6 { any; };
                              // version statement - inhibited for security
                              // (avoids hacking any known weaknesses)
                              version "not currently available";
                              // disables all zone transfer requests
                              allow-transfer { "none"; };
};

view "localnet"
{
    // This view sets up named to be a localhost resolver
    // (caching only nameserver).
    // If all you want is a caching-only nameserver,
    // then you need only define this view:
    match-clients           { 127.0.0.1;
                              10.20.30.0/20;
                              172.20.10.0/20; };

    // prime the server with knowledge of the root servers
    zone "." {
     type hint;
     file "db.root";
    };
    // be authoritative for the localhost forward and reverse zones, and for
    // broadcast zones as per RFC 1912
    zone "localhost" {
     type master;
     file "db.local";
                              allow-update { "none" ; };
    };

    zone "127.in-addr.arpa" {
     type master;
     file "db.127";
                              allow-update { "none" ; };
    };

    zone "0.in-addr.arpa" {
     type master;
     file "db.0";
                              allow-update { "none" ; };
    };

    zone "255.in-addr.arpa" {
     type master;
     file "db.255";
                              allow-update { "none" ; };
    };

    zone "30.20.10.in-addr.arpa" {
     type master;
     file "db.10.20.30
";
                              allow-update { "none" ; };
    };

    zone "E14NG.net" {
     type master;
     file "db.E14NG.net
";
    };
};

Buat symbolic link /etc/named.conf

ln -s /var/named/chroot/etc/named.conf /etc/named.conf

Edit file-file zone

Pindah ke direktori /var/named/chroot/var/named/. Buat file-file zone:

db.0
db.127
db.255
db.192.168.87
db.local
db.root
db.centos.org

File-file yang perlu diedit (disesuaikan dengan domain) adalah db.192.168.87 dan db.centos.org.

/var/named/chroot/var/named/db.0

; BIND reverse data file for broadcast zone 
; 
$TTL 604800 
@ IN SOA localhost. root.localhost. ( 
         1  ; Serial 
    604800  ; Refresh 
     86400  ; Retry 
   2419200  ; Expire 
    604800 ) ; Negative Cache TTL 
; 
@ IN NS localhost.

/var/named/chroot/var/named/db.127

; 
; BIND reverse data file for local loopback interface 
; 
$TTL 604800 
@ IN SOA localhost. root.localhost. ( 
         1  ; Serial 
    604800  ; Refresh 
     86400  ; Retry 
   2419200  ; Expire 
    604800 ) ; Negative Cache TTL 
; 
@ IN NS localhost. 
1.0.0 IN PTR localhost.

/var/named/chroot/var/named/db.255

; 
; BIND reverse data file for broadcast zone 
; 
$TTL 604800 
@ IN SOA localhost. root.localhost. ( 
         1  ; Serial 
    604800  ; Refresh 
     86400  ; Retry 
   2419200  ; Expire 
    604800 ) ; Negative Cache TTL 
; 
@ IN NS localhost.

/var/named/chroot/var/named/db.192.168.87

$TTL 604800 
@ IN SOA ns1.E14NG.net
. hostmaster.E14NG.net
. (          2  ; Serial 
    604800  ; Refresh 
     86400  ; Retry 
   2419200  ; Expire 
    604800 ) ; Negative Cache TTL 
; 
@ IN NS ns1.E14NG.net
. 
103 IN PTR mail.E14NG.net
.

/var/named/chroot/var/named/db.local

; 
; BIND data file for local loopback interface 
; 
$TTL 604800 
@ IN SOA localhost. root.localhost. ( 
         2  ; Serial 
    604800  ; Refresh 
     86400  ; Retry 
   2419200  ; Expire 
    604800 ) ; Negative Cache TTL 
; 
@ IN NS localhost. 
@ IN A 127.0.0.1 
@ IN AAAA ::1

