Agratitudesign Impression

Agratitudesign Art and Nature Photography and Graphic Design

noreply@blogger.com (Agratitudesign) — Thu, 19 Apr 2018 17:51:00 +0000

This is the special page of Agratitudesign Art And Nature Photography and Graphic Design images gallery collection from what I have learned into practice about art and nature of Photography and Graphic Design. This page contains a lot of my still artwork of Photography, Graphic Design, Drawing, and Illustrations which is separated into different categories on tabs. This images gallery collection will show a glimpse of how far and deep of my skill, experience and knowledge in the field of Photography and Graphic Design to inspire or just as comparison with you who already expert in Photography and Graphic Design. Photography and Graphic Design has much relationship one another that could be as complement each other. Having a good knowledge and experience by practicing of Photography and Graphic Design will produce a better masterpiece.

Photography is the art, application and practice of creating durable images by recording light or other electromagnetic radiation, either electronically by means of an image sensor, or chemically by means of a light-sensitive material such as photographic film "wikipedia". Photography needs your taste, sensitivity, and techniques in order to create the images from the camera looks art and professional. In order to be a good photographer we need comfortable with our camera use techniques at least about Aperture, ISO, and Shutter Speed. I believe we will understand it slowly by practicing day by day which will hone our expertise. I hope images gallery can be inspire to make the artwork of Photography and Graphic Design more and more.

If you interested Agratitudesign Art And Nature Photography and Graphic Design images, you can find full resolution of images and license on ADOBESTOCK, SHUTTERSTOCK, POND5, or DREAMSTIME certainly it depends on their selection of my artwork. If you want to join as fellow Shutterstock please click this link "Shutterstock Contributor". Feel free to explore Agratitudesign Art And Nature Photography and Graphic Design images gallery. You can loadmore the images gallery portfolio in order to see all the images that available. That's all..! thanks for visiting and have a good day!

Beautiful Red Flower Plants Of Rose Balsam Or Impatiens Balsamina Growing In Agricultural Area

Fresh Green Leaves Of Wild young Plants In Agricultural Area At The Village In The Cloudy Sunny Day

Hydroponic Lotus Flower Blooming In Small Container With Water

Fresh Green Young Papaya Stem And Leaves Growing In Agricultural Area At The Village

Wild Hydroponic Plant Water Lettuce Float On Water In The Rice Field

Simple Outdoor Decorative Potted Plants Bring Freshness In The House

Growing Chilli Plants In Agricultural Area At The Village

Fresh Blooming Red Flower Of Rose Balsam Or Impatiens Balsamina Growing In Agricultural Area

Bushy Leaves Of Lemon Grass Or Cymbopogon Citratus Growing In Agricultural Area At The Village_

Beautiful Green Yard Of Balinese Temple With Old Frangipani Tree At Ringdikit Village North Bali Indonesia

Natural View Decoration Plants Of Cabbage Tree Or Cordyline Australis In The Garden Of The House North Bali Indonesia

Beautiful Decoration Plants Of Cabbage Tree Or Cordyline Australis In The Garden Of The Hospital North Bali Indonesia

Balinese Carving Arches Building In The Tropical Garden Park On A Sunny Day Tangguwisia Village North Bali Indonesia

Warm Atmosphere Tropical Garden Landscape On A Sunny Day In A Long Dry Season Tangguwisia Village North Bali Indonesia

Peacefull Tropical Garden View With Walking Path On A Sunny Day In A Long Dry Season Tangguwisia Village North Bali Indonesia

Beautiful Tropical Garden Park On A Sunny Day In A Long Dry Season Tangguwisia Village North Bali Indonesia

Cloudy Atmosphere Of The Rice Fields After Harvesting At The Village North Bali Indonesia

Irrigation Water Channel Of The Rice Fields After Harvested In Agricultural Area At The Village

Growing Young Rice Plants In The Field At Agricultural Area Of The Village North Bali Indonesia

Spread Of Various Plants In The Rice Fields On Roadside At The Village In The Cloudy Sunny Day

Natural Rice Fields After Harvesting Scenery At Ringdikit Village North Bali Indonesia

Fresh Green Leaves Of Young Rice Plants In The Field At Agricultural Area Of The Village

Beautiful White Wild Grassland Flowers In The Rice Fields At The Village In The Cloudy Sunny Day

Green Spread Of Various Plants In The Rice Fields At The Village In The Cloudy Sunny Day North Bali Indonesia

Soda Traditional Balinese Offerings In A Ceremony To The Dead Souls At Dalem Temple Of The Village

Small Balinese Shrine With Decoration In The Middle Of The Temple In The Ceremony At The Village Ringdikit North Bali Indonesia

Ganesha Statue Balinese Style And Decoration In Front Of The Temple In The Ceremony At Dalem Temple Ringdikit North Bali Indonesia

Traditional Balinese Shrine With Decoration And Offerings During Ceremony In The Temple At The Village Ringdikit North Bali Indonesia

Traditional Balinese Temple Gate With Decoration In The Ceremony Of The Temple At The Village

Traditional Balinese Ganesha Statue With Decoration In Front Of The Temple In The Ceremony At Dalem Temple Ringdikit North Bali Indonesia

Front View Altar Building On The Yard Of Labuhan Aji Balinese Hindu Temple At Temukus Village North Bali Indonesia

Traditional Altar Building On The Yard Of Labuhan Aji Balinese Hindu Temple At Temukus Village North Bali Indonesia

Colorful Abstract Orange Neon Glowing Diagonal Lines Against Red Blue Background

Happy New Year 2020 Greeting Text On Square Shines Dotted Globe Earth World Map Against Blue Shiny Sparkles Stars And Lens Flare Glare Light

Artistic Abstract Blue Purple Glowing Light Beam Follow Spark Circles With Lens Flare Glare Light

Artistic Colorful Orange Neon Glowing Vertical Lines Against Red Blue Background

Abstract Square Shines Dotted Globe Earth World Map Side Of Of Asia And Australia On Red Shiny Sparkles Stars And Bokeh

Abstract Square Shines Dotted Globe Earth World Map Side Of The North And South America On Red Shiny Sparkles Stars And Bokeh

Abstract Purple Orange Glowing Diagonal V lines Pattern With Dark Purple Red Background

Abstract Square Shines Dotted Globe Earth World Map Side Of Of Africa And Europe On Red Shiny Sparkles Stars And Bokeh

Woman Traveler Sitting On A Typical Balinese Carved Seat In The Natural Garden Park Tangguwisia Village North Bali Indonesia

Woman Traveler Sitting On Carved Seat Of The Throne In The Tropical Garden Park At Tangguwisia Village North Bali Indonesia

Sweet Smile Woman Traveler Sitting On White Carved Seat In The Beautiful Flower Garden At Tangguwisia Village North Bali Indonesia

Woman Traveler Picking Red Hibiscus Flower In The Fresh Garden On A Sunny Day At Tangguwisia Village North Bali Indonesia

Woman Traveler Face Among Carving Arches Of White Carved Seat Building In The Tropical Garden On A Sunny Day

Woman Traveler Take A Selfie In The Beautiful Tropical Garden Plants On A Sunny Day Tangguwisia Village North Bali Indonesia

Woman Traveler Take A Selfie On The Green Lawn In A Fresh Atmosphere Tropical Garden At Tangguwisia Village North Bali Indonesia

Woman Traveler Sitting On White Carved Seat Building In The Tropical Garden Park At Tangguwisia Village North Bali Indonesia

Peaceful Front Garden And Porch Area Of Hospital Room North Bali Indonesia

Clean And Peaceful Garden Yard And Building Of The Hospital North Bali Indonesia

Midnight Mood Hospital Hallway View With Patients Family Sleeping Outside Hospital Rooms

Perspective View Door And Ceiling Of The House At Seririt Village North Bali Indonesia

Perspective View Wall Window And Floor Of Minimalist House In Bali Indonesia

Peaceful Atmosphere In The Wide Yard Of Hospital Building At Buleleng North Bali Indonesia

Emergency Room Building Construction And The Yard Of The Hospital At Buleleng North Bali Indonesia

Carved Buddha Statue On Large Pieces Of Wood In The Room Of Buddhist Monastery In Bali Indonesia

Villagers Carrying Wooden Wadah Move Around The Burning Place In The Dead Body Cremation Ceremony

Hospital Man Nurses Take Medical Patient From Emergency To The Room At Shanti Graha Hospital

Balinese People Watching Traditional Balinese Dance Performance In The Ritual Ceremony At Pura Dalem Seririt At Night

Balinese People Gathering In The Hindu Family Temple In Galungan Ceremony At The Village

Balinese People Crowd Worships During Galungan Ceremony In The Family Temple At The Village

Balinese People Stand Watching Balinese Dance Performance After Worships In Galungan Ceremony

Balinese People Celebrating Galungan Ceremony In The Hindu Family Temple In At The Village

Tiger Guard Statue And Balinese People In The Hindu Family Temple Take Back Offering After Worships During Galungan Holiday

Balinese Family Ceremony Grandmother Is Sprinkled With Holy Water By Her Daughter In Law At Dalem Temple

Grandma With Balinese Traditional Clothes Praying To Her Husband Who Has Passed In A Ceremony At Dalem Temple

Balinese Family Praying In Front Of The Altar Offerings For Families Who Have Died At Dalem Temple

Grandma And Grandpa With Balinese Traditional Clothes Talking About Their Condition And Health In The Temple

Romantic Man And Woman Sitting On A Typical Balinese Carved Seat In The Tropical Garden Park

Married Couple Sit Enjoy A Holiday On The Lawn In The Natural Tropical Garden At Tangguwisia Village North Bali Indonesia

Woman And Man Her Cousin Brother With Balinese Traditional Clothes Meet In The Temple

People Walking On Remnant Of Tree Wood Pieces In The Fields In The Dry Season At Ringdikit Village North Bali Indonesia

Young Balinese Cow In The Cage At The Farm Field At The Village North Bali Indonesia

Dying Little Brown Bat Crawl On The House Wall Amid Heatwave Before The Earthquake

A Bat Creeping Unable To Fly Eating Mango Fruit On The House Wall

A Bat Sleeping Upside Down Hanging On Wire Mesh In The House

Bats Eyes Creeping Unable To Fly On The House Wall

Couple Of Cats With Different Colors Approach To Mate On The House Yard

Adorable Kitten Feels Comfortable And Relaxed On The Lap In The House

Gaze Into The Eyes Of Young Baby Cat In The Corner Of The House Room On The Red Carpet

Closeup Of Fresh Mango Fruits Hanging On The Tree

Fresh Jackfruit Color Peeled For Family Snack

Two Fresh Apples With Fresh Skin Texture On The House Floor

Natural Red Apple With Fresh Skin Texture On The House Floor

Tasty Pan Fried Shredded Chicken With Traditional Balinese Salsa Or Sambal Matah On A Plate

Spicy Balinese Shredded Chicken With Traditional Balinese Salsa Or Sambal Matah On A Plate

A Glass Tropical Jackfruit Juice Drink With Milk On The Floor

Fresh Green Young Fruits Of Grapes On The Vines In Agricultural Area At The Village North Bali Indonesia

Small Light Of Rubbish Fire Burned At Night

Dried Leaves On White Rice Plastic Sacks

Fresh Front Leaf Texture Frangipani Plants On The House Floor

Beautiful Simple Traditional Balinese Offerings Made At Home For A Ceremony North Bali Indonesia

Fresh Back Leaf Texture Frangipani Plants On The House Floor

Natural Palimanan Yellow Sandstone Wall Texture

Natural House Wall Texture Of Palimanan Stone

Balinese Cremation Area Before The The Death Cremation Ceremony Takes Place

Missing Something, Drawing Art

I am Waiting, Drawing Art

Ethnic Flower, Drawing Art

Happy Kids, Drawing Art

Jug Flower, Drawing Art

Princess Meet Warrior, Drawing Art

Honey Flower, Drawing Art

Metamorphose, Drawing Art

LOAD MORE LOADING... NO MORE WORKS

Agratitudesign Art and Nature Videography and Animation

noreply@blogger.com (Agratitudesign) — Fri, 30 Mar 2018 14:27:00 +0000

This is the special collection of Agratitudesign Art and Nature Videography and Animation as a medium for my creativity in the field Videography and Graphic motion art or animation. This main page collection contains raw material video or commonly called as footage's, composition video footage's as a clip video of music, and also editorial or documentary video of the event.

At this moment I am so excited art and nature Videography and animation that most inspired by Microstock footage's agencies that absolutely amazing as a community of artists and creators. That's why Agratitudesign has join as fellow of Dreamstime, AdobeStock, and Pond5. So full footage's collection, resolution and licence of Agratitudesign Art and Nature Videography and Animation are and will be available to those of microstock agencies.

Most of Agratitudesign Videography Footage's was taken by just using iPhone Camera that was cut and edited in Adobe After Effects. While the animation videos was created by using Adobe Photoshop, Adobe illustrator and Adobe After Effects. So this page will be updated continuously from Agratitudesign Youtube. Fell free to explore Agratitudesign Art and Nature Videography and Animation and have great day to you all!

Natural Landscape Panorama Titab Ularan Dam's Reservoir In The Cloudy And Rainy Atmosphere

Natural Beauty Countryside Tropical Rocky Beach Scenery In The Dark Cloudy Twilight Sky

Beautiful Atmosphere In The Park Of Krisna Eco Village With Krishna's Chariot Statue Landmark

Peaceful Beach Scenery With Calm Seawater Waves And Coral Reefs At Umeanyar Village

Dramatic Color Sunset Beach Scenery Of Batu Bolong At Canggu Village Bali

Ulun Danu Bratan Famous Balinese Hindu Temple With Beautiful Mountains Lake In The Morning

Plants And Flowers In The Fields In The Dry To Rainy Transition Season

Tropical Fishing Beach Scenery In Dry Season At Seririt Village North Bali Indonesia

Seamless Loop Sea Waves And Heavy Rain On The Rocky Fishing Beach At The Village

Jukung Traditional Paddle Canoe And Beratan Lake Water Scenery At Bedugul Bali

Natural Motion Wild Beach Plants And Flowers By The Beach At Umeanyar Village

Silhouette Walking People At Sunset Beach Of Batu Bolong Temple At Tanah Lot Tabanan Bali Indonesia

Motion Plants Purslane Portulaca Oleracea Blown By The Wind In The Garden Of The House

Natural Scene Coconut Trees Blown By The Wind With Sunshine In The Dry Season At The Field

Motion Plants Of Ipomoea Pes caprae By The Beach Wind At Pemuteran North Bali Indonesia

Motion Leaves Of Caesalpinia Pulcherrima In The Sunny Windy Day At The Field

Bungan Sandat Serasi Dance In The Opening of Tanah Lot Art Food Festival 2018

Monkeys and Natural Habitat at Pulaki Beach Region North Bali Indonesia

The Part of Balinese Ritual Ceremony Caru Rsi Gana and Mendem Pedagingan

Monkeys Came Down From The Tree Branch At Pulaki Temple Region North Bali

Climbing Coconut Trees In The Plant Field

Cutting A Bunch Into A Hand Of Bananas By The Farmer

Romantic Happy Birthday Formed By Pile Of Flying Colorful Tiny Blooming Flowers And Dust In The Wind

Colorful Happy Birthday Lettering Neon Sign With Floor Reflection And Brick Wall In The Falling Confetti

Glowing Light Burst And Purple Shine Happy New Year 2021 Greeting On Dotted Globe Earth World Map

Congratulations Joe Biden Lettering Blue Brightly Light Mainland USA Map Neon Sign Lens Flare

Heart Rose Vine Green Leaves Flowers Tunnel In The Wind With Bright Blue Blurry Light Optical Bokeh

Happy New Year 2020 Greeting On Square Shines Dotted Globe Earth World Map Blue Background

Happy Anniversary Text Reveal From Romantic Red Blue Purple Bokeh Color Light Glitter Sparkles

Red Colorful Happy Birthday Neon Light Greeting Animation With Abstract Shiny Flare Glitter Bokeh

Never Live in Vengeance of The Heart In Our Life

Meaning of Unsuccessful in Life

Perfection of the Life is how you bring peace to the people

LOAD MORE LOADING... NO MORE WORKS

Remote Access DVR CCTV Server on Mikrotik from Local Network and Mobile

noreply@blogger.com (Agratitudesign) — Fri, 01 Sep 2017 13:25:00 +0000

Learning Network using Mikrotik with the router OS was very fun. At this moment I would like to write the note about how to remote or access DVR as the camera/CCTV server on our Mikrotik network by creating port forwarding rules on firewall nat of the Mikrotik router OS. Maybe you be like me wanted to be able to see a certain place that you feel important to keep safe in your observation wherever you are. It doesn't look to be such a big deal, your eyesight is in your hands right now on your mobile.