/var/named/chroot/var/named/db.root

;       This file holds the information on root name servers needed to 
;       initialize cache of Internet domain name servers 
;       (e.g. reference this file in the "cache  .  " 
;       configuration file of BIND domain name servers). 
; 
;       This file is made available by InterNIC 
;       under anonymous FTP as 
;           file                /domain/named.root 
;           on server           FTP.INTERNIC.NET 
;       -OR-                    RS.INTERNIC.NET 
; 
;       last update:    Dec 12, 2008 
;       related version of root zone:   2008121200 
; 
; formerly NS.INTERNIC.NET 
; 
.                        3600000  IN  NS    A.ROOT-SERVERS.NET. 
A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4 
A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:BA3E::2:30 
; 
; FORMERLY NS1.ISI.EDU 
; 
.                        3600000      NS    B.ROOT-SERVERS.NET. 
B.ROOT-SERVERS.NET.      3600000      A     192.228.79.201 
; 
; FORMERLY C.PSI.NET 
; 
.                        3600000      NS    C.ROOT-SERVERS.NET. 
C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12 
; 
; FORMERLY TERP.UMD.EDU 
; 
.                        3600000      NS    D.ROOT-SERVERS.NET. 
D.ROOT-SERVERS.NET.      3600000      A     128.8.10.90 
; 
; FORMERLY NS.NASA.GOV 
; 
.                        3600000      NS    E.ROOT-SERVERS.NET. 
E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10 
; 
; FORMERLY NS.ISC.ORG 
; 
.                        3600000      NS    F.ROOT-SERVERS.NET. 
F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241 
F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2F::F 
; 
; FORMERLY NS.NIC.DDN.MIL 
; 
.                        3600000      NS    G.ROOT-SERVERS.NET. 
G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4 
; 
; FORMERLY AOS.ARL.ARMY.MIL 
; 
.                        3600000      NS    H.ROOT-SERVERS.NET. 
H.ROOT-SERVERS.NET.      3600000      A     128.63.2.53 
H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::803F:235 
; 
; FORMERLY NIC.NORDU.NET 
; 
.                        3600000      NS    I.ROOT-SERVERS.NET. 
I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17 
; 
; OPERATED BY VERISIGN, INC. 
; 
.                        3600000      NS    J.ROOT-SERVERS.NET. 
J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30 
J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:C27::2:30 
; 
; OPERATED BY RIPE NCC 
; 
.                        3600000      NS    K.ROOT-SERVERS.NET. 
K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129 
K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7FD::1 
; 
; OPERATED BY ICANN 
; 
.                        3600000      NS    L.ROOT-SERVERS.NET. 
L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42 
L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:3::42   
; 
; OPERATED BY WIDE 
; 
.                        3600000      NS    M.ROOT-SERVERS.NET. 
M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33 
M.ROOT-SERVERS.NET.      3600000      AAAA  2001:DC3::35 
; End of File

/var/named/chroot/var/named/db.centos.org

; 
; BIND data file for local loopback interface 
; 
$TTL 604800 
@ IN SOA ns1.E14NG.net
. hostmaster.E14NG.net
. (          2  ; Serial 
    604800  ; Refresh 
     86400  ; Retry 
   2419200  ; Expire 
    604800 ) ; Negative Cache TTL 
; 
@ IN NS ns1.E14NG.net
. 
@ IN A 10.20.30.2
@ IN AAAA ::1 
@ IN MX 10 mail.centos.org. 
ns1 IN A 10.20.30.2

mail IN A 10.20.30.2

server  IN CNAME ns1

Sebelum service named dijalankan. Cek dulu file konfigurasi named.conf dan file-file zona dengan perintah named-checkconf -t /var/named/chroot -z

[root@vbox-server ~]# named-checkconf -t /var/named/chroot -z
zone localhost/IN: loaded serial 2
zone 127.in-addr.arpa/IN: loaded serial 1
zone 0.in-addr.arpa/IN: loaded serial 1
zone 255.in-addr.arpa/IN: loaded serial 1
zone 87.168.192.in-addr.arpa/IN: loaded serial 2
zone centos.org/IN: loaded serial 2

Jika tidak ada masalah lanjutkan dengan aktifkan service named dan instal servicenya dengan chkconfig agar setiap kali server booting service named selalu dijalankan.

[root@vbox-server ~]# /etc/init.d/named start
Starting named:                                            [  OK  ]
[root@server ~]# cd /etc/init.d
[root@server init.d]# chkconfig --level 2345 named on

Edit file /etc/hosts dan /etc/resolv.conf.

[root@vbox-server ~]# cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1       localhost.localdomain localhost
10.20.30.2      server.E14NG.net server
#::1  localhost6.localdomain6 localhost6

[root@vbox-server ~]# cat /etc/resolv.conf
nameserver 127.0.0.1

Lakukan test untuk domain lokal dan internet.

[root@server ~]# host server.E14NG.net
server.E14NG.net is an alias for ns1.E14NG.net.
ns1.E14NG.net has address 10.20.30.2

[root@server ~]# host -t mx E14NG.net

E14NG.net mail is handled by 10 mail.E14NG.net.

[root@server ~]# host www.yahoo.com
www.yahoo.com is an alias for fd-fp3.wg1.b.yahoo.com.
fd-fp3.wg1.b.yahoo.com is an alias for ds-fp3.wg1.b.yahoo.com.
ds-fp3.wg1.b.yahoo.com is an alias for ds-sg-fp3-lfb.wg1.b.yahoo.com.
ds-sg-fp3-lfb.wg1.b.yahoo.com is an alias for ds-sg-fp3.wg1.b.yahoo.com.
ds-sg-fp3.wg1.b.yahoo.com has address 106.10.170.118
ds-sg-fp3.wg1.b.yahoo.com has IPv6 address 2406:2000:ac:8::c:9102
ds-sg-fp3.wg1.b.yahoo.com has IPv6 address 2406:2000:ac:8::c:9101

2013-02-16T21:40:00.002+07:00

Monitoring network services are the important activity in every admins life. There are lot of network monitoring tools are available to monitor the activities in the network. I here list some of the useful network monitoring tool here.

Aqualogic Monitoring System helps you to monitor mission critical applications without installing any software/agent on the production environments. Collects runtime statistics of Connection Pools, Servlets, EJBs, Thread Pools, JMS Queues and Topics, Web Sessions, Server Availability, JVM Statistics and Transactions. It manages the inventory of servers, machines, and projects.

Demo : http://www.aqualogic.in/ams/

AggreGate Network Manager is an enterprise-grade IP network management, monitoring and supervision system based on AggreGate Device Management Platform. It saves costs and simplifies setup when providing remote monitoring and intelligent device management services for a large network of devices and computers which are spread over a local network or the Internet. It introduces new conceptsin M2M (Machine-2-Machine) technology. AggreGate provides a rich set of features for managing/monitoring device networks,processing data, and integration with other enterprise systems using open-source APIs. The core components are Java-based and may be deployed on most present-day hardware and operating systems.

Download : http://aggregate.tibbo.com/downloads.html
Demo : http://aggregate.tibbo.com/demo.html

Andrisoft provides complete IP traffic monitoring and accounting and DDoS protection solutions for LAN, MAN and WAN networks using the self-developed, particularly scalable, truly innovative and high performing WANGuard Platform. This software addresses the many aspects of traffic monitoring and network protection needed to ensure the secure and reliable delivery of essential network services, through NetFlow, sFlow and Packet Sniffing. WANGuard Lite is a stripped-down, cheaper version that only provides traffic monitoring and accounting capabilities.

Download : http://www.andrisoft.com/download

David system is a network management system (nms). It allows you to manage your resources and services through both Intranet and Internet. Auto-discovering and network topology building feature help you to keep more intuitive view of your IT infrastructure. Resources, real-time monitoring and accessibility of historical data let you react faster to arising failures. Configured interfaces for monitored devices allow you to focus on the most important aspects of their work.

Download : http://www.hadden.pl/en/download.php

Cymphonix Network Composer monitors Internet traffic by user, application, and threat. Includes controls to shape access to Internet resources by user, group, and/or time of day. Also featuring anonymous proxy blocking, policy management, and real time monitoring.

Demo : http://www.cymphonix.com/on-demand-product-demo.html

Zentyal allows ICT professionals to manage all network services such as Internet access, network security, resource sharing, network infrastructure or communications in an easy way via one single platform. It offers an intuitive interface, that includes the most frequently needed features although there are other, some more complex, methods used to carry out all kinds of configuration.

Download : http://www.zentyal.org/downloads

OpenNMS is an enterprise-grade network management platform developed under the open source model. It is designed to scale to tens or hundreds of thousands of managed nodes from a single instance. OpenNMS is an integrated platform providing service availability management, performance data collection (via SNMP, JMX, HTTP, WMI, XMP, and other protocols), event management (internal events, custom events via an XML/TCP interface, and external events via SNMP traps and TL1), event de-duplication, and flexible notifications (via SMTP, XMPP, and many other protocols). The software is free under the GPLv2 license, and commercial support, training, and consulting are available.