Obviously for the security reasons you need surveillance system at the office or even your home. Installation CCTV (Closed Circuit Television) camera is not difficult matter. I think right now you wanted to buy the camera and hoping to be able to see the place where you think it might be necessary for you. Perhaps you have CCTV installed already, but don’t quite know the CCTV network system. I hope after this you can manage your CCTV network by your self. Lets take a look the schematic picture below!

Based on the schematic picture above, we have the internet connection with static public IP connected to port 1 of wan mikrotik interface named as internet. The internet goes into the router and out to the network through port 4 of local network interface named as localnet-3. Then the Internet connection which is already masquerade by the router will be shared to the local area network using switch/hub. DVR CCTV server as the device client of the local network must be set using static IP, it can be done by setting DVR server lonely like you set the IP the configuration on the PC client that uses static IP. DVR CCTV server usually has the port that you can set manually, or just leave the port number by default manufacture, you just need to know what the port that used to access DVR as CCTV server.

As probably you know, there are two kind of the cameras/CCTV such as Analog Camera which is using coaxial cable, its kind like commonly antenna cable television connected to DVR and IP Camera which is using LAN cable. Surely when you buy the cameras you must know the kind of DVR as the camera server, its using coaxial cable or LAN cable that will connected to. In this implementation I was used Analog Cameras and The DVR. DVR will act as the server of cameras to view and record the showing what the camera captures.

In this case I am not showing you how to setup DVR as the server, its probably a less of my record. But trust me it is easy its depends on the brand of your DVR that you have. If you want to setup the DVR, you can connect the screen, maybe PC monitor must be connected to DVR, you can plug in PC mouse and keyboard if needed, then start on the DVR. DVR will ask you the login password to access DVR menu. The default login may you can find at the body chasing of DVR itself. After you have logged in, you begin to setup DVR configuration, its truly depending on yours. Just for the reference:

IP address (static) : 192.168.3.5
Subnet Mask: 255.255.255.0
Default Gateway (real) : 192.168.3.1
Preferred dns server : 8.8.8.8
Alternate dns server : 8.8.4.4

Media Port : 34567
Mobile Port: 5000

So that is the point of DVR configuration, once again its depending on your network environment that you have. Some of DVR may does not have or provide you Media Port. In this condition you have to access the camera server just from the mobile port by your mobile phone through internet from outside of your network.

As the schematic picture, let's assume:

Mikrotik Router Configuration:

Wan/public Interface : Internet
Public Network : 114.6.112.92/30
Gateway IP : 114.6.112.93
Public IP: 114.6.112.94

Lan/Local Interface : localnet-3
Local Network : 192.168.3.0/24
Gateway IP : 192.168.3.1

PC Security Monitor:

IP address (dynamic) : 192.168.3.13
Subnet Mask: 255.255.255.0
Default Gateway (real) : 192.168.3.1
Preferred dns server : 8.8.8.8
Alternate dns server : 8.8.4.4

According to this condition, what would you like to do?

1. Access DVR CCTV Server Displaying the Cameras View from Local Network

Our aim to access DVR CCTV server through local network in the same local port interface of mikrotik router we don’t need to add or create the new rules of the mikrotik configuration that has been run. If your DVR has provided the Camera Client View software, you can install the software on PC client, in this case is PC Security Monitor. But if your DVR doesn’t provide any software, you may need third party software like CMS2000. I believe you just like free software!

The you make the configuration to access DVR CCTV server from local network in the same interface or DHCP server of the router. Create the name of the configuration, login password for DVR that you have setup earlier, insert DVR IP address and media port that’s used to access DVR server. Some people commonly use 34567 | 7000 | 8000 | 9000 as media port DVR. Just my opinion leave the port configuration by default manufacture for not invite any trouble during the setup.

If you have got the problem in accessing DVR CCTV server from local network, it most probably caused by PC client that you have used is in different interface or network/subnet. When you using different interface like this, you may need to setup the bridge on the router, or you just can access from public IP router itself. So to avoid any problem during the configuration, simply just put PC client monitoring in the same interface or network of the router. Another thing that could be the cause is firewall filter rules on the router that may block the connection. DVR server is hang can be the cause of the problem too, try reset the DVR. The last possibility is DVR is broken system, buy the new one, lol!

2. Access DVR CCTV Server Displaying the Cameras View from Internet

This will be the main thing that I want to explain, which is the main goal is how we can access DVR CCTV camera everywhere as long as we have internet connection. This is the way how we can access the cameras through public IP of the Mikrotik as the router of the network where the DVR CCTV is located. Lets assume that we have public IP which is not changed or static 114.6.112.94. So knowing your ISP internet connection IP, you have private Public IP or not.

We should create the new rules port forwarding media and mobile port DVR on firewall nat Mikrotik. The same kind like what I have done as the article Building Web Hosting Server. So have to create two rules port forwarding for each port DVR like below!

/ip firewall nat
add action=dst-nat chain=dstnat comment="CCTV Media Port Fowarding" dst-address=114.6.112.94 dst-port=34567 protocol=tcp to-addresses=192.168.3.5 to-ports=34567
add action=dst-nat chain=dstnat comment="CCTV Mobile Port Fowarding" dst-address=114.6.112.94 dst-port=5000 protocol=tcp to-addresses=192.168.3.5 to-ports=5000

Simply I just can say, we do CCTV media port forwarding to public IP media port will be forwarding to DVR IP media port that just using TCP protocol. This will allow you in order to access DVR CCTV server through public IP using PC or laptop with camera client view software like CMS2000.

On the other part, we also add the rule for CCTV mobile port forwarding, that will allow you to access DVR CCTV server using mobile device with any mobile application like HDIVS. HDIVS is available on android and iOS of your mobile phone.

We have done in adding the rules port forwarding on mikrotik firewall nat, next we ready to install camera client view software on PC/laptop (CMS2000) and camera client view app on mobile device(HDIVS). Just like what we have been done like we setup Local Access DVR CCTV Server Displaying the Cameras View from Local Network, but now we are going to use the Public IP on the configuration as shown like the picture below!

The picture above is how we configure the camera client view software in this case CMS2000 on the laptop to access the camera from public IP DVR Server. It assumes you have private public IP from your ISP on DVR CCTV server.

In the most cases you gonna need to access the camera just wherever you want. For this kind purposes you have to setup camera client app on your mobile device that has connection to the internet. The picture below is how you can configure HDIVS app on your mobile device!

If you have found any problem in accessing DVR CCTV Server Displaying the Cameras View remotely through internet or public IP. Try to cross check you have the right way in creating the new rules port forwarding media and mobile port DVR on firewall nat Mikrotik about public IP of DVR server side. Make sure access media and mobile port has been opened. Go to yougetsignal.com type your public IP with media and mobile port that should be opened, like the picture below!

It’s impossible to access the camera remotely through internet since you have found the port is still closed. Try to check the firewall rules and make sure there’s no rule has block the port access. In most cases try to reboot the DVR CCTV Camera Server.

So that’s the concept how we can access DVR CCTV Camera Server from local network and remotely through public IP. Perhaps some of you have wondering how about if we have just dynamic public IP on the camera server. It can be solve by accessing from ddns domain name.

Please read how setup noIP on the article Build Web Hosting Server by self Using Dynamic IP. After you have domain name on noip.com and related to your dynamic public IP, you must keep it in up to date by using Script Automatic Update Dynamic IP into the router like the script below!

/system script
add name=no-ip_ddns_update policy=read,write,test source={
 :local noipuser "your_user_login_noIP"
 :local noippass "your_password_login_noIP"
 :local noiphost "yourdomain.ddns.net"
 :local inetinterface "your_wan_interface_router"
 :global previousIP
 :if ([/interface get $inetinterface value-name=running]) do={
  :log info "Fetching current IP"
  /tool fetch url="https://www.trackip.net/ip" mode=http dst-path=mypublicip.txt
  :local currentIP [/file get mypublicip.txt contents]
  :log info "Fetched current IP as $currentIP"
  :for i from=( [:len $currentIP] - 1) to=0 do={
   :if ( [:pick $currentIP $i] = "/") do={
    :set currentIP [:pick $currentIP 0 $i]
   }
  }
  :if ($currentIP != $previousIP) do={
   :log info "No-IP: Current IP $currentIP is not equal to previous IP, update needed"
   :set previousIP $currentIP
   :local url "http://dynupdate.no-ip.com/nic/update\3Fmyip=$currentIP"
   :local noiphostarray
   :set noiphostarray [:toarray $noiphost]
   :foreach host in=$noiphostarray do={
    :log info "No-IP: Sending update for $host"
    /tool fetch url=($url . "&hostname=$host") user=$noipuser password=$noippass mode=http dst-path=("no-ip_ddns_update-" . $host . ".txt")
    :log info "No-IP: Host $host updated on No-IP with IP $currentIP"
   }
  }  else={
   :log info "No-IP: Previous IP $previousIP is equal to current IP, no update needed"
  }
 } else={
  :log info "No-IP: $inetinterface is not currently running, so therefore will not update."
 }
}

/system scheduler
add interval=2m name=no-ip_ddns_update on-event=no-ip_ddns_update policy=read,write,test comment="Update No-IP DDNS" disabled=no

By using Script Automatic Update Dynamic IP, the router will working in updating your Dynamic IP still related to ddns domain noip in order to access the camera. In this condition we do a little bit changed for the rules port forwarding DVR CCTV Camera Server that is no longer using public IP, otherwise it must be refer to wan interface router like the rules below!

/ip firewall nat
add action=dst-nat chain=dstnat comment="CCTV Media Port Fowarding" in-interface= your_wan_interface_router dst-port=34567 protocol=tcp to-addresses=192.168.3.5 to-ports=34567
add action=dst-nat chain=dstnat comment="CCTV Mobile Port Fowarding" in-interface= your_wan_interface_router dst-port=5000 protocol=tcp to-addresses=192.168.3.5 to-ports=5000

That’s all about the accessing DVR CCTV Camera Server on our Mikrotik network, for more clearly, you may need watching the video, have a good day!

Smart and Powerful Way to Block Netcut Software on Mikrotik

noreply@blogger.com (Agratitudesign) — Mon, 21 Aug 2017 15:03:00 +0000

Netcut is the software that has an ability to control the internet connection in the same network interface of the router. By scanning IP address to all the device that connected with the same network. Netcut can be used to get and take over the network client devices and can do anything with the internet connection for all devices as the network clients. Netcut is used by someone inside the local network as part of our network clients. It most probably used on wifi connection after the client is login.

There are some kind Netcut software out of there. But one of the most powerful netcut software which is has very complete ability as I have found so far is P2pover. First I know P2pover is used by my client that want to cut another network clients for the internet connection. Hoping to get faster internet connection of other clients. I was very surprised this kind netcut, because it is really work, this software can be used to manage our bandwidth clients like an admin of the network. P2pover can cut or drop, limit, filter and others inside our network. As an admin, it might be an alternative way to manage the internet usage by the clients. But if the client is used, it could be a big problem. One client that uses this kind netcut software will tend to do a bed thing to another clients for their personal reasons.

As the picture above the client that used P2pover which is without any login the software, it will able to scan all the clients IP in the same network. After that can be create or define the rules to limit the internet speed like we are doing as an admin on mikrotik. It is possible until kill or cut the internet connection to another clients until out of the network. If more than one client do like this, you can imagine what would happen with our network services. We as the admin or IT network just receive much complain that will be angry with a this chaos, and most probably one of them will be gone. This would be a terrible threat, does it not? You are in the same boat, we must dealt with some kind the netcut software, so that no netcut anymore between our network clients and the mikrotik.

In order to prevent from netcut attack on mikrotik network, there a few method to do so. Some tutorial may advice such as creating any rules to block netcut on firewall filter mikrotik. Prevent the clients creating static IP by themselves so that the IP address that used by any clients just come from dhcp server on mikrotik, like the picture below!

For such kind netcut software like P2pover, none of those method that I mention above during my experiment to block P2pover, it won't work perfectly. It looks like need another way that can strictly and powerful to block P2pover on our mikrotik network. Especially for you that is using wireless interface of mikrotik you must isolate communication between the clients by disable default forward so the clients can not communicate each other. The same thing if you have use wireless router like TP-link try to enable AP isolation.

This is one of the most powerful way in order to stop at all the netcut and protect the clients on our mikrotik network. This is the smart method by using trick to hide the real IP gateway from netcut, so that the netcut will never know the access gateway for the interfaces that we have used on mikrotik router. Ok I assumes that you have used 4 local network interfaces and 1 public interface as reflected by the rules below!

Configuration Before Block Netcut is Implemented on Mikrotik

/ip address
add address=192.168.1.2/24 interface=internet network=192.168.1.0
add address=192.168.2.1/24 interface=localnet-1 network=192.168.2.0
add address=192.168.3.1/24 interface=localnet-2 network=192.168.3.0
add address=192.168.4.1/24 interface=localnet-3 network=192.168.4.0
add address=192.168.5.1/24 interface=localnet-4 network=192.168.5.0

And dhcp server network would be like this rules:

/ip dhcp-server network
add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.1
add address=192.168.3.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.3.1
add address=192.168.4.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.4.1
add address=192.168.5.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.5.1

We are going to hide the real IP gateway that used by every local network of the router interfaces. This method has found by someone from many many experiment. It looks like little funny by using fake IP gateway on dhcp server network such as:

dhcp gateway IP for localnet-1 : 1.1.1.1
dhcp gateway IP for localnet-2 : 2.2.2.2
dhcp gateway IP for localnet-3 : 3.3.3.3
dhcp gateway IP for localnet-4 : 4.4.4.4

Change the gateway IP of dhcp server network for each interfaces that you want to protect our network clients against netcut or remove dhcp server network rules and insert the new rules for dhcp server network like this:

Configuration After Block Netcut is Implemented on Mikrotik

/ip dhcp-server network
add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=1.1.1.1
add address=192.168.3.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=2.2.2.2
add address=192.168.4.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=3.3.3.3
add address=192.168.5.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=4.4.4.4

So the result of dhcp server network after changing would be like this!

In order to make this gateway IP work, we need to add the new rules of network IP address for each interfaces. The rules that we need to add would be like this!

/ip address
add address=1.1.1.1/24 interface=localnet-1 network=1.1.1.0
add address=2.2.2.2/24 interface=localnet-2 network=2.2.2.0
add address=3.3.3.3/24 interface=localnet-3 network=3.3.3.0
add address=4.4.4.4/24 interface=localnet-4 network=4.4.4.0

It looks like little bit funny or non theoretical, but its really realy work, it will not effect anything with the internet connection for all the network clients. It just hide the real gateway IP and make the netcut software stuck will never know the right gateway IP for every network router interfaces. Finally no netcut anymore between mikrotik and network client.

My notice here if sometime you want to use external wifi router to interface that have been setup to be anti netcut, you should not use automatic configuration on external wifi router. But you have to setup manually of wan interface gateway that must be using the real gateway IP from the mikrotik router interfaces. That’s all about the smart and powerful way to stop netcut on mikrotik, give a try! and for more clearly lets watch the video! See you!

Build Web Hosting Server On Mikrotik Double Router Port Forwarding and Script Automatic Update Dynamic IP

noreply@blogger.com (Agratitudesign) — Sat, 19 Aug 2017 16:56:00 +0000

On this occasion, I’d like to explain how to build web hosting server as our own, at our home on our PC. This is Part II of Building Web Hosting Server but now we are using double or multiple router port forwarding technique using Mikrotik as the router of local network. The script automatic update dynamic public IP that most probably we have to the No-IP sub domain. The script will run automatically by system scheduler, and check our current public IP every time its changed the script will send the current IP to the noip.com server, and noip.com will know that the sub domain that we have should be updated to the current IP, and finally your sub domain still keep represent as your current public IP. So we don’t need “Dynamic Update Client” app of noip.com because this job will be handle by the script that will run on mikrotik, without burdening the web hosting server with the application.