Download : http://www.opennms.org/get-opennms

IP Host Network Monitor is a network and server monitoring tool that lets you monitor availability and performance of mail servers, internet hosts, database servers, and other network resources. Performance counters on Windows computers can be monitored using WMI. Other supported protocols are HTTP, HTTPS, FTP, SMTP, POP3, IMAP, ODBC, PING

Download : http://www.iphostmonitor.com/download.html

Demo : http://cdn.iphostmonitor.com/videodemo/newmonitor-ping/NewMonitor-PING.html

Nagios is a powerful monitoring system that enables organizations to identify and resolve IT infrastructure problems before they affect critical business processes. Designed with scalability and flexibility in mind, Nagios gives you the peace of mind that comes from knowing your organization’s business processes won’t be affected by unknown outages. Nagios is a powerful tool that provides you with instant awareness of your organization’s mission-critical IT infrastructure. Nagios allows you to detect and repair problems and mitigate future issues before they affect end-users and customers.

Download : http://www.nagios.org/download

Demo : http://demos.nagios.com/

Cacti is a complete network graphing solution designed to harness the power of RRDTool‘s data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple data acquisition methods, and user management features out of the box. All of this is wrapped in an intuitive, easy to use interface that makes sense for LAN-sized installations up to complex networks with hundreds of devices.

Download : http://www.cacti.net/download_cacti.php

Zabbix is a network management system created by Alexei Vladishev. It is designed to monitor and track the status of various network services,servers, and other network hardware. It uses MySQL, PostgreSQL, SQLite, Oracle or IBM DB2 to store data. Its backend is written in C and the web frontend is written in PHP. Zabbix offers several monitoring options. Simple checks can verify the availability and responsiveness of standard services such as SMTP or HTTP without installing any software on the monitored host. A Zabbix agent can also be installed on UNIX and Windows hosts to monitor statistics such as CPU load, network utilization, disk space, etc. As an alternative to installing an agent on hosts, Zabbix includes support for monitoring via SNMP, TCP and ICMP checks, as well as over IPMI, SSH, telnet and using custom parameters. Zabbix supports a variety of real-time notification mechanisms, including XMPP.

Download : http://www.zabbix.com/download.php
There are lot of Network monitoring tools are available, it’s not possible to list all the monitoring tools. I ll explain some other tools in an another article soon.

How to install Xen on CentOS

2013-02-16T21:11:00.003+07:00

Virtualisation plays a major role in the cloud and other distributed environment. There are lot of virtualisation softwares are available. One of the most popular open source software is XEN and this tutorials explains about how to install xen on rpm based distributions. ( Works well on CentOS, Redhat Enterprise Linux , Fedora ).

The Xen hypervisor, the powerful open source industry standard for virtualization, offers a powerful, efficient, and secure feature set for virtualization of x86, x86_64, IA64, ARM, and other CPU architectures. It supports a wide range of guest operating systems including Windows, Linux, Solaris, and various versions of the BSD operating systems. The Xen.org community develops and maintains the Xen hypervisor as a free solution licensed under the GNU General Public License.

Xen powers most public cloud services and many hosting services, such as Amazon Web Services, Rackspace Hosting and Linode. Commercial virtualization products such as Oracle VMand XenServer are built on top of Xen, as well as desktop virtualization solutions such as Qubes OS and XenClient. From Linux 3.0 onwards, all of the code necessary to run Linux as the Xen management OS and as a Xen guest, is part of the Linux kernel.

Installation of Xen

Open your terminal and go a head with this command.

#yum groupinstall Virtualisation

This command will install everything you need and after that open your grub configuration file which is located in /etc/grub.conf ( if you cant find that grub.conf, use locate command to find it. ie locate grub.conf )

#vim /etc/grub.conf

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00
#          initrd /initrd-version.img
#boot=/dev/sda
default=0
timeout=1
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.18-92.1.10.el5xen)
        root (hd0,0)
        kernel /xen.gz-3.3.0
        module /vmlinuz-2.6.18-92.1.10.el5xen ro root=/dev/VolGroup00/LogVol00
        module /initrd-2.6.18-92.1.10.el5xen.img
title CentOS (2.6.18-92.1.10.el5)
        root (hd0,0)
        kernel /vmlinuz-2.6.18-92.1.10.el5 ro root=/dev/VolGroup00/LogVol00
        initrd /initrd-2.6.18-92.1.10.el5.img

Your grub configuration file will be like this. Now reboot your machine.

# reboot

After rebooting, select the xen kernel from the bootlader option * and login into your user account.

Now check out your kernel version by using the command uname

# uname -r

2.6.18-53.1.21.el5xen

So now you are using new xen kernel. Create a directory to install the virtual machine, here i create a directory in the /vmachine, Of course you can choose your own location with enough space.

# mkdir /vmachine

If you have guest operating system image file just copy it to /vmachine directory or else if you have planned to use remote server then leave it.

Make sure that your SELinux is disable and permissive .

# vim /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
#       targeted - Only targeted network daemons are protected.
#       strict - Full SELinux protection.
SELINUXTYPE=targeted

If you had to modify /etc/sysconfig/selinux, please reboot the system else dont reboot.

# reboot

Now run the Xen virtual machine

# xm list

to check if Xen has started. It should list Domain-0 (dom0) [root@linuxinternetworks ~]# xm list
Name                   ID             Mem(MiB)      VCPUs   State   Time(s)
Domain-0               0               867          1       r-----    134.1
[root@linuxinternetworks ~]#

CentOS comes with a nice tool called virt-install with which we can create virtual machines for Xen. To start it, we simply run

#virt-install

 What is the name of your virtual machine? vcentos
 How much RAM should be allocated (in megabytes)? 512
 What would you like to use as the disk (file path)? /vmachine/vmachine1.img
 How large would you like the disk (/vm/vm01.img) to be (in gigabytes)? 6
 What is the install location? /vmachine/centos.iso

Here i am using image file ( *.iso ) as a source to install the guest operating system. Of Course you can use the url http://www.centos.org/modules/tinycontent/index.php?id=13 . After we have answered all questions, virt-install starts the normal CentOS installer in our vmachine1 virtual machine. You already know the CentOS installer, so it should be no problem for you to finish the CentOS installation in vmachine1.

After the installation, we stay at the vmachine1 console. To leave it, type CTRL+] if you are at the console, or CTRL+5 if you’re using PuTTY. You will then be back at the dom0 console.

virt-install has created the vmachine1 configuration file /etc/xen/xend-config.sxp

To Run Xen

# xm console vmachine1
To get a list of running virtual machines, type

#xm list
The output will look like this

[root@linuxinternetworks ~]# xm list
Name          ID               Mem(MiB)              VCPUs               State                Time(s)
Domain-0      0                    867               1                  r-----                168.5
vmachine1     1                    512               1                  -b----                197.7
[root@linuxinternetworks ~]#

To shut down vmachine1 : # xm shutdown vmachine1
To start vmachine1 : # xm console vmachine1
Some of the xen commands are
xm create -c /path/to/config - Start a virtual machine.
xm shutdown - Stop a virtual machine.
xm destroy - Stop a virtual machine immediately without shutting it down. It’s as if you switch off the power button.
xm list - List all running systems.
xm console - Log in on a virtual machine.
xm help - List of all commands.
You can also control the xen services by using these commands.
service xend start – To start the service
service xend stop – To stop the service
service xend status – To know about the status of the service
service xend restart – To restart the service

Install XenServer Tools - Linux

Within this tutorial we will cover how to install XenServer Tools to your virtual machines. This applies to CentOS, Debian and Red Hat operating systems.

1. Open up XenCenter and establish a connection to your XenServer. Here is an example of a Virtual Machine that is a fresh install but does not have XenServer Tools setup. You will notice that for "Virtualization State:" the software says "Tools not installed".

2. Let's get started by simply right-clicking on the name of our Virtual Machine and clicking "Install XenServer Tools". A warning will come up stating that, "Any CD or DVD currently in the Virtual Machine's CD drive will be ejected when xenServer Tools are installed." Click on "Install ZenServer Tools" to continue unless you are currently using a CD in the VM. If so, continue this tutorial at a time when the virtual disk drive is free for use.

3. You should be sent to the console tab of XenCenter for your Virtual Machine. You will notice that at the top of the window, below the tabs that the software is telling you that it has the CD image of "xs-tools.iso" loaded into the DVD Drive. It also provides you with the device name within the system.

4. You can do the following steps via either the console or via an SSH session to the system. I will perform the installation using SSH. Here is the output of my session. Remember that the drive's device name is provided by XenCenter.