Perhaps amongst of you will ask, why we need to use double router or multiple router ? so the reason is depending on your needs. Personally for me as you can see like the picture above ZTE Optical Router by ISP I have limited to manage everything to my network clients. Other than me as just the user of the ISP router that have limited to manage the router, Mikrotik is the programable router, I can manage my Bandwidth of my web hosting server amongst of other network clients as I see fit. I don’t want my web hosting server lack of bandwidth because of the internet purpose of other Pc clients on my local network.

1. The First Router Port Forwarding for TCP and UDP Protocol

In this case I am using ZTE Optical Router from ISP, I still have the access to the router as user login. I can setup port forwarding configuration of the public IP router ISP that is using port:80 to the Public IP wan interface my Mikrotik router that is using the some port:80. As you can see as the above schematic picture, dynamic public IP 36.85.254.229:80 will be forwarding to private public IP Mikrotik 192.168.1.2:80 that is using TCP and UDP protocol.

Try to find port forwarding feature if your ISP is not using ZTE optical router, it should be any on many kind of the router. But if you have Mikrotik as the first router, you can add the rules on firewall NAT like this! Please change public interface name and public/wan IP that will be the second router!

/ip firewall nat
add action=dst-nat chain=dstnat in-interface=internet dst-port=80 protocol=tcp to-addresses=192.168.1.2 to-ports=80 comment="TCP port forwarding"
add action=dst-nat chain=dstnat in-interface=internet dst-port=80 protocol=udp to-addresses=192.168.1.2 to-ports=80 comment="UDP port forwarding"

It means the incoming connection that comes from public IP that is using port 80 will be forwarding to private public IP of the public/wan interface of the second router.

2. The Second Router Port Forwarding for TCP and UDP Protocol

Next we have plan to put our web hosting server as the PC client of local network of Mikrotik as the second router. We need to setup the second router port forwarding that will fowarding connection from public/wan IP on the second router Mikrotik that is using port 80 to the IP web hosting server as the client of local network second router mikrotik that is using port 8080. So we need add 2 rules on firewall NAT of the second router mikrotik like this!

/ip firewall nat
add chain=dstnat dst-address=192.168.1.2 action=dst-nat protocol=tcp to-addresses=192.168.2.254 to-ports=8080 comment="port forwarding router IP to the client"
add chain=dstnat dst-address=192.168.1.2 action=dst-nat protocol=udp to-addresses=192.168.2.254 to-ports=8080

At this time we have done to setup double router port forwarding on the two router. The condition now is if any incoming connection that comes from public IP on the first router that is using port 80 will be forwarding to the IP of web hosting server by double router port forwarding.

3. Adjustment Server Configuration on Local Network As Web Hosting Server

If you follow the previous article, its nothing different then what we have done to Build Web Hosting Server that used Single Router. Just make sure, the IP address of web hosting server should be set 192.168.2.254 as the static IP on the ethernet adapter configuration of LAN related to the second port forwarding. The windows firewall should not block wamp server as the web server application, and create the rules that allow TCP and UDP Port 8080. On Apache httpd.conf of wamp server

httpd.conf : C:\wamp64\bin\apache\apache2.4.23\conf

Find the text with “Listen” and change

Listen 0.0.0.0:80 -> Listen 0.0.0.0:8080
Listen [::0]:80 -> Listen [::0]:8080

Find the text with “ServerName” and change

ServerName localhost:80 -> ServerName 192.168.2.254:80
Find the text with “onlineoffline” and change
Require local -> Require all granted

Optional:

DocumentRoot "${INSTALL_DIR}/www/agratitudesign"
<Directory "${INSTALL_DIR}/www/agratitudesign/">

phpmyadmin.conf : “C:\wamp64\alias”

Require local -> Require all granted

4. Script for Automatic Update Dynamic Public IP to No-IP Domain on Mikrotik.

The second router Mikrotik as the programmable router that allow us to do the job like Dynamic Update Client to keep update your sub domain noip.com related to the dynamic Public IP ISP that would be changed at anytime. The System Script for Automatic Update Dynamic Public IP to No-IP will be join with system scheduler.

/system script
add name=no-ip_ddns_update policy=read,write,test source={
:local noipuser "agratitudesign"
:local noippass "Password"
:local noiphost "agratitudesign.sytes.net,agratitudesign.ddns.net"
:local inetinterface "internet"
:global previousIP
:if ([/interface get $inetinterface value-name=running]) do={
:log info "Fetching current IP"
/tool fetch url="https://www.trackip.net/ip" mode=http dst-path=mypublicip.txt
:local currentIP [/file get mypublicip.txt contents]
:log info "Fetched current IP as $currentIP"
:for i from=( [:len $currentIP] - 1) to=0 do={
:if ( [:pick $currentIP $i] = "/") do={
:set currentIP [:pick $currentIP 0 $i]
}
}
:if ($currentIP != $previousIP) do={
:log info "No-IP: Current IP $currentIP is not equal to previous IP, update needed"
:set previousIP $currentIP
:local url "http://dynupdate.no-ip.com/nic/update\3Fmyip=$currentIP"
:local noiphostarray
:set noiphostarray [:toarray $noiphost]
:foreach host in=$noiphostarray do={
:log info "No-IP: Sending update for $host"
/tool fetch url=($url . "&hostname=$host") user=$noipuser password=$noippass mode=http dst-path=("no-ip_ddns_update-" . $host . ".txt")
:log info "No-IP: Host $host updated on No-IP with IP $currentIP"
}
} else={
:log info "No-IP: Previous IP $previousIP is equal to current IP, no update needed"
}
} else={
:log info "No-IP: $inetinterface is not currently running, so therefore will not update."
}
}

/system scheduler
add interval=5m name=no-ip_ddns_update on-event=no-ip_ddns_update policy=read,write,test comment="Update No-IP DDNS" disabled=no

Insert the script above to the new terminal winbox! the system script and scheduler should be set with policy=read,write,test. Change on the script that I have marked as red color, depending on your noip.com account and the public interface name on your mikrotik router as the second router. The system schedule will run every 5 menit as the interval that we set to execute the related system script. Then the system script will watch your current public IP, if it is changed from the previous public IP, the script will send the request to your noip.com account to update the related IP for sub domain that we have setup. But if the current public IP is not changed is nothing to send request to noip.com server.

Actually build web hosting server, its not such a big deal. It doesn’t matter, perhaps you need triple or multiple router port forwarding. We just only understand the principle Port forwarding techniques and how to make the firewall is not blocking the port forwarding process running on the server. That’s it… let’s see the video for more clearly, good job!

Build Web Hosting Server by self Using Dynamic IP, Wamp Server with Router Port Forwarding

noreply@blogger.com (Agratitudesign) — Thu, 17 Aug 2017 07:17:00 +0000

At this moment I am going continue my experiment in order to build Web Hosting Server as my own self on my personal computer (PC). Web Hosting Server that I am going to build is on our PC server which is one of my PC client on my network that is using just one router port forwarding at this time. Here The equipment environment that I used:

a. Wamp Server : Windows Web development environment with 3 packages in one, that is Apache, MySQL, PHP. Wamp Server itself require its dependency that is The Visual C++ Redistributable Packages that must be installed before you install wamp server to make it run on windows.

b. Network Router : It is depending on your network environment of the internet connection that you have use from your ISP (Internet Service Provider). In this case the ISP using their router to provide internet connection that is ZTE optical router. But it doesn’t matter If you use Mikrotik that directly connected to Public IP of internet.

c. No-IP Account: This is for you who no have IP from ISP. No-IP means that you have no private or static public IP. Of course you have public IP but always changed at anytime. Using noip.com will make it possible to create any domain still keep related to your dynamic Public IP.

d. Website Project Files: the files of your website that you have build and need to launch so that you can access the website from outside using internet. In this case I have use wordpress for the complete example the website that using PHP and database Mysql to test Web Hosting Server that we are going to make it.

Before we begin lets take a look the image schema above! I am using the ISP router directly connected to the switch/hub before connected to the local network PC clients. The Web Hosting Server as the PC client can be connected directly to the router or use switch/hub in between if you more than one PC clients. The Web Hosting Server get the IP from ZTE Optical Router with dhcp server inside the router system by ISP. After thay we need to set the IP of Web Hosting Server to be static. We can setup or define the static IP through windows ethernet adapter.

As you can see, the Web Hosting Server as of the client local network already set to be static IP 192.168.1.9 and use the IP gateway 192.168.1.1 of the local network of the router, in this case ZTE Optical router. After that we need to setup port forwarding from the router in order to access the Web Hosting Server through public IP of our internet connection.

Ok lets begin step by step in detail how to build Web Hosting Server for Dynamic Public IP using single router. If you have different kind of the router by your ISP, try to find the port forwarding feature that allow you to setup port forwarding!

1. Get Free Sub Domain noip.com as the Domain Name your Public IP

If you have no the account yet, let you register first to make your account on noip.com, then define any sub domain that you will use as the domain name of website project that you want to launch as live web server.

Noip.com has nice domain name, its easy to remember. But as free user we have limited to create the sub domain on it, and has expiration date. But we still have chance to update the sub domain that we have created every month. If you have more funds you can upgrade to be premium user of the noip.com account.

As you can see, the sub domain is related to the IP target that is our current Public IP right the way. But how about when the public IP has changed. Noip.com has provide the app that you must be install on one of PC clients as the client of the local internet network that still using the same Public IP.

You can download Dynamic Update Client app from the site and install it to PC client on the local network. Using this app will keep the sub domain that we have just created still related to our dynamic Public IP. Every time our Public IP is changed, this app will get our current IP and send the request to noip.com to update the sub domain IP from the previous IP to current IP of our public IP. Please keep this app running as the background.

2. Setup Router Port Forwarding Public IP to the Web Hosting Server

Don’t worry If you have another kind of the router, try to find where the port forwarding feature is. The principle is you setup port forwarding for TCP and UDP protocol of public interface router on port 80 to the IP local network client as the web hosting server on port 8080. We can not using port 80 of the web hosting server, cause most probably port 80 on it is busy.

ZTE router is such kind of the instant or simple router. As you can see, how easy to setup port forwarding on it. But for you Mikrotik lover, perhaps ask to me, why not using Mikrotik. Ok assuming you have use Mikrotik as your router and connected directly to the external/public IP. Or maybe your ISP use mikrotik router to provide their internet connection to you. So this is single mikrotik router port forwarding rules that you must add to the nat firewall as follow:

/ip firewall nat
add action=dst-nat chain=dstnat in-interface=internet dst-port=80 protocol=tcp to-addresses=192.168.1.9 to-ports=8080 comment="TCP port forwarding"
add action=dst-nat chain=dstnat in-interface=internet dst-port=80 protocol=udp to-addresses=192.168.1.9 to-ports=8080 comment="UDP port forwarding"

We require two rules on firewall nat, change in-interface name, it depends on public interface name on your mikrotik configuration. So that we also create port forwarding for TCP and UDP protocol.

3. Installing Wamp Server According to Public IP and Port Forwarding

The process for the Installation of Wamp Server on windows its not such a big deal that I should be explain explicitly. Just go immediately to http://www.wampserver.com/en/, then you can download Wamp Server for the latest version that now is including with php 7.0.10. Don’t forget before install Wamp Server, you must be install its dependency Visual Studio 2012 : VC 11 vcredist_x64/86.exe.

After this you can install Wamp Server itself, before finish the installation, I suppose you to allow Apache http server of Wamp Server running on private and public network on the app windows firewall. Remember we have plan to access Wamp Server as Web Hosting Server through public IP or external IP. So we don’t want app windows firewall blocked Wamp Server.

4. Adjust Wamp Server Configuration and Windows Firewall Rules

We have done to create port forwarding rules on the router, but our job is not finish yet, still need to Add Windows Firewall rules for TCP and UDP port on windows firewall with advanced security and adjust Wamp Server Configuration.

Adjustment Windows Firewall:

It is the very common way but its required. Most probably we fail in building web hosting server because of it, so that we need to add 2 rules to the port 8080 for each TCP and UDP protocols on windows firewall with advanced security like the picture below!

And don't forget to make sure that Wamp Server is allowed to communicate through windows firewall as private and public on app windows firewall like the picture below!

Adjustment Wamp Server Configuration:

Before we adjust Wamp Server Configuration, let you check everything is working properly. Run Wamp Server App and make sure Wamp Server System Tray Icon should be green.

Type localhost, 127.0.0.1, and The IP address 192.168.1.9 as you set as static IP for the server, all should be able to access from your browser to open Wamp Server.

After that you begin to find httpd.conf of Apache configuration file on Wamp Server installation directory. It is according to the place where you put the Wamp Server installation files on your PC. “C:\wamp64\bin\apache\apache2.4.23\conf”. Open httpd.conf with your favorite editor then

Find the text with “Listen” and change

Listen 0.0.0.0:80 -> Listen 0.0.0.0:8080
Listen [::0]:80 -> Listen [::0]:8080
Find the text with “ServerName” and change
ServerName localhost:80 -> ServerName 192.168.1.9:80

Find the text with “onlineoffline” and change

Require local -> Require all granted

For phpmyadmin of Web Server in order to access it through public IP, find phpmyadmin.conf on Wamp Server installation directory “C:\wamp64\alias”. Open phpmyadmin.conf and change

Require local -> Require all granted

This is just an option, in order to access the web project directly rather then access directory root www just by typing public IP or domain name. We need to set DocumentRoot and Directory, still on httpd.conf like this:

DocumentRoot "${INSTALL_DIR}/www/agratitudesign"
<Directory "${INSTALL_DIR}/www/agratitudesign/">

"agratitudesign" is a directory name of the web project files

You have done to adjust Wamp Server Configuration according to router port forwarding. Then you need to restart all the wamp server services, you can do it from Wamp Server System Tray Icon. Everything should be working properly. At this you can access Wamp Server through public IP or your sub domain that you have created on noip.com.

4. Adjust Wordpress Sites from Localhost to Live Web Hosting Server

In this case I am using Wordpress CMS as the example of the Website Project that uses database to work with. Its so many tutorial about how to install wordpress, here I just explain how to adjust Wordpress Website from local configuration to the live web hosting server configuration. Our aim is to test the Web Hosting Server that we have just created.

Ok assuming that you have build Website Wordpress Project to the directory “www” as default document root of Wamp Server. In this example is agratitudesign directory, and I have been move the document root to this directory itself. So that we can access agratitudesign web project just by typing the subdomain of noip.com, that is agratitudesign.sytes.net or agratitudesign.ddns.net. If you don’t how to install wordpress please watching the video of this tutorial for more details.

The most important that I have to tell you, consider that our Wamp Server its not localhost that only can be access from you’re the PC server, but now is the live server that can be access anywhere as long as connected to the internet. Usually we leave “localhost/phpmyadmin” with user root with no password. Imagine that someone type “yoursubdomain/phpmyadmin” they can access the website database with the common login like this. So we are going to create a new login for phpmyadmin of Wamp Server

Create a new user login for phpmyadmin don’t forget activate all global privileges for the user login, after that you can remove the root login, because almost everyone already knows as the default user login for phpmyadmin on windows.

So when we build website wordpress project, we have database name of the site, user login for the database, user login for admin backend for that wordpress site. As usually we do, when we move wordpress project from local to the live web hosting server, we need to adjust wp-config file of wordpress site files

After that we login to the database of this wordpress site, by typing “subdomain/phpmyadmin” with the new login that we have just created. Open the database of the wordpress site and find “wp_options” table and change siteurl and home from localhost to subdomain that we have. Lets see the picture below!

Most probably wordpress website was using hyperlink refers to localhost but now we must change ro subdomain. It would be very painful to do manually one by one to check the database tables. Go to the related database and on SQL tab we insert sql query as follow

UPDATE wp_posts SET post_content = REPLACE(post_content, 'localhost/agratitudesign', 'agratitudesign.sytes.net');

The last is go to wp-admin of the backend wordpress website then select setting > permalinks and update the permalink on the backend.

Well done we have successful to build web hosting server by own self on our local network using dynamic public IP and single router. I have already test the subdomain access, admin backend of wordpess site, the database. Everything is working good, and finally Web Hosting Server is own hands. For more clearly lets watch the video, see you!

Local Port Interfaces same Network different Subnets and Bridge Mikrotik

noreply@blogger.com (Agratitudesign) — Fri, 21 Jul 2017 04:03:00 +0000

As one of the IT staff in a company I have any request for me. How can we manage some local networks using just 1 network address but different subnets. In other word, we use the same network address that will divided by sub network. Yet I just think about when I want to manage some networks in different local port interface router so I divided into different network mask for the local network. But actually we can manage our networks into single network multiple subnets. So this implementation is about the understanding subnetting in ip address of the network. If you already knew it, just forget it! I just go to continue my notes.

For the example about Subnetting Ip Address C Class :

NETWORK ADDRESS = 192.168.1.0/26

Subnet Mask /26 = 11111111.11111111.11111111.11000000 = 255.255.255.192

Number of Subnet = 2^x = 2^2 = 4 segments

Number Host/Subnet = 2^y-2 = 2^6 – 2 = 62 host

Subnet block = 256 – 192 = 64, 64 + 64 = 128, 128+64=192 = 0, 64, 128, 192

x : number of binary 1 of the last 2nd octet

y : number of binary 0 of the last 2nd octet

For more clearly about subnetting IP address you can go to boossit.wordpress.com and for you who want automatic calculation of it, you can go to http://jodies.de/ipcalc

Ok lets get furthermore how we implement it into our Mikrotik router.

Lets say we have the internet connection with the modem that has

IP gateway = 192.168.1.1

We have plan to share the internet connection to our local network

Number of Localnet = 4

The forth local network will be divided into 4 subnets in the same network address

Network Address = 192.168.2.0/24 so our subnets will be

Subnet Localnet1 : 192.168.2.0/26

Subnet Localnet2 : 192.168.2.64/26

Subnet Localnet3 : 192.168.2.128/26

Subnet Localnet4 : 192.168.2.192/26

Reset your router with no default configuration, then we can start how to configure our mikrotik using 1 network address divided by 4 subnets of our local network.

1. Setup identity, DNS server, and NTP client of the Mikrotik router

We begin by setup identity of your router. Sometimes if you have some mikrotik routers, its better we give the name of router to prevent the mistake which one of mikrotik router that now you setup or change. Then we chose the dns server reference and NTP client at first.

/system identity

set name=Agratitudesign

/ip dns

set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4

/system ntp client

set enabled=yes primary-ntp=203.89.31.13 secondary-ntp=82.200.209.236

2. Setup Interface Port Names for all the Ports that will used

Just the name, you can give any interface port names as you like. In this case I was using internet for wan or gateway, and localnet-1, localnet-2, localnet-3, localnet-4 for the local network interface names.

/interface ethernet

set [ find default-name=ether1 ] name=internet

set [ find default-name=ether2 ] name=localnet-1

set [ find default-name=ether3 ] name=localnet-2

set [ find default-name=ether4 ] name=localnet-3

set [ find default-name=ether5 ] name=localnet-4

As the picture above, we use just 1 wan or internet whatever you say, and 2 local port interfaces. No matter if we just use 2 local port, the rest is just spare ports that will ready to use.

3. Setup Network IP address for the Interface Ports and the Route Gateway

For wan or internet interface we use 192.168.1.2/24, start from 192.168.1.2 its because our IP gateway from the ISP router is using 192.168.1.1. So don’t use 192.168.1.1/24 unless the router will not find the gateway of the internet.

/ip address

add address=192.168.1.2/24 interface=internet network=192.168.1.0

add address=192.168.2.1/26 interface=localnet-1 network=192.168.2.0

add address=192.168.2.65/26 interface=localnet-2 network=192.168.2.0

add address=192.168.2.129/26 interface=localnet-3 network=192.168.2.0

add address=192.168.2.193/26 interface=localnet-4 network=192.168.2.0

/ip route

add distance=1 gateway=192.168.1.1

As you can see, we use 192.168.2.1/26, 192.168.2.65/26, 192.168.2.129/26, 192.168.2.193/26 as the Network IP address for local port interfaces. /26 will has 4 subnets or segments of the total range network address hosts.

4. Setup DHCP Server and IP Pools for Our Local Subnet Interfaces

So 1 dhcp server and ip pool is for 1 local subnet interfaces. Because we have 4 local port subnet interfaces, we must create 4 dhcp servers with ip pools.

/ip pool

add name=dhcp_pool1 ranges=192.168.2.2-192.168.2.62

add name=dhcp_pool2 ranges=192.168.2.66-192.168.2.126

add name=dhcp_pool3 ranges=192.168.2.130-192.168.2.190

add name=dhcp_pool4 ranges=192.168.2.194-192.168.2.254

/ip dhcp-server

add address-pool=dhcp_pool1 disabled=no interface=localnet-1 name=dhcp1

add address-pool=dhcp_pool2 disabled=no interface=localnet-2 name=dhcp2

add address-pool=dhcp_pool3 disabled=no interface=localnet-3 name=dhcp3

add address-pool=dhcp_pool4 disabled=no interface=localnet-4 name=dhcp4

/ip dhcp-server network

add address=192.168.2.0/26 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.1

add address=192.168.2.64/26 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.65

add address=192.168.2.128/26 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.129

add address=192.168.2.192/26 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.193

5. Create Localnets Masquerade Nat rules on Firewall Nat

We have 4 masquerading nat rules on firewall nat. If you want to make off of or disable the internet connections for those local port subnet interfaces, you can do it by disable this rules that you want to make off.

/ip firewall nat

add action=masquerade chain=srcnat out-interface=internet src-address=192.168.2.0/26 disabled=no comment="localnet-1"

add action=masquerade chain=srcnat out-interface=internet src-address=192.168.2.64/26 disabled=no comment="localnet-2"

add action=masquerade chain=srcnat out-interface=internet src-address=192.168.2.128/26 disabled=no comment="localnet-3"

add action=masquerade chain=srcnat out-interface=internet src-address=192.168.2.192/26 disabled=no comment="localnet-4"

For any new of the mikrotik router configuration, we should try to reboot the router, for all the rules on it is working stable and actual like we were setup before. After this, you should can use the internet connection from each local port subnet interfaces. Then from the clients side, you can see what the IP number and IP gateway they get from.

6. Setup Bridge for Local Network Port Subnet Interfaces

Obviously the clients on different network or sub network that use different interface can not communicate the data one another thorough local networks. This is why we have to setup the bridge for those clients that was using different port interface on your router.

The picture above is client subnet 1 is remote client subnet 2 that is using chrome remote desktop thorough internet connection. Client 1 and Client 2 are using different interface of the router. Event we share the file folder on the clients, we still could not see the file folder that have shared thorough local network.

So what will we do now is setup the bridge for each local subnet interface on mikrotik router. Open your winbox and insert this kind rules.

/interface bridge

add name=bridge_localnet

/interface bridge port

add bridge=bridge_localnet interface=localnet-1

add bridge=bridge_localnet interface=localnet-2

add bridge=bridge_localnet interface=localnet-3

add bridge=bridge_localnet interface=localnet-4

Setup bridge on each interface is like you merge the interfaces and follow dhcp server of the bridge interface that you have to setup. If you stop in this step, of course it will make all local network broken, because the clients using dhcp server for each interface that now already merge.

What we have to do is change one of localnet dhcp server to the bridge interface name, in this case bridge_localnet like the picture below. Or you can create a new rule for the bridge dhcp server like this

/ip address

add interface=bridge_localnet address=192.168.2.1/24

/ip pool

add name=dhcp_pool_bridge ranges=192.168.2.2-192.168.2.254

/ip dhcp-server

add address-pool=dhcp_pool_ disabled=no bridge interface=bridge_localnet

/ip dhcp-server network

add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.1

The local subnet network will working again which is no longer using each own subnet dhcp server, otherwise is using one of the bridge dhcp server. Lets check the client get the IP, and now you can share the file folder that you want it. As the picture below the network sharing for each client across the interface router.

That’s all that I can inform you depending on experiment about implementing subnet on local port interfaces and setup the bridge interfaces on dhcp server Mikrotik router. For more clearly lets the video!

Related to this topic here the complete rules if we don’t require to use subnetting for the local port interfaces Mikrotik router!

/system identity

set name=Agratitudesign

/ip dns

set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4

/system ntp client

set enabled=yes primary-ntp=203.89.31.13 secondary-ntp=82.200.209.236

/interface ethernet

set [ find default-name=ether1 ] name=internet

set [ find default-name=ether2 ] name=localnet-1

set [ find default-name=ether3 ] name=localnet-2

set [ find default-name=ether4 ] name=localnet-3

set [ find default-name=ether5 ] name=localnet-4

/ip address

add address=192.168.1.2/24 interface=internet network=192.168.1.0

add address=192.168.2.1/24 interface=localnet-1 network=192.168.2.0

add address=192.168.3.1/24 interface=localnet-2 network=192.168.3.0

add address=192.168.4.1/24 interface=localnet-3 network=192.168.2.0

add address=192.168.5.1/24 interface=localnet-4 network=192.168.2.0

/ip route

add distance=1 gateway=192.168.1.1

/ip pool

add name=dhcp_pool1 ranges=192.168.2.2-192.168.2.254

add name=dhcp_pool2 ranges=192.168.3.2-192.168.3.254

add name=dhcp_pool3 ranges=192.168.4.2-192.168.4.254

add name=dhcp_pool4 ranges=192.168.5.2-192.168.5.254

/ip dhcp-server

add address-pool=dhcp_pool1 disabled=no interface=localnet-1 name=dhcp1

add address-pool=dhcp_pool2 disabled=no interface=localnet-2 name=dhcp2

add address-pool=dhcp_pool3 disabled=no interface=localnet-3 name=dhcp3

add address-pool=dhcp_pool4 disabled=no interface=localnet-4 name=dhcp4

/ip dhcp-server network

add address=192.168.2.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.2.1

add address=192.168.3.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.3.1

add address=192.168.4.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.4.1

add address=192.168.5.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.5.1

/ip firewall nat

add action=masquerade chain=srcnat out-interface=internet src-address=192.168.2.0/24 disabled=no comment="localnet-1"

add action=masquerade chain=srcnat out-interface=internet src-address=192.168.3.0/24 disabled=no comment="localnet-2"

add action=masquerade chain=srcnat out-interface=internet src-address=192.168.4.0/24 disabled=no comment="localnet-3"

add action=masquerade chain=srcnat out-interface=internet src-address=192.168.5.0/24 disabled=no comment="localnet-4"

/interface bridge

add name=bridge_localnet

/interface bridge port

add bridge=bridge_localnet interface=localnet-1

add bridge=bridge_localnet interface=localnet-2

add bridge=bridge_localnet interface=localnet-3

add bridge=bridge_localnet interface=localnet-4

/ip address

add interface=bridge_localnet address=192.168.2.1/24

/ip pool

add name=dhcp_pool5 ranges=192.168.2.2-192.168.2.254

/ip dhcp-server

add address-pool=dhcp_pool5 disabled=no interface=bridge_localnet

/ip dhcp-server network

add address=192.168.2.0/24 gateway=192.168.2.1

Setup PPPoE Connection to Mikrotik using Biznet ISP

noreply@blogger.com (Agratitudesign) — Tue, 04 Jul 2017 16:29:00 +0000

For everyone who have an internet connection from an ISP that is using PPPoE connection (Point to Point Protocol over Ethernet) it may be slightly different with how to setup it into Mikrotik router to your local internet network. Here we do not need to setup rule Ip address for the internet gateway as WAN. Instead we will use the PPPoE Client setup as a virtual interface of the gateway or wan. For you who want to learn more about the PPPoE connection, please read wiki.mikrotik.com.

Well I think you don’t waste time, lets go how to setup PPPoE Connection to Mikrotik. In here, I am using Biznet ISP as the axample for ISP that uses PPPoE Connection for their Internet. Its most commonly the same as how we setup the internet connection to mikrotik as usuall. Ok let you reset your mikrotik with no default configuration at first, before we can start.

1. Set the name for the interface Ethernet

We put the gateway/wan cable on port1 and the local network cable on port2 on the router. So then the name of ether1 will be biznet-internet and ether2 will be lan-localnet, the rest of the ethernet ports just leave it. Again as usual we just need two rules on it.

/interface ethernet
set [ find default-name=ether1 ] name=biznet-internet
set [ find default-name=ether2 ] name=lan-localnet

2. Setup ip address just for local networks

It is not like usual since we were using internet connection for the ISP that was using IP gateway such as Indosat. We don’t need to setup ip address for wan network mask, instead we are going to define the route for internet gateway with PPPoE Client later. In this case we just have 1 local network so the rule is just one.

/ip address
add address=192.168.1.1/24 interface=lan-localnet network=192.168.1.0

3. Setup PPPoE client for the ISP Connection on the Router

It would be the core of PPPoE setup on Mikrotik router. In this case we set MikroTik RouterOS to be a PPPoE client, we define the interface name here. Obviously we must to know the login or authentication for PPPoE connection for the ISP.

/interface pppoe-client
add add-default-route=yes disabled=no interface=biznet-internet name=BIZNET password=xxxxxxxx user=yyyyyyyyyy

4. Dns server on the routerOS for PPPoE Connection

Yet we can know that sometimes we don’t need to setup dns server on the RouterOS. It will be created automatically during we were setting PPPoE client configuration. But in another case we still need to set the dns server on the routerOS. The only thing that we can do is make sure that the routerOS have already get Dns Server from PPPoE ISP dns itself. Optionally we can add static Dns Server manually.

/ip dns
set allow-remote-requests=yes cache-size=5000KiB max-udp-packet-size=512 servers=203.142.82.222,203.142.84.222

If we already insert the rules for dns server, try to remove all the static dns server until the routerOS has dynamic dns server. This will be the cause of the setup PPPoE intenet connection on Mikrotik router fails.

5. Masquerade Public Traffic for Lan and Setup DHCP server

This configuration rule is like usually we do, but let me give you the note. Masquerade Public Traffic on as NAT rule is using out-interface BIZNET not biznet-internet. It must take the interface name from the PPPoE client that we have just setup.

/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade Public Traffic" out-interface=BIZNET src-address=192.168.1.0/24

the rest is creating dhcp server to provide the IP address for our local network clients

/ip pool
add name=dhcp_pool1 ranges=192.168.1.2-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=lan-localnet name=dhcp1
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1

I think it is enough already. If it is not so clear for you, lets see the video below!

Effective Way Bandwidth Management with Fasttrack Firewall Filter

noreply@blogger.com (Agratitudesign) — Wed, 28 Jun 2017 17:40:00 +0000

I am happy at this occasion, I have time to share one of the other article about how to manage the internet bandwidth from the ISP to the local network for some kind internet purposes effectively. I hope it can be one of the reference for you to manage the internet connection as you intended. Of course you have to understand about your internet network environment that you have, so that you can implemented my article as you needed.

What I explain this time is about the effective Way about Bandwidth Management of Mikrotik router with the new feature rules on ROS version 6.xx using Fasttrack Firewall Filter rules. This method will combining with Mangle, Queue Tree and PCQ rules, so that we can manage the internet connection to our network ideally, and prioritization the connection packet that we want to get priority as we like.

1. Upgrade Mikrotik Router OS to the Latest Version

Fasttrack Firewall Filter is the new feature rules of the router OS version 6.xx. At this time I am using ROS version 6.39.2. If you still use version 5.xx, please upgrade your router OS to the latest version at first before we can implemented this rules! In the other hand, upgrading the router OS can fix any problem in the router system that caused by any bug on the system that need to be fixed by upgrade or update to the latest of ROS. Don’t know how to upgrade ROS let’s see this video!

2. Basic Configuration Of Mikrotik Router

In this implementation, I don’t want any conflict between many rules that we don’t understand exactly what they do. So better we begin from scratch of the basic configuration router by resetting the previous router configuration. Open winbox the System > Reset Configuration, don’t forget, given the check mark on default configuration. Router will reboot automatically and reset the configuration, Let see the picture below!

After this we can start from scratch, assuming that you put gateway/wan at port 1 and localnet/lan at port 2 of your router. No matter how much localnet that you have planned, in this case I just use 1 localnet. So here it the rules that you must insert as the basic configuration of your router!