$ ssh 10.10.10.3
root@10.17.37.243's password:
Last login: Thu Sep 11 12:57:31 2008 from 10.0.80.84
[root@ns0 ~]# cd /mnt
[root@ns0 mnt]# ls
[root@ns0 mnt]# mkdir xs-tools
[root@ns0 mnt]# mount /dev/xvdd /mnt/xs-tools/
mount: block device /dev/xvdd is write-protected, mounting read-only
[root@ns0 mnt]# cd /mnt/xs-tools/Linux/
[root@ns0 Linux]# bash install.sh
Detected `CentOS release 5.2 (Final)' (centos version 5).
 
The following changes will be made to this Virtual Machine:
* packages to be installed/upgraded:
- kernel-xen-2.6.18-53.1.13.el5.xs4.1.0.24.x86_64.rpm
- xe-guest-utilities-4.1.0-257.x86_64.rpm
 
Continue? [y/n] y
 
Preparing...########################################### [100%]
1:xe-guest-utilities########################################### [100%]
Preparing...########################################### [100%]
package kernel-xen-2.6.18-92.el5 (which is newer than kernel-xen-2.6.18-53.1.13.el5.xs4.1.0.24) is
already installed
 
You should now reboot this Virtual Machine.
[root@ns0 Linux]#

If you would like to simply copy and paste into your shell, the following lines should perform all of the steps provided that you are assigned the same device name of /dev/xvdd

mkdir /mnt/xs-tools
mount /dev/xvdd /mnt/xs-tools
cd /mnt/xs-tools/Linux/
bash install.sh

5. The XenServer Tools installation script does a reasonable job of determining the best way to install what it needs without much intervention. If everything went well you should be able to reboot your system from the command line and when it restarts you can see that XenServer Tools are installed as in the following image.

6. Now XenCenter will be able to have a bit more control of the operating system within the Virtual Machine and you will also be able to view the previously unavailable counters within the "Performance" tab of XenCenter.

Reference :
www.xen.org
www.centos.org
linuxinternetworks.com

Instalasi Server Linux CLI dengan CentOS

2013-02-16T21:02:00.001+07:00

Artikel ini menjelaskan dengan rinci tahapan instalasi Server Linux dengan CentOS 5.4. Di sini instalasi dilakukan dalam mode text. Begitu pula tidak ada instalasi Server GUI (Graphic User Interface) baik Gnome maupun KDE melainkan Server CLI (Command Line Interface).
Konfigurasi Domain & Hostname

Domain : mumed.com
Hostname : nms.mumed.com

Konfigurasi Network

IP Address: 10.10.10.3
Netmask1 : 255.255.255.248
Gateway : 10.10.10.5

Setup BIOS untuk enable booting primary via DVD.
Masukkan DVD CentOS 5.4.
Setelah komputer berhasil booting DVD CentOS maka akan muncul tampilan di bawah:

Instalasi dilakukan dalam mode text, ketikan perintah linux text lalu tekan seperti gambar di bawah:
Selanjutnya klik OK apabila ingin melakukan media test untuk mencek kevalidan isi DVD CentOS.
Klik Test untuk test isi DVD.
Sistem akan melakukan media check sampai selesai:
Jika isi DVD tidak ada masalah maka hasil media check adalah PASSED.Tekan OK untuk mulai instalasi.
Jika masih ingin melakukan media check DVD yang lain maka tekan Test atau tekan Continue untuk melanjutkan instalasi.
Welcome to CentOS ! Tekan OK.
Pakai kursor up dan down untuk pemilihan bahasa English lalu pakai tab untuk keluar dari menu pilihan sehingga tombol OK tersorot (aktif) lalu klik untuk ke menu selanjutnya.
Pilih model keyboard us pada menu Keyboard Selection. Tekan OK.
Selanjutnya masuk ke menu partitioning. Instalasi default CentOS akan membagi harddisk dalam 3 partisi:
- BootPartisi ini menyimpan kernel linux yang akan dijalankan setiap kali booting. Partisi ini secara default mempunyai nama folder /boot di file sistem linux.
- RootPartisi ini menyimpan direktori sistem operasi linux secara keseluruhan: /root, /etc, /var, /bin, /sbin, /usr, /opt, /home, /tmp dll.
- SwapMemori virtual, besarnya dua kali memori fisik.
Pilih option Remove all partitions on selected drives and create default layout dengan kursor up/down. Lalu pilih harddrive, selanjutnya tekan OK.
Pada menu partitioning berikutnya kita akan memformat dan memberi nama partisi atau mount point. Pertama gerakkan kursor up/down sehingga partisi jenis swap tersorot lalu klik tab dan pilih Edit.
Saat masuk ke menu Make Logical Volume, cek pilihan berikut:
- Besar swap (MB) : Pastikan dua kali ukuran memori fisik.
- File system type: swap.
- Format partition: Dipilih (*)
Jika sudah sesuai tekan OK.
Selanjutnya pilih mount point root atau / dan klik Edit.
Pastikan partisi ini mempunyai mount point / dengan file system ext3 dan format partition dipilih (*).
Selanjutnya pilih mount point /boot dan klik Edit.
Pastikan partisi ini mempunyai mount point /boot dengan file system ext3 dan format partition dipilih (*).
Menu akan kembali ke menu partitioning seperti pada gambar di langkah 14, tekan tombol OK.
Tekan OK untuk memilih Use GRUB Boot Loader.
Saat masuk menu Boot Loader Configuration tanpa melakukan perubahan tekan tombol OK.
1.Selanjutnya beri tanda [*] untuk Use a Grub Password. Isikan password kemudian tekan tombol OK.
Tekan tombol OK untuk menerima Default Boot Label Centos.
Boot loader harus diinstal di Master Boot Record (MBR). Tekan OK.
Jawab Yes untuk konfigurasi network interface.
Pada menu Network Configuration for eth0 beri pilihan [*] untuk Activate on boot dan Enable IPv4 support. Tekan OK.
Pada menu Ipv4 Configuration for eth0 pilih Manual address configuration
- IP Address: 192.168.87.103
- Prefix (Netmask): 28
Tekan OK.

Pada langkah selanjutnya isikan gateway dan dns seperti pada gambar di bawah:
Di menu Hostname Configuration pilih manually dan beri nama vbox-server.centos.org. Tekan tombol OK.
Pada menu Time Zone Selection set System clock using UTC dan pilih Asia/Jakarta untuk time zone. Tekan tombol OK.
Isikan password root lalu tekan OK.
Pada menu Package Selection set Server dan Customize software selection. Tekan OK.
Pada menu Package Group Selection, gerakan kursor up/down dan pilih package seperti di bawah ini:
- Base
- DNS Name Server
- Development Libraries
- Development Tools
- Editors
- FTP Server
- Java
- Legacy Network Server
- Legacy Software Development
- Legacy Software Support
- Network Servers
- System Tools
- Text-based Internet
- Windows File Server
Tekan OK untuk mulai instalasi.
Selanjutnya sistem akan mulai melakukan Dependency Check.
Tekan OK pada menu Installation to begin.
Selanjutnya sistem akan mulai melakukan Formatting, Copying File, dan Package Installation.
Selesai install sistem akan minta Reboot.Saat reboot berlangsung secara otomatis DVD akan dieject atau dikeluarkan dari tray. Ambil DVD dan tutup kembali tray.
Setelah CentOS booting maka dimunculkan di layar console menu Setup Agent.
Pilih Firewall configuration dan klik Run Tool.
Set Security Level dan SElinux ke Disabled. Klik tombol OK.
Kembali ke menu Setup Agent pilih System Services lalu klik Run Tool.
Di menu services hilangkan pilihan di sendmail lalu klik tombol OK.
Kembali ke menu Setup Agent klik Exit.
Welcome to CentOS .

Selamat mencoba . . . . . . .

No	Nama	IP Address	Line 1	Line 2	Line 3	Line 4	UserID
1	SPA400-1	192.168.51.185	310	311	320	321	9000
2	SPA400-2	192.168.51.172	-	312	-	-	9001

No	Nama	IP Address	Phone 1 (VOIP 1)	Phone 2 (VOIP 2)
1	PAP2T-1	192.168.51.186	321 (2000)	311 (2001)
1	PAP2T-2	192.168.51.187	310 (2002)	320 (2003)
3	PAP2T-3	192.168.51.173	312 (2004)	-

Proxy	:	192.168.51.253
Register	:	Yes
Register Expires	:	3600
Make Call Without Reg	:	No
Ans Call Without Reg	:	No
Preferred Codec	:	G711a

Line	Line Enable	SIP Port	Display Name	User ID	Password	Use Auth ID
1	yes	5060	2000	2000	1234	no
2	yes	5061	2001	2001	1234	no