/interface ethernet
set [ find default-name=ether1 ] name=ether1-internet
set [ find default-name=ether2 ] name=ether2-localnet
set [ find default-name=ether3 ] name=ether3-slave-local
set [ find default-name=ether4 ] name=ether4-slave-local
set [ find default-name=ether5 ] name=ether5-slave-local
/ip address
add address=192.168.1.2/24 interface=ether1-internet network=192.168.1.0
add address=192.168.88.1/24 interface=ether2-localnet network=192.168.88.0

/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip route
add distance=1 gateway=192.168.1.1
/ip pool
add name=dhcp_pool1 ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=ether2-localnet name=dhcp1
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.88.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-internet src-address=192.168.88.0/24 disabled=no comment="ether2-localnet"
/system ntp client
set enabled=yes primary-ntp=203.89.31.13 secondary-ntp=82.200.209.236

I think no need explanation about it, but yeah… just reminding. Maybe If you have two localnet, just give the name of the interface, add IP address for the network, add dhcp server configuration and masquerade for that network. If internet connection still not available, reboot your router and you can access your router again from the gateway localnet IP. Until this step, make sure you can access the internet from localnet!

3. Fasttrack Firewall Filter Rules for Prioritizing Typical Connection Packets

The new feature rules in router firewall filter that you can setup depending on your needs. It will Fasttracked packets bypass firewall of Typical Connection Packets that you intended. Ok I give the example how that rules on the router.

/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related disabled=yes dst-address=xxx.xxx.xxx.xxx dst-port=5060,5061 protocol=udp comment="Bypass Voip UDP SIP"
add action=fasttrack-connection chain=forward connection-state=established,related dst-address=xxx.xxx.xxx.xxx dst-port=10000-20000 protocol=udp comment="Bypass Voip UDP RTP"
add action=fasttrack-connection chain=forward connection-state=established,related disabled=yes dst-address=xxx.xxx.xxx.xxx dst-port=4569,5036 protocol=udp comment="Bypass Voip UDP IAX"
add action=fasttrack-connection chain=forward connection-state=established,related disabled=yes dst-address=xxx.xxx.xxx.xxx dst-port=5060,5061 protocol=tcp comment="Bypass Voip TCP SIP"

The above rules are how you can fasttracked or bypass the Voip connection packet. The Important things here is, you have to know the port number, the protocol type, and the IP of the Voip Server that you use. Please contact the Voip server services, if you don’t know about it!

For another example, here it is how to fasttrack Lostsaga online games. Whatever the tools that you use to get the port number which is using by Lostsaga game server, please cross check the port number that was used! I have captured the port lostsaga connection server.

/ip firewall filter add action=fasttrack-connection chain=forward connection-state=established,related dst-port=14009,14010,14017,14019,14024,14025,14042,14113,14120 protocol=udp comment="UDP PORT LOSTSAGA I"
add action=fasttrack-connection chain=forward connection-state=established,related dst-port=14245,14263,15494,21530,22317,22561,26019,30146,32629,45693 protocol=udp comment="UDP PORT LOSTSAGA II"
add action=fasttrack-connection chain=forward connection-state=established,related dst-port=9000,14009,14010,61031,61034,61035,61037,61046,61047,61048,61049,61051,61058 protocol=tcp comment="TCP PORT LOSTSAGA"

Still on firewall filter rules, let’s complete our router rules with Router protection and Clients Protection to avoid something that we don’t want! For more explanation please visit wiki.mikrotik.com.

/ip firewall filter
add action=drop chain=input comment="Drop Invalid connections" connection-state=invalid
add action=accept chain=input comment="Allow Established connections" connection-state=established
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input in-interface=!ether1-internet src-address=192.168.88.0/24
add action=drop chain=input comment="Drop everything else"
add action=drop chain=forward comment="drop invalid connections" connection-state=invalid protocol=tcp
add action=accept chain=forward comment="allow already established connections" connection-state=established
add action=accept chain=forward comment="allow related connections" connection-state=related
add action=drop chain=forward src-address=0.0.0.0/8
add action=drop chain=forward dst-address=0.0.0.0/8
add action=drop chain=forward src-address=127.0.0.0/8
add action=drop chain=forward dst-address=127.0.0.0/8
add action=drop chain=forward src-address=224.0.0.0/3
add action=drop chain=forward dst-address=224.0.0.0/3
add action=jump chain=forward jump-target=tcp protocol=tcp
add action=jump chain=forward jump-target=udp protocol=udp
add action=jump chain=forward jump-target=icmp protocol=icmp
add action=drop chain=tcp comment="deny TFTP" dst-port=69 protocol=tcp
add action=drop chain=tcp comment="deny RPC portmapper" dst-port=111 protocol=tcp
add action=drop chain=tcp comment="deny RPC portmapper" dst-port=135 protocol=tcp
add action=drop chain=tcp comment="deny NBT" dst-port=137-139 protocol=tcp
add action=drop chain=tcp comment="deny cifs" dst-port=445 protocol=tcp
add action=drop chain=tcp comment="deny NFS" dst-port=2049 protocol=tcp
add action=drop chain=tcp comment="deny NetBus" dst-port=12345-12346 protocol=tcp
add action=drop chain=tcp comment="deny NetBus" dst-port=20034 protocol=tcp
add action=drop chain=tcp comment="deny BackOriffice" dst-port=3133 protocol=tcp
add action=drop chain=tcp comment="deny DHCP" dst-port=67-68 protocol=tcp
add action=drop chain=udp comment="deny TFTP" dst-port=69 protocol=udp
add action=drop chain=udp comment="deny PRC portmapper" dst-port=111 protocol=udp
add action=drop chain=udp comment="deny PRC portmapper" dst-port=135 protocol=udp
add action=drop chain=udp comment="deny NBT" dst-port=137-139 protocol=udp
add action=drop chain=udp comment="deny NFS" dst-port=2049 protocol=udp
add action=drop chain=udp comment="deny BackOriffice" dst-port=3133 protocol=udp
add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp
add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 protocol=icmp
add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 protocol=icmp
add action=accept chain=icmp comment="host unreachable fragmentation required" icmp-options=3:4 protocol=icmp
add action=accept chain=icmp comment="allow source quench" icmp-options=4:0 protocol=icmp
add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 protocol=icmp
add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 protocol=icmp
add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 protocol=icmp
add action=drop chain=icmp comment="deny all other types"

4. Mark Connection Packets Upload and Download based on Bytes Connection

We going to mark the connection packets for total upload and download as usual. This rules will not effect with fasttrack-connection that we have just created above. After that we create the connection packets mark based on bytes size of the connection packets.

Assuming that the client download any files with different sizes. We don’t want that the client who download the big size file spend a lot of the bandwidth spare that we have. So we have plan that the connection packets priority is down, and change Its speed is lowered. Of course its not just for download files, its for all connection packets types based on bytes sizes. Ok lets see the rules below!

/ip firewall mangle
add action=mark-connection chain=forward in-interface=ether1-internet new-connection-mark=dconn-isp comment="ISP DOWNSTEAM"
add action=mark-packet chain=forward connection-mark=dconn-isp new-packet-mark=dpkt-isp comment="Packets Total Downsteam"
add action=mark-packet chain=forward connection-bytes=0-1000000 new-packet-mark=dpkt-light-isp packet-mark=dpkt-isp passthrough=no comment="Packets Less Then 1000000"
add action=mark-packet chain=forward connection-bytes=1000000-3000000 new-packet-mark=dpkt-fair-isp packet-mark=dpkt-isp passthrough=no comment="Packets 1000001-3000000"
add action=mark-packet chain=forward connection-bytes=3000000-6000000 new-packet-mark=dpkt-weight-isp packet-mark=dpkt-isp passthrough=no comment="Packets 3000001-6000000"
add action=mark-packet chain=forward connection-bytes=6000000-0 new-packet-mark=dpkt-very-isp packet-mark=dpkt-isp passthrough=no comment="Packets more then 6000000"
/ip firewall mangle
add action=mark-connection chain=forward new-connection-mark=uconn-isp out-interface=ether1-internet comment="ISP UPSTEAM"
add action=mark-packet chain=forward connection-mark=uconn-isp new-packet-mark=upkt-isp comment="Packets Total Upsteam"

The above mangle rules means we separate connection packets into download and upload, then we separate download packets about less then 1M, 1-3M, 3-6M, more then 6M.

5. Queue tree with PCQ to manage the priority and speed limitation

Assuming we have total bandwidth 20M, we want to spread the internet connection equal for all clients using PCQ for every separated packets byte sizes that we have defined on mangle rules. In this case I use pcq-download-default, pcq-upload-default. Change the total limit PCQ as you like, or you can create a new rule for PCQ, then use it on queue tree.

/queue tree
add max-limit=20M name=Downsteam-ISP packet-mark=dpkt-isp parent=global queue=pcq-download-default
add limit-at=1M max-limit=20M name=1.light-isp packet-mark=dpkt-light-isp parent=Downsteam-ISP priority=1 queue=pcq-download-default
add limit-at=1M max-limit=10M name=2.fair-isp packet-mark=dpkt-fair-isp parent=Downsteam-ISP priority=2 queue=pcq-download-default
add limit-at=1M max-limit=5M name=3.weight-isp packet-mark=dpkt-weight-isp parent=Downsteam-ISP priority=3 queue=pcq-download-default
add limit-at=1M max-limit=1M name=4.very-isp packet-mark=dpkt-very-isp parent=Downsteam-ISP priority=4 queue=pcq-download-default
add max-limit=20M name=Upsteam-ISP packet-mark=upkt-isp parent=global queue=pcq-upload-default

So that’s all about the Effective Way Bandwidth Management with Fasttrack Firewall Filter, I hope can be useful, and for more clearly lets see the video below! Happy exploring!

Building Squid 3.5.4 Transparent Proxy on Ubuntu Server VMware

noreply@blogger.com (Agratitudesign) — Tue, 19 May 2015 17:10:00 +0000

This is continuation of the previous article beginning to install Squid 3.5.4…, that is about the preparation before ready to install 3.5.4 on Ubuntu server virtual machine using VMware on windows. This method can be implemented to the Ubuntu Server Virtual Machine or to the real machine. As you may know on Ubuntu Server Virtual Machine using VMware we can not divide the hard drive into some partitions as manually. The partitions is created automatically by VMware itself. With this conditions we can start to build squid 3.5.4 as the transparent proxy on Ubuntu Server.

All the command lines is assuming that you have logged-in and you in active state to be root of the command line by typing sudo –i and entering the password. Look at the picture below!

A. Installing Squid 3.5.4 on Ubuntu Server

1. Updating some Ubuntu applications and install the default squid 3 package dependencies and some other packages that will required to install squid 3.5.4 on Ubuntu server. You can type/paste the following command lines below!

apt-get update
apt-get build-dep squid3
apt-get install build-essential sharutils ccze libzip-dev libssl-dev

2. Grab a copy of the squid-3.5.4 source code, you can put it to the /usr/src directory. Then you extract tar.gz of squid source file and go to the new extracted folder. You can do this with a bunk of the following command lines.

cd /usr/src
wget https://www.squid-cache.org/Versions/v3/3.5/squid-3.5.4.tar.gz
tar zxvf squid-3.5.4.tar.gz
cd squid-3.5.4

3. Compile the Squid 3.5.4 as the proxy server on Ubuntu server by the configuration. Assuming that you are still in squid-3.5.4 active path directory, type or paste this command lines to compile and install Squid 3.5.4 proxy server.

./configure --prefix=/usr --localstatedir=/var/squid --libexecdir=${prefix}/lib/squid --srcdir=. --datadir=${prefix}/share/squid --sysconfdir=/etc/squid --with-default-user=proxy --with-logdir=/var/log/squid --with-pidfile=/var/run/squid.pid --enable-delay-pools --enable-cache-digests --enable-poll --enable-linux-netfilter --enable-removal-policies --with-maxfd=8192 --enable-storeio=aufs --disable-wccp --enable-x-accelerator-vary --enable-kill-parent-hack --enable-async-io=30 --disable-ident-lookups

make && make install

4. Squid 3.5.4 need to resolve library dependencies to make it works properly. Go to the lib directory and download squid-lab.tar.gz . After this you extract the files, squid just use the extracted files on lib directory and you can remove squid-lib.tar.gz

cd /usr/lib
wget https://e7d.github.io/resources/squid-lib.tar.gz
tar zxvf squid-lib.tar.gz
rm squid-lib.tar.gz

5. Replacing squid.conf by your new squid configuration. First you can remove squid.conf by default and download a new configuration from the url that you may put the new squid.conf. Then we can give the access control for the squid.conf.

rm -fr /etc/squid/squid.conf
wget --no-check-certificate -O /etc/squid/squid.conf https://raw.githubusercontent.com/suardika/agratitudesign-template/master/squid35/squid.conf
cd /etc/squid/ && chown proxy:proxy squid.conf && chmod 755 squid.conf

Sometimes if you want to edit or reconfigure your squid.conf you can open the file using one of the command lines below! It is depending on where your active root now!

nano squid.conf
nano /etc/squid/squid.conf

After you make any changes to your squid.conf, you can save the new configuration by pressing ctrl+x, y, enter. The new configuration that is changed will be saved.

6. In order to enable the authentication, you need uncomment the Authentication on squid.conf. It will prevent the browser that will ask authentication for our clients who access squid transparent proxy.

You can create your users entries of users.pwd by your self on the Htpasswd Generator website, or you can use users.pwd of mine. The Squid.conf will directly use the users.pwd, and providing you a basic user named proxy, using also proxy as password.

rm -fr /etc/squid/users.pwd
wget --no-check-certificate -O /etc/squid/users.pwd https://raw.githubusercontent.com/suardika/agratitudesign-template/master/squid35/users.pwd

7. Build squid 3.5.4 service runtime by downloading squid.sh from the url project to /etc/init/squid directory and make it to be executable. And you can make it run automatically at Ubuntu server startup with update-rc.d squid defaults.

wget --no-check-certificate -O /etc/init.d/squid https://gist.githubusercontent.com/e7d/1f784339df82c57a43bf/raw/squid.sh
chmod +x /etc/init.d/squid
update-rc.d squid defaults

8. Preparing execution directories, make sure you have the log, cache, and spool directories and create the access control to those directories with the following command line!

mkdir /var/log/squid
mkdir /var/cache/squid
mkdir /var/spool/squid
chown proxy:proxy /var/log/squid
chown proxy:proxy /var/cache/squid
chown proxy:proxy /var/spool/squid

9. Preparing execution files, go to /var/log/squid directory and create blank access.log, cache.log and store.log and give the access control to those files with the following command lines!

cd /var/log/squid
touch access.log cache.log store.log
chmod 755 access.log cache.log store.log
chown proxy:proxy access.log cache.log store.log
chown proxy:proxy /var/cache/squid && chmod 755 /var/cache/squid

10. You have ready to create cache swap directories “squid –z” and you can exit by pressing ctrl+c, then you diagnose the squid “squid –Nd1” and exit with ctrl+c. and you run squid service service squid start. Squid services will be run automatically when you start Ubuntu server. At last you can check the access.log to monitor the access Squid proxy server.

B. Configuration of the Ubuntu Server Virtual Network System

This is especially for you who have built squid proxy server using vmware. Click edit > virtual network editor. On virtual network editor select VMnet8 NAT, you can see DHCP setting with IP address range and on NAT settings you can see the gateway IP, this is the configuration of virtual NAT network system on VMware.

Make sure Ubuntu server has used this virtual NAT network system as shown like the left picture below! Meanwhile the main windows operating system use Vmware network adapter vmnet8 to be connected to the internal virtual NAT network system on Ubuntu server virtual machine as shown like the right picture below!

Now you can understand that ubuntu server use virtual NAT network system on VMware with internal DHCP server that will give an IP address 192.168.218.129 depending on the IP address range of dhcp settings to the ubuntu server virtual network system that should be using dhcp client system as show like the left picture below!

checking dhcp client that applied to the Ubuntu Server network system with this command line :

sudo nano /etc/network/interfaces

If you want to check the IP address 192.168.218.129 that was given by dhcp settings on VMware virtual NAT network system, you can use this command line:

ifconfig eth0

and to check dns server that used by Ubuntu server virtual machine, you can use this command line

sudo nano /etc/resolv.conf

Virtual NAT network system is Just like home network or internal network system that using dhcp server on your host computer system, the VM will use the gateway IP such 192.168.218.2 and will be give the IP address 192.168.218.219 to the internal client system, in this case is Ubuntu server, but this IP address only shown by internal system include the main windows operating system that has IP address that is depending on Vmware network adapter vmnet8.

So IP address 192.168.218.219 ubuntu server, It is a static IP address that was given by dhcp VM, and it can not be accessed directly by the clients on local area network. Meanwhile squid 3.5.4 that was installed on Ubuntu server has the port 3128 that can be accessed from local area network using the IP address of the main windows operating system that connected to network directly.

In order to use squid 3.5.4 transparent proxy on ubuntu server VM on the main windows operating system you can set your browser to use this proxy server 192.168.218.129 : 3128 manually, and you can the access.log of squid 3.5.4 using this command line:

tail -f /var/log/squid/access.log | ccze

Beginning to install Squid 3.5.4 Ubuntu Proxy Server in Windows using VMware

noreply@blogger.com (Agratitudesign) — Sun, 17 May 2015 17:39:00 +0000

Increase the internet access speed significantly while saving quota bandwidth usage is the main goal of the open source squid development as the proxy server. This far Squid developers have many experiments and improvement to build the proxy server that more stable in high performance. Until the time this article was written, Squid have released version 3.5.4, squid 4 is still experimental. Different with squid 2.7, squid 3.5.x is need to be compiled to use this version. This would give more flexibility in the application and development of squid to build proxy server.

In order to implement squid 3.5.x in Windows operating system directly, it should be compiled by the application before it can be used. Of course If you are a programmer which are used to create software and applications, it would be for you. But for most people, it would be hard to compile the source squid 3.5.x and implement it directly on windows. Some developers have been made easy for you, to install squid 3.5 who has made squid35.msi, but it just compatible in window 64 bit. For this reason I prefer to operating system based on linux, such as ubuntu and debian that make easy to compile this source squid version.

This method can be implemented to the ubuntu server directly you have installed on the real machine or PC without needed some configuration like in virtual machine. In this case I have installed squid 3.5.4 on Ubuntu Server virtual machine on Windows using VMware Workstation Version 10 that still compatible in windows system 32 bit. You have to download and install VMware on your pc at first. VMware installation procedure is common and easy steps, so I don’t need to show with you, you can go for more details about VMware! I assume you've installed vmware on windows operating system. So let’s get started to install squid 3.5 on Ubuntu Server 14.04 virtual machine on Windows using VMware.

1. Install Ubuntu Server 14.04 on VMware

VMware is one of the most powerful software that allow you to build the virtual operating system that best supports Linux-based installation such a Ubuntu Server. In this case I have used VMware Workstation 10, the interface software is very understandable. We are going to install the Ubuntu Server 14.04 on this virtual machine on the main operating system Windows 7 32 bit.

You can start to click Create a New Virtual Machine and you can choose Typical (recommended) as the above picture!

Then click next, you can browse to find the ubuntu-server iso/image installer file to the folder where you put the installer file, but if you are using ubuntu server installer on cd you can select installer disc to use your cdrom drive on your pc. After this you can fill personalize-linux with username and password that you will use to logged in every time when ubuntu server VM (Virtual Machine) started. Look at the picture below!

Next you can browse to put the ubuntu server virtual machine file to the folder/directory on your computer, next again you will specify disk capacity of ubuntu server virtual machine that will installed as you can see as the right picture below!

Next you can customize hardware that will used by ubuntu server virtual machine, it is depending on the specification your hardware pc. In this I have 2 GB of the memory pc and I just use 512 MB for virtual machine so it just use ¼ memory of the total capacity. You can specify the other hardware configuration depending on your hardware pc.

One of the important hardware customization is Network Adapter system that will used by ubuntu server virtual machine as shown like the picture below! It is depending on what type of internet connection that you have used of your ISP on the main operating system. The most recommended to use NAT Network connection system, it can be use all whatever the type internet connection comes from ISP the hardware that now you are using and active on the main operating system. That the most possible if you have plan to access the proxy server virtual machine from outside host or through clients on your network .

After you have customize all the hardware configuration that will used by ubuntu server virtual machine, the last step is to click next and the installation process of ubuntu server will run automatically on VMware as shown like the pictures below! Just wait until ubuntu server installation finished.

2. Adjustment Ubuntu Server VMware on Windows operating system

Ubuntu server is linux-based operating system, it’s very different from the windows operating system while we run ubuntu server on windows operating system using virtual mechine. By default, Ubuntu Server kernel is compiled with PAE (Physical Address Extensions) support. In some other virtual machine, it would be a problem. I personally would like to say that this is one of the advantages of VMware Workstations, it still allow us to run ubuntu server VMware on windows, but we need some adjustment in order to make ubuntu server can works properly.

VMware will ask you to install VMware tools to run ubuntu server, and you have to install it. It will download VMware tools and install it to the system automatically, then it will restart your ubuntu server after the installation vmware tools. But sometimes when you have the problem as shown like the left picture below! You must restart ubuntu server manually by clicking on restart guest icon VMware and VMware will install VMware tools during before ubuntu server started as show like the right picture below!

If you have used internet connection through USB, while ubuntu server first time start, it may disconnect your internet connection. We can uncheck usb connection to prevent ubuntu server virtual machine to use USB controller directly as shown like the picture below!

When ubuntu server first time to run/boot on VMware sometimes come up with the issues message :

piix4_smbus 0000:00:007.3: Host SMBus controller not enabled! The issue come up because VMware actually doesn’t provide that level interface for CPU access, but Ubuntu server will try to load the kernel module anyway. We can fix it by adding “blacklist i2c-piix4” on blacklist.conf.
intel_rapl: no valid ralp domains found in package 0 this message issue actually is non-obstructive, and when it occurs it doesn't affect the performance or functionality of the ubuntu server system, because it's just a power management module, but to fix this issue we can add “blacklist intel_rapl” on blacklist.conf.

Just let ubuntu server finish to boot until you can logged in the ubuntu server with your username and password, and you must run to be root by typing sudo -i and insert your password again, then you type this command line to open blacklist.conf.

nano /etc/modprobe.d/blacklist.conf

After blacklist.conf is opened you can add this code on it :

blacklist i2c-piix4

blacklist intel_rapl

To save the changes of blacklist.conf, press ctrl+x, y , then enter. The blacklist.conf has been added and you can reboot the system again, then the issues message should be disappear.

Until this step we have already completed to Install and adjust Ubuntu Server 14.04 on VMware, and we ready to continue for the installation squid 3.5.4 as the transparent proxy on ubuntu server virtual machine. To be continue...

Building Local Dns Server Using BIND for Windows on the Network

noreply@blogger.com (Agratitudesign) — Sun, 26 Apr 2015 10:24:00 +0000

DNS Server is the database server which will be distributed and mapping the hostnames to the IP address and otherwise. This is the process which must be passed when we are connected to the internet to access any servers in the world. So when we use the specific dns server such google dns, we will follow the domain database rules on this server. For example if google dns has blocked any webhosting server, we will not be able to access the webhosting server using this dns server. I personally prefer to use google dns because the resolve dns response more quickly and widely, but this would depend on your purposes.

From ISP (Internet Service Provider) itself many has been implemented the Internal DNS Server to their clients internet services for some reasons . This will greatly depend on the quality and ability of their internal dns sever to serve their clients. If sometime their dns server having a problems, automatically their services will be disrupted, although their internet connection in good condition. This could be a factor that could be a problem and the resolve dns response of their dns server to serve many clients.
In some other cases building local dns server will be the alternative way which can increase the internet speed and can be fix the problem dns server to our local internet network. When we have used local dns server, we can make our rules for the local dns server, and all the responsibility is fully on our hands to manage the rules of local dns server. Ok we begin immediately how to build local dns server for our local network using BIND (Berkeley Internet Name Domain) on windows. BIND is the open source or free software that allow you to build your local DNS Server.

1. Download and Install Bind on windows for Local Dns Server

BIND (Berkeley Internet Name Domain) is free software that allow us to build dns server that can be run for some operating system. In this case, we will implement Bind on window 7 32bit. You can download Bind application version by visiting www.isc.org/downloads/bind/ or just download this file here.
After you have download you can extract the zip file at first and you can run BINDInstall.exe. Then you can fill where the installation files will be placed.

Target Directory : c:\windows\system32\dns
Service Account Password : named
Password : Up to you!

For more details you can see the picture below! After you fill the installation configuration, you can click install!

If something happen during installation such a Problem from "vcredist.msi "file. You can find vcredist_x86.exe from the source BIND installation files, and you can extract this exe file and you can see vcredist.msi to the extracted files. Then you can browse the asking file and the installation process will be continued. Until you have found successful Bind Installation, you can close Bind Installer.

2. Configuration of the Variables Path to the Bind Installation Root

Make sure the variables Path of Environment Variables in system properties has added the string. Look at the two pictures below!

Windows 64 bits ;%SYSTEMROOT%\SysWOW64\dns\bin;
Windows 32 bits ;%SYSTEMROOT%\system32\dns\bin;
And the complete variables path that have been added string will be like this
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\squid\bin;C:\squid\sbin;%SYSTEMROOT%\system32\dns\bin;

3. Bind Installation files and Adding a New Folders

Go to the Bind Installation Path c:\windows\system32\dns. And you will see Bind Installation has 2 main folders/directories, that is bin and etc folders. Run the command prompt, by typing cmd on start menu, right click, and run as administrator.

We are going to create log and zone folder on Bin installation files using command prompt (CMD). After cmd has running and type the command below!

mkdir log
mkdir zone

4. Create the configuration files in Bind Files and Drivers\etc

To make the local dns server we have to create some configuration dns files as the local Dns Server. The configuration files require further understanding in DNS programming to build dns server as the specific characters and rules of your dns server as you like. You can learn more about DNS programming www.isc.org. But now I will give the configuration as the basic local dns server that you can customize as dns server and rules.

Create named.conf in System32\dns\ etc

Proceed from the active root from the command prompt before. Still at the active root/path on cmd. Next we will continue of the next command to create the bind configuration files, just continue type :

cd etc
notepad named.conf

named.conf :

options {
    directory "C:\Windows\System32\dns\zone";
    allow-query { localhost; clients ; };
    forwarders { 8.8.8.8; 8.8.4.4; 208.67.222.222; 208.67.220.220; };
    forward only;
    max-cache-size 2097152 ; 
    empty-zones-enable yes;
};

acl  clients    {
    192.168.1.0/24  ; 192.168.137.0/24  ;
};

zone "go2net.com" { type master; file "dummy-block"; };
zone "infospace.com" { type master; file "dummy-block"; };
zone "kcookie.netscape.com" { type master; file "dummy-block"; };
zone "linksynergy.com" { type master; file "dummy-block"; };
zone "yimg.com" { type master; file "dummy-block"; };
zone "zedo.com" { type master; file "dummy-block"; };

logging {
    channel queries_log {
        file "C:\Windows\System32\dns\log\queries.log";
        print-severity yes;
        print-time yes;
    };
    category queries { queries_log ; };
};

zone "localhost." IN {
    type master;
    file "localhost.zone";
    allow-update { none; };
};
zone "0.0.127.in-addr.arpa." IN {
    type master;
    file "localhost.rev";
    allow-update { none; };
};

include "C:\Windows\System32\dns\etc\rndc.key";

This named configuration using forwarders as parent dns server by google dns, you can change or add another dns server as forwarders. The acceleration access for the local network, you can adjust the IP network as your own. If you want to block the access hostname/url, you can fill the hostname on zone with dummy block. And make sure queries.log and rndc.key in the right path that we will created next.

Create localhost.zone and localhost.rev in System32\dns\etc

cd..
cd zone
notepad localhost.zone
notepad localhost.rev

localhost.zone :

$TTL    86400
@               IN SOA  @       root (
                                        42              ; serial
                                        3H              ; refresh
                                        15M             ; retry
                                        1W              ; expiry
                                        1D )            ; minimum
                IN NS           @
                IN A            127.0.0.1
                IN AAAA         ::1

localhost.rev :

$TTL    86400
@       IN      SOA     localhost. root.localhost.  (
                                      1997022700 ; Serial
                                      28800      ; Refresh
                                      14400      ; Retry
                                      3600000    ; Expire
                                      86400 )    ; Minimum
        IN      NS      localhost.
1       IN      PTR     localhost.

Create queries.log in System32\dns\log

cd..
cd log
notepad queries.log

we just create queries.log file that the path file is related to named queries.log configuration, leave it blank! this file will be the place as the record of the log dns access.

Create rndc.key in System32\dns\etc

cd..
cd bin
rndc-confgen –a

The rndc.key (remote name daemon control) that program file that allow us as the system administrator to control the operation of a name server, this will created automatically in dns\etc by the above command.

Create resolve.conf in System32\drivers\etc

The resolve.conf consist with the IP nameservers as the IP address of dns server itself. If you want to access the local dns server on the unit server where the local dns installed you can access 127.0.0.1 as the localhost IP. But from the client network it can be accessed by 192.168.137.1 as the localnetwork IP address that connected with.

cd..
cd..
cd drivers
cd etc
notepad resolv.conf

resolv.conf :

nameserver 127.0.0.1
nameserver 192.168.137.1
nameserver 192.168.1.1

5. Run Local Bind Dns Server on Windows Services

After we have created the all configuration of the local Bind Dns Server, to use Bind Dns server we have to run the service on windows system. Ok we can run the service by typing services.msc on the windows start menu and click services, and you try to start ISC BIND on services, perhaps you will find the error warning to run ISC BIND services like the picture below!

Ok we have to fix this problem by right click on ISC BIND and click properties. On ISC BIND properties you click on the tab “Log On” and select Local System account as shown like the picture below! And you can try again to start ISC BIND Services.

6. Setup Network Configuration to Use Bind Dns Server

Assuming that local Bind Dns Server have installed on Wan server which directly connected to ISP internet connection. In this case I use dial-up connection, actually this kind ISP can not allow you change the dns server by external dns server such google dns (8.8.8.8), if you do like this you will lost the internet connection. But now I have local Bind Dns Server to this unit wan server and I'll use local dns server with the IP server 127.0.0.1 that has forwarders to google dns. And now I do not depend anymore to the ISP dns server.

In the purpose to use local Bind Dns Server to the local network that using mikrotik router, we have to setup dns server leading to the IP address of the unit where the dns server is built or installed and connected with. It doesn’t means that local dns server must be installed as wan server. Local Dns Server also can be installed as the client network. Ok open your mikrotik winbox, click IP > DNS and you can insert the IP local dns server. In this case 192.168.137.1, it also as the IP wan server on my network.

7. Testing and Resetting Local Bind Dns Server

To start using Local Bind Dns Server we should clear Windows DNS Cache. You can reopen again cmd and type.

ipconfig /flushdns : clear all Dns Cache Server
rndc reload : reload bind Dns Server
dig google.com : interrogate google.com server

The Query time dig at 2 time and more should be smaller then when you dig at first time, because at 2 times and later will reload the dns cache server.

To inspect the DNS Cache Server type : ipconfig /displaydns. The last command line will enable the query.log record when restart ISC Bind Service : rndc querylog. That’all about building local dns server network using Bind using windows, have a try and good luck!

Quota Bandwidth User Manager Hotspot Mikrotik & Voucher Design

noreply@blogger.com (Agratitudesign) — Wed, 22 Apr 2015 18:08:00 +0000

Firstly I do apologize to the respectable agratitudesign visitors, I personally still learn and research to find the solution in the case that I have found that’s all would like to write into the blog as a record of my research and lesson. I'm sure there some of you still disappointed about less of my response, I really sorry about it, many questions that sometimes makes me a bit stuck. Think about the concept, to resolve the problem, which is very likely different situations, but I thank you, that the questions of you sometimes as an inspiration to me.

I come back to continue with the discussion about building hotspot server on mikrotik. In order to manage the bandwidth hotspot system, as probably you know mikrotik router has the extension packages that is called “User Manager”. User Manager allow you to make “Authentication, Authorization dan Accounting Server” on the mikrotik router. As the AAA server that has database system, you can fully manage the clients in the case is called “users” and the bandwidth management, you can even set the quota limit based on the packages.

1. Install NTP &User Manager Packages of the All Packages Router

First you have to go to https://mikrotik.com/download and you can download the full packages router, it’s depending on what the routerboard series that you have and the router OS that you use. So choose the compatible packages of your router. In this case I have RB750 using Router OS vesion 6.

As you can see, you have the full packages of the router system, ntp and user manager packages also has included therein. Now we ready to install ntp and user manager packages that we require by putting the packages to router files, if you are using winbox go to files on the winbox main menu and put the files there, or you can you winscp application to put the files and reboot the router. If it still not clear, see the video!

2. Setup Parent Time Zone and Radius Hotspot Mikrotik Router

After we have installed ntp and user manager package to our router system, make the parent time zone is always in updated state. User manager will depending on the time setting on the router system to manage the database packages and clients/users. Just through new terminal console winbox, and paste this rule!

/system ntp client
set enabled=yes mode=unicast primary-ntp=152.118.24.8 secondary-ntp=202.169.224.16

You will see the configuration on NTP client that using NTP servers. Next you click on System > Clock you will setup the clock router system for the parent time zone of your router, it is depending to your time area.

User manager has the database system that will require to setup the radius configuration to your router. just paste the rules below to the terminal console winbox to make the radius configuration automatically on your router.

/ip hotspot profile set hsprof1 use-radius=yes

/radius add service=hotspot address=127.0.0.1 secret=123456

3. Setup the Customer & Router of the User Manager

Here is a bit confusing about differences in customer and admin for each routerOS, to avoid that, I conclude personally that Customer is one of the administrator of user manager that will be able to generate and manage the hotspot users/client. Each customers will have different users, that means users is under the rule of customer. For more simple just paste this rules to make the customer and router account of the database user manager and configuration.

/tool user-manager customer
add login=agratitudesign password="password" permissions=owner currency=Rupiah
/tool user-manager router
add name=router customer=agratitudesign ip-address=127.0.0.1 shared-secret=123456

You can see the result by typing “ip_public_interface_router/userman” such 192.168.137.2/userman on the browser as the pictures above!

4. Setup the Users Variables of the User Manager Customer

Setting Users Variables, here we do manually by clicking on Settings > Appearance on the user manager interface and choose the variables that want to use to the visible variables box and click save!

The visible data variables that used are

Username
Password
Start Time
End Time
Total Time Left
Till Time
Uptime Used
Uptime Limit
Money Paid

5. Create User Account Packages of the User Manager

We start by creating the user manager profiles, rather than doing it manually, I personally prefer to make use of script rules below. I just need to set the value of the profiles configuration, This will speed up our works rather than creating manually. But keep in mind that this rules use owner=agratitudesign is related to the customer as the owner. If already finished to set the value, just paste this code through console terminal winbox.

/tool user-manager profile
add name="256K Hourly" name-for-users=5hours price=10000 starts-at=logon validity=2d owner=agratitudesign
add name="512K Daily" name-for-users=1day price=20000 starts-at=logon validity=1d owner=agratitudesign
add name="512K weekly" name-for-users=7day price=50000 starts-at=logon validity=7d owner=agratitudesign
add name="768K Mothly" name-for-users=1month price=120000 starts-at=logon validity=4w2d owner=agratitudesign
add name="1M Annual Unlimited" name-for-users=1year price=1000000 starts-at=logon validity=365d owner=agratitudesign

You can see the result on the profiles user manager like the picture below! Imagine if you want to make many profiles. If you made manually huh... so tired, clack click and write in somewhere, sometimes confused our self, does it not?

Associated with the user manager profiles, next we create the profile limitations as the packages of the users hotspot. Just do the same thing as we created user manager profiles, we will write the script rules that we need to set the values as your plan and paste it to the console terminal winbox.

1GB = 1024 x 1024 x 1024 = 1073741824B
2GB = 2 x 1024 x 1024 x 1024 = 2147483648B
500MB = 5 x 1024 x 1024 = 524288000B

For the example if you want to plan the quota limit for your users member with package 1GB you have to insert the value 1073741824B that equal to 1GB of download-limit. Next we will require to set rate-limit-min-rx & tx, and rate-limit-rx & tx. As the state when the quota limit has been reached. If the user member has reached the quota limit value, the bandwidth speed will be reduced to the rate-limit-min. Ok give you the note below!

download-limit : quota limit download
upload-limit : quota limit upload
transfer-limit : quota limit download+upload
rate-limit-tx : speed limit download (if the quota has not been reached)
rate-limit-rx : speed limit upload (if the quota has not been reached)
rate-limit-min-tx : speed limit download (if the quota has been reached)
rate-limit-min-rx : speed limit upload (if the quota has been reached)
download-limit=0B : unlimited quota download
rate-limit-tx=262144B : speed limit download 256 kbps

So you must understand the configuration value to make the right plan to the user manager hotspot packages as you like. After you have setup the value of this rules you just paste the code to the console terminal winbox.

/tool user-manager profile limitation
add name="256k Hourly" download-limit=524288000B upload-limit=0B transfer-limit=0B uptime-limit=5h owner=agratitudesign \
rate-limit-min-rx=65536B rate-limit-min-tx=65536B rate-limit-rx=131072B rate-limit-tx=262144B
add name="512k Daily" download-limit=1073741824B upload-limit=0B transfer-limit=0B uptime-limit=1d owner=agratitudesign \
rate-limit-min-rx=131072B rate-limit-min-tx=131072B rate-limit-rx=262144B rate-limit-tx=524288B
add name="512k weekly" download-limit=2147483648B upload-limit=0B transfer-limit=0B uptime-limit=1w owner=agratitudesign \
rate-limit-min-rx=131072B rate-limit-min-tx=131072B rate-limit-rx=262144B rate-limit-tx=524288B
add name="768K Monthly" download-limit=7516192768B upload-limit=0B transfer-limit=0B uptime-limit=4w2d owner=agratitudesign \
rate-limit-min-rx=196608B rate-limit-min-tx=196608B rate-limit-rx=524288B rate-limit-tx=786432B
add name="1M Annual Unlimited" download-limit=0B upload-limit=0B transfer-limit=0B uptime-limit=365d owner=agratitudesign \
rate-limit-min-rx=262144B rate-limit-min-tx=262144B rate-limit-rx=524288B rate-limit-tx=1048576B

We have just created 5 user manager profiles and the profile limitations, next step is adding the the limitation to the profiles itself. The limitation names is related to the profile names. Go to the profiles menu of the user manager. On the profiles tab, you have any profile list and click add new limitation > select the limitation name > add > activate > save profiles. Look at the picture for more details.

Do this step to all profiles list that you have to add the limitation profiles that is associated with.

6. Generate Users Account for Each Packages of User Manager Profiles

We can create the user member of the hotspot packages with the strong security username and password that will generated automatically how much you want. The account member that will generated is impossible to be remembered.

As you can see on the picture above, to generate the user account member, you can click on users > add > batch, on the user details window you can set the number of users and select assign profiles of the profiles that we have just created. Finally you will get the user account members, you can do like this for each profiles as the hotspot packages that you have.

7. Create the Voucher Style of User Accounts Hotspot Packages

After create the user account for all profile packages, the next step is to create the style of the voucher hotspot member. Go to the Setting of the user manager menu, go to templates tab and select Voucher Style as shown like the picture below!

Here you can see the HTML script code to create voucher style, you can create a new voucher style by clicking + button. But I just overwrite this voucher style so that is the HTML code for the header and row that I overwrite is according to this HTML Voucher Scripts that is still not minified yet for you can customize!

The HTML Code for Header

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title>Vouchers</title>
    <style>
        @media print {
            .noprint {
                display: none;
            }
            .pagebreak {
                page-break-after: always;
            }
        }
        body {
            font-family: 'Lucida Grande', 'Helvetica Neue', Helvetica, Arial, sans-serif;
            padding: 50px 100px;
            font-size: 13px;
        }
        div.box {
   background-color: #46A700;
   background-image: linear-gradient(to bottom, #95D814, #46A700);
   background-repeat: repeat-x;
            width: 3.6in;
            height: 2.1in;
            padding: 0 17px 18px 12px;
            margin: 10px 0;
            border: solid 1px #D9D9D9;
            border-radius: 10px;
            -webkit-border-radius: 2px;
            -moz-border-radius: 2px;
        }
        div.box h2 {
   background-color: #153E5D;
   border-color: #2B78C5;
            margin: 0 -17px 1px -12px;
            padding: 15px 0px 0 10px;
            height: 20px;
            border-top-left-radius: 10px;
            border-top-right-radius: 10px;
            -webkit-border-radius: 2px;
            -moz-border-radius: 2px;
            font: bold 18px/0.2 Arial;
            color: #fff;
            text-align: center;
        }
        div.box h3 {
            background-color: #FFF8DC;
            border-color: #000;
            border-style: solid;
            border-width: 1px;
            margin: -35px 0 0 70px;
            padding: 12px 50px 3px 10px;
            height: 8px;
            width: 30px;
            font: bold 12px/0 Arial;
            color: #000;
        }
        div.box h4 {
   background-color: #153E5D;
   border-color: #2B78C5;
            /* IE6-9 */           
            margin: 0 -17px 1px -12px;
            padding: 15px 0px 0 10px;
            height: 20px;
            border-bottom-left-radius: 10px;
            border-bottom-right-radius: 10px;
            -webkit-border-radius: 2px;
            -moz-border-radius: 2px;
            font: bold 12px/0.2 Arial;
            text-align: center;
            color: #fff;

        }
        .block-left {
            background-color: transparent;
            width: 170px;
            height: 120px;
            margin: 15px 0;
            float: left;
        }  
        .block-right {
            background-color: transparent;
            width: 150px;
   float: right;
   padding: 0px 5px 15px !important;
            text-align: center;
        }

        .block-right > h5 {
   font: bold 25px/0.1 Arial;
   text-align: center;
   color: #FFF;
   text-shadow: 2px 2px 2px #000;
   margin: 25px 0;
        }      
  .block-bottom {
            background-color: transparent;
            clear: both;
        } 
        .txtbox img {
            width: 50px;
            height: 50px;
            float: left;
            padding-right: 5px;
        }     
    </style>
</head>
<body>

The HTML Code for Row

<div class="box">
    <h2>Agratitudesign-Hotspot Rp. %u_moneyPaid%</h2>
    <div class="block-left">        
     <div class="txtbox">
            <img alt="" src="/umfiles/agratitudesignlogo.png"/><b>Agratitudesign HighSpeed Hotspot</b>        
     </div>
        <div class="txtbox2">
            <p>Open your browser, put the <b>UserName</b> and <b>Password</b> in required field, then <b>click login button.</b></p>
        </div>
    </div>

    <div class="block-right">
     <h5>%u_timeLeft%</h5> 
     <p>Price: <b>Rp. %u_moneyPaid%</b></p>
     <div><p align="left">UserName:</p><h3 align="center">%u_username%</h3></div>
     <div><p align="left">Password:</p><h3 align="center">%u_password%</h3></div>
    </div>
    <div class="block-bottom">
     <h4>Contact for more info. agratitudesign.blogspot.com</h4>
    </div>
</div>

If you want to create the voucher style with the logo as the image extension files, we have to create the new folder/directory umfiles on the first path of the router files. And the html code to call this image file will be like this.

<img alt="" src="/umfiles/agratitudesignlogo.png"/><b>Agratitudesign HighSpeed Hotspot</b>

The last you can check the voucher style to display the user account member of the hotspot package. Back to the users menu, put the check mark on top user account if you want create all of the user accounts that you have, click generate and select voucher. Next you can download the user accounts with the voucher style and you have ready to print the voucher package member of your hotspot.

If you are using the image for the voucher style, the download doesn’t include the image files, to do that you need to generate the voucher without download as file and view on the browser. From the browser you can download the complete style of the voucher hotspot and finally you can print the voucher hotspot account member. So that is all, if it is less clear for you, see the video! Good luck!

Conversion Internal to External Hotspot Web Interface Login Page Mikrotik

noreply@blogger.com (Agratitudesign) — Mon, 13 Apr 2015 12:16:00 +0000

After understanding the process to create internal hotspot web interface login page, we are going to go one step further to create external hotspot web interface login page using internal hotspot web interface that we have just created. In other word we are going to place the hotspot web login page files to the live server or website hosting file. So that when the hotspot client want to login to use internet hotspot, they will directed to the external hotspot web interface. Of course you must have the hosting account to put hotspot files to the live server.

If you already have any website whether it be personal or business website, you can include it into the part of your website pages and menu navigation links. It's very free where you want to place it as you like, and you do not have to worry how much the images that you want to use, This will not limit the creativity when you create the style of the hotspot login page. Without being limited by capability of the mikrotik router that you have.

To make it easier understood, look at the scheme of client request login flow at first! this is how the external hotspot web interface works :

Client request to login : request will be sent to login.html router, login.html will be redirected to login.php live server.
Client enter the data login: data login variables will be sent back to login.html, if it is true the process go to alogin.html, then alogin.html will be redirected to alogin.php, and the client see the alogin.php page on live server. While data login variables is false, request will be redirected back to login.php with the warning “login is wrong”.
Client request status : After successfully logged in, the client is on alogin.php then request the status. Request will be sent to status.html. And status.html will be sent the statistic data variables and redirect to the status.php to display statistic data variables of the client.
Client request logout : web interface pages will be sent the request to logout the client, status.html will be process it then will be redirecting and send the last statistic data variables to logout.php, then the client now in logout state on logout.php page.
Client request re logout : request will be sent to login.html. then login.html will be redirecting to login.php. And the client see the login form again on login.php page.

So that how does the external hotspot interface works, when the first time the process redirecting to each external page, the client will see the warning to continue the javascript from the browser. Ok let’s get started how we implement it!

1. Change and Move the Internal hotspot web interface

Take Internal hotspot interface on your router to the folder of your local computer, we only use such as login.html, alogin.html, status.html, and logout.html. of course included with the file links that related to those files. That is css, img, fonts and js folder that containing the related file links. I think would be nice if we collect md5.js to the js folder, so outside of folder we just only have the main html of the hotspot files by removing the others html file that we do not require.

Change the html extension files (.html) to the php extension files (.php), then you can create the zip file from those files including the folder, so that it can be uploaded faster using FTP connection. Next, open the FTP application in this case I am using the add-on Mozilla Firefox, that is fireFTP.

Login with your website files or hosting files with your account to the fireFTP and you can access and manage the hosting files on live server. Create a new folder inside the hosting files or your website files just named with “hotspot”, and drag the zip hotspot file into the folder to upload the zip file.

We are now on live server files, then extract the zip file on the hotspot folder. To extract the zip file, I must go to the cpanel and login with the account hosting. As usual go the file manager and find the hotspot directory on public_html of the hosting files and then you can extract the zip file. After the extraction successfully, we can remove the zip file. So that in the hotspot directory on live server will looked like the picture below!

2. Bypass The URL Domain of the External Hotspot Web Interface

Because External Hotspot Web Interface files is located to the url domain pages, you need to give free or bypassed access to the domain name that used in walled garden. For the automatic configuration, just paste this rule to the new teminal window on winbox!

/ip hotspot walled-garden ip
add action=accept disabled=no dst-host=wiswaweb.com

Go to IP > Hotspot on winbox, you can see the rule on the tab walled garden and walled-garden IP list has a new configuration to accept/allow the domain name with the IP public even the domain using dynamic public IP. So make sure that client can access the all domain pages included with the external hotpot pages without login.

3. Adjustment php files external hotspot and html files internal router

External hotspot web interface on live server can work by the scripts itself or just from live server. Actually It is the proses to access the internal hotspot server that will be redirected to the external pages on live server including the variables hotspot that used. The client will send the input variables and see the data variables of the internal hotspot server through external hotspot pages or interface on live server.

The script Login.html on the hotspot router files

<html>
<head><title>login</title></head>
<body>
$(if chap-id)
<noscript>
<center><b>JavaScript required. Enable JavaScript to continue.</b></center>
</noscript>
$(endif)
<center>If you are not redirected in a few seconds, click 'continue' below<br>
<form name="redirect" action="http://wiswaweb.com/hotspot/login.php" method="post">
<input type="hidden" name="mac" value="$(mac)">
<input type="hidden" name="ip" value="$(ip)">
<input type="hidden" name="username" value="$(username)">
<input type="hidden" name="link-login" value="$(link-login)">
<input type="hidden" name="link-orig" value="$(link-orig)">
<input type="hidden" name="error" value="$(error)">
<input type="hidden" name="trial" value="$(trial)">
<input type="hidden" name="chap-id" value="$(chap-id)">
<input type="hidden" name="chap-challenge" value="$(chap-challenge)">
<input type="hidden" name="link-login-only" value="$(link-login-only)">
<input type="hidden" name="link-orig-esc" value="$(link-orig-esc)">
<input type="hidden" name="mac-esc" value="$(mac-esc)">
<input type="hidden" name="identity" value="$(identity)">
<input type="hidden" name="bytes-in-nice" value="$(bytes-in-nice)">
<input type="hidden" name="bytes-out-nice" value="$(bytes-out-nice)">
<input type="hidden" name="session-time-left" value="$(session-time-left)">
<input type="hidden" name="uptime" value="$(uptime)">
<input type="hidden" name="refresh-timeout" value="$(refresh-timeout)">
<input type="hidden" name="link-status" value="$(link-status)">
<input type="submit" value="continue">
</form>
<script language="JavaScript">
   document.redirect.submit();
</script></center>
</body>
</html>

Login.html no longer used for displaying the data hotspot variable, but only send/insert the data variables hotspot that will be redirected to the form of the external login.php

So the data variables will be send with type “hidden” to the external url http://wiswaweb.com/hotspot/login.php which is the login page of the external interface. Input data variables that I used is the same for alogin.html, status.html, and logout.html, it’s no problem because this is the hidden varibles.

The script Login.php on live server / hosting server

<?php
    $mac=$_POST['mac'];
    $ip=$_POST['ip'];
    $username=$_POST['username'];
    $linklogin=$_POST['link-login'];
    $linkorig=$_POST['link-orig'];
    $error=$_POST['error'];
    $trial=$_POST['trial'];
    $loginby=$_POST['login-by'];
    $chapid=$_POST['chap-id'];
    $chapchallenge=$_POST['chap-challenge'];
    $linkloginonly=$_POST['link-login-only'];
    $linkorigesc=$_POST['link-orig-esc'];
    $macesc=$_POST['mac-esc'];
    $identity=$_POST['identity'];
    $bytesinnice=$_POST['bytes-in-nice'];
    $bytesoutnice=$_POST['bytes-out-nice'];
    $sessiontimeleft=$_POST['session-time-left'];
    $uptime=$_POST['uptime'];
    $refreshtimeout=$_POST['refresh-timeout'];   
    $linkstatus=$_POST['link-status'];  
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <title>Mikrotik Hotspot | Login</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link href="css/bootstrap.min.css" rel="stylesheet">
    <link href="css/font-awesome.min.css" rel="stylesheet">
    <link href="css/custom.css" rel="stylesheet">
</head>
<body>
<div id="wrap">
    <div class="navbar navbar-inverse navbar-static-top" role="navigation">
        <div class="container">
            <div class="navbar-header">
                <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
                    <span class="sr-only">Toggle navigation</span>
                    <span class="icon-bar"></span>
                    <span class="icon-bar"></span>
                    <span class="icon-bar"></span>
                </button>
                <a class="navbar-brand" href="#"><?php echo $identity; ?></a>
            </div>
            <div class="collapse navbar-collapse">
                <ul class="nav navbar-nav navbar-right">
                    <li class="active"><a href="http://hotspot.wiswaweb.com">Login</a></li>
                    <li><a href="http://hotspot.wiswaweb.com/status">Status</a></li>
                    <li><a href="http://hotspot.wiswaweb.com/logout?erase-cookie=true">Logout</a></li>
                </ul>
            </div>
        </div>
    </div>

    <div id="bottom-menu">
        <div class="container">
            <div class="row">
                <div class="col-md-2 mylogo">
                    <a href="http://agratitudesign.blogspot.com/" ref="index.html"><img src="img/agratitudesignlogo2.png" alt="logo"></a>
                </div> 
                <div class="col-xs-10 textlogo">
                    <h1>Agratitudesign Hotspot</h1>
                </div>
            </div>
        </div>
    </div>

    <div class="container">
        <div class="col-md-6 col-sm-12">
        
            <div class="row">
                <?php if($error) : ?>
                    <div class="alert alert-danger"><?php echo $error; ?></div>
                <?php endif; ?>

                <div class="alert alert-info">Please log on to use the hotspot service.</div>
                <?php if($trial == 'yes') : ?> 
                    <div class="alert alert-info">
                        Free trial available, <a href="<?php echo $linkloginonly; ?>?dst=<?php echo $linkorigesc; ?>&amp;username=T-<?php echo $macesc; ?>">click here</a>.
                    </div>
                <?php endif; ?>
            </div>
            <div class="row">            
                <div class="panel panel-default">                    
                    <div class="panel-body">

                        <form id="loginForm" class="form-horizontal" role="form" action="<?php echo $linkloginonly; ?>" method="post">
                            <input type="hidden" name="dst" value="<?php echo $linkorig; ?>"/>
                            <input type="hidden" name="popup" value="true"/>

                            <div class="form-group">
                                <label for="inputLogin" class="col-sm-2 control-label">Login</label>

                                <div class="col-sm-10">
                                    <input type="text" class="form-control input-lg" id="inputLogin" name="username"
                                           placeholder="Login" autofocus required>
                                </div>
                            </div>
                            <div class="form-group">
                                <label for="inputPassword" class="col-sm-2 control-label">Password</label>

                                <div class="col-sm-10">
                                    <input type="password" class="form-control input-lg" id="inputPassword" name="password"
                                           placeholder="Password" required>
                                </div>
                            </div>
                            <div class="form-group">
                                <div class="col-sm-offset-2 col-sm-10">
                                    <button type="submit" class="btn btn-primary btn-block btn-lg">OK</button>
                                </div>
                            </div>
                        </form>
                    </div>
                </div>
            </div>
        </div>

        <div class="col-md-6 col-sm-12">
            <div class="panel panel-default">
                <div class="panel-body">

                    <div class="card hovercard">
                        <div class="cardheader">
                        </div>
                        <div class="avatar">
                        <img alt="" src="img/agratitudesignlogo.png">
                        </div>
                        <div class="info">
                        <div class="title">
                        <a href="http://agratitudesign.blogspot.com/">Agratitudesign HighSpeed Hotspot</a>
                        </div>
                        <div class="desc">Website Hotspot Interface For Free</div>
                        <div class="desc">created by <a target="_blank" href="http://agratitudesign.blogspot.com/" title="Agratitudesign Hotspot Templates">agratitudesign.blogspot.com</a></div>
                        <div class="desc">supported by <a target="_blank" href="http://wiswaweb.com/" title="Agratitudesign Hotspot Templates">wiswaweb.com</a></div>
                        </div>
                        <div class="bottom">
                        <a class="btn btn-primary btn-twitter btn-sm" href="https://twitter.com/agratitudesign"><i class="fa fa-twitter"></i></a>
                        <a class="btn btn-danger btn-sm" rel="publisher" href="https://plus.google.com/+KetutAgusSuardika"><i class="fa fa-google-plus"></i></a>
                        <a class="btn btn-primary btn-sm" rel="publisher" href="https://www.facebook.com/pages/Agratitudesign/451131721572773"><i class="fa fa-facebook"></i></a>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<div id="footer">
    <div class="container">
        <p class="text-muted">Powered by <a href="http://agratitudesign.blogspot.com/">Agratitudesign</a></p>
    </div>
</div>

<script type="text/javascript" src="js/jquery.min.js"></script>
<script type="text/javascript" src="js/bootstrap.min.js"></script>

<?php if($chapid) : ?> 
<script type="text/javascript" src="js/md5.js"></script>
<script type="text/javascript">
<!--
    function doLogin() {
    <?php if(strlen($chapid) < 1) echo "return true;n"; ?>
    document.sendin.username.value = document.login.username.value;
    document.sendin.password.value = hexMD5('<?php echo $chapid; ?>' + document.login.password.value + '<?php echo $chapchallenge; ?>');
    document.sendin.submit();
    return false;
    }
//-->
</script>
<?php endif; ?>

<script type="text/javascript">
  document.login.username.focus();
</script>

</body>
</html>

At the top of this script is inserted with the php scripts, this script will collect the data variable hotspot that will be sent by login.html.

<?php
    $mac=$_POST['mac'];
    $ip=$_POST['ip'];
    $username=$_POST['username'];
    $linklogin=$_POST['link-login'];
    $linkorig=$_POST['link-orig'];
    $error=$_POST['error'];
    $trial=$_POST['trial'];
    $loginby=$_POST['login-by'];
    $chapid=$_POST['chap-id'];
    $chapchallenge=$_POST['chap-challenge'];
    $linkloginonly=$_POST['link-login-only'];
    $linkorigesc=$_POST['link-orig-esc'];
    $macesc=$_POST['mac-esc'];
    $identity=$_POST['identity'];
    $bytesinnice=$_POST['bytes-in-nice'];
    $bytesoutnice=$_POST['bytes-out-nice'];
    $sessiontimeleft=$_POST['session-time-left'];
    $uptime=$_POST['uptime'];
    $refreshtimeout=$_POST['refresh-timeout'];
    $linkstatus=$_POST['link-status'];
?>

After the client entered the data login, it will sent back to hotspot server to be processed by md5.js. If it is true will be redirected to the alogin.html, then alogin.html will redirect to alogin.php includes with the hidden hotspot data variables, and so it goes.

Get Variables Hotspot on the Content login.php

Conversion Format

$(identity) --> <?php echo $identity; ?>
$(if error) --> <?php if($error) : ?>
$(endif) --> <?php endif; ?>
$(else) ---> <?php else: ?>
$(if login-by == 'trial') --> <?php if($loginby == 'trial') : ?>
$(elif login-by != 'mac') --> <?php elseif($loginby != 'mac') : ?>

It is different at the time when we get the data hotspot variables login.html that using the format code like this "$(endif)", in login.php will be changed to <?php endif; ?>.So you must change the format in php funtion.

For the complete process you can see on this video article. The complete scripts you can download below as the example. One the important thing that you have to do is to change the url links, such http://wiswaweb.com/hotspot/login.php on each router html files depending on the path url where you put the external hotspot pages. ok...have a try and good luck!

Download

Creating Internal Hotspot Web Interface Login Page Mikrotik using bootstrap

noreply@blogger.com (Agratitudesign) — Sun, 12 Apr 2015 15:39:00 +0000

Creating Internal Hotspot Web Interface Login Page is covering the process to create web page design, customizing the hotspot server variables inside the template web pages, styling the display of hotspot login pagein order to make it more attractive for the client. It could reflecting of the quality of your hotspot services. The styling of the hotspot login page gives a distinct impression, identity and professionalism for your hotspot network services that you have build. The hotspot client may use different types of media screen when they want to login to your hotspot network. Therefore bootstrap will help you to create a responsive design and flexibility of the style to the hotspot web interface.

Hotspot web interface is using the variables of the hotspot server, you can see the variables hotspot wiki mikrotik! The variables hotspot as the core of data hotspot server that you can use and manage to the hotspot web interface, so that can be displayed as hotspot page style. It doesn’t means all of the variables must be included to hotspot web interface, you can select to use those of important variables that you want to display on each pages of the hotspot web interface.

Actually when you setup hotspot server on your mikrotik router, it will create the hotspot files automatically. This is a reference for you how you can create a new style to the hotspot web interface login system as you like. If you are quite satisfied with this display or styling, don't waste your time to read this article. But if you want to create a new hotspot web interface as you like, Let us learn and start together to create a new internal hotspot web interface as you like!

1. Understanding Original Structure of HTML Hotspot Files

To begin in understanding hotspot file system to create a new hotspot web interface as you like, just focus with the main system : login.html, alogin.html, status.html, and logout.html. While md5.js is the javascript code for MD5 password hashing that used together with http-chap login method. It is containing with the rule of the login hotspot system. It always to be the intention for the hacker to find the weaknesses of this MD5 security system. You can download the original hotspot files!

login.html : the page that will displayed to ask usename and password for the hotspot clients. The important thing, It will require md5.js link inside the script.
alogin.html : the page that will displayed after client has logged in, you can insert what the data variables that you want to display or redirecting to the external url.
status.html: the page that will displayed statistics data variables for the client that has logged in.
logout.html : the page that will displayed after the client is logged out

It is just enough 4 html files that you need to understand as the main system of internal hotspot web interface that allow to create a new style for your hotspot network login page.

Actually the hotspot web interface login page based on html language scripts. Here we only manage the position of the hotspot server variables to div wrapper style. The original hotspot login page files doesn't use css or js link that usually use when we build the website page. Next you can add css, images and javascript files as the link file to each hotspot pages.

If you just have a little bit knowledge about how to build the html web pages, don’t worry! You can try to change the example style in customizing hotspot login page until you get the an ideal style that you like.

2. Bootstrap to Create Responsive Design of the Hotspot Web interface

Bootstrap will help you to create a responsive design for the hotspot Web Interface. It is possible your client want to use the hotspot internet connection using various types of media screen, such as mobile, tablet and else. So the style of your hotspot web interface is still looking good, because bootstrap is oriented to build responsive design. You can download the complete files of the basic bootstrap hotspot!

As you can see on the picture above, This is the completeness of the basic bootstrap hotspot web interface files completed with css, fonts, and js files that will be linked to the main html script files. Move all the bootstrap files to the router hotspot files and it will replace the existing html files. After this you can see your hotspot login page will be changed to the basic bootstrap hotspot web interface style.

3. Customizing the Standard/Basic Bootstrap Hotspot Web Interface

It is truly you must understand bootstrap core system to create the hotspot web interface as you like. So much if I want to explain about bootstrap, you need understanding HTML and CSS scripts at first. But things that you must to do when you want to make a new style, create the css according to html tags that used.

The Tag Head of the login.html

<head>
    <title>Mikrotik Hotspot | Login</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link href="css/bootstrap.min.css" rel="stylesheet">
    <link href="css/font-awesome.min.css" rel="stylesheet">
    <link href="css/custom.css" rel="stylesheet">
</head>

The section head contains the title of the page, initial media screen, css links that used separately from the html files. You can make a new rule of the style at custom.css file. You can see the right picture below! This is the section of the body tag. Navbar, container, row, col-md-2 is the general class names on bootstrap system to create the frame html scripts.

The Tag Body of the login.html

Depending on tags html that used on login.html script, we create a new css rules for navbar and bottom-menu style. Using bootstrap you need to understand the class css that usually used by bootstrap system, this will help you create the tag style more quickly. Inside the tag body we place the data variables of the hotspot server mikrotik that we required that will displayed the variables styling more attractive as you like.

The Bottom of the Tag Body “login.html”

<script type="text/javascript" src="js/jquery.min.js"></script>
<script type="text/javascript" src="js/bootstrap.min.js"></script>


$(if chap-id)
    <script type="text/javascript" src="md5.js"></script>
    <script type="text/javascript">
        $('#loginForm').submit(function () {
            var password = $('#inputPassword');
            password.val(hexMD5('$(chap-id)' + password.val() + '$(chap-challenge)'));
        });
    </script>
$(endif)

When you have build the website template you need to insert javascript link, that related to the class css that used on the html body tags, This is more efficient placed before the end of the body tag “</body>. In order to make the page load faster. You must set the link md5.js to the right path, it is very important. Md5.js is required just for login.html page.

Navigation Menu Links

<div class="collapse navbar-collapse">
    <ul class="nav navbar-nav navbar-right">
        <li class="active"><a href="login">Login</a></li>
        <li><a href="status">Status</a></li>
        <li><a href="logout?erase-cookie=true">Logout</a></li>
    </ul>
</div>

Don’t forget to set the links menu as the hotspot login page content that will allow the client to navigate the hotspot menu links to the right links.

Next you can start to customize the main content of the login.html in which you can adjust the variables hostpot position and styling. You can combine with another elements that require to include on login page, creating a new div tag and give the style to the related div tag by creating the css rule on custom.css file. For more clearly as an example I just put the complete customizing login.html additional css rule here!

Complete Customizing login.html Script

<!DOCTYPE html>
<html lang="en">
<head>
    <title>Mikrotik Hotspot | Login</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link href="css/bootstrap.min.css" rel="stylesheet">
    <link href="css/font-awesome.min.css" rel="stylesheet">
    <link href="css/custom.css" rel="stylesheet">
</head>
<body>

<div id="wrap">
    <div class="navbar navbar-inverse navbar-static-top" role="navigation">
        <div class="container">
            <div class="navbar-header">
                <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
                    <span class="sr-only">Toggle navigation</span>
                    <span class="icon-bar"></span>
                    <span class="icon-bar"></span>
                    <span class="icon-bar"></span>
                </button>
                <a class="navbar-brand" href="#">$(identity)</a>
            </div>
            <div class="collapse navbar-collapse">
                <ul class="nav navbar-nav navbar-right">
                    <li class="active"><a href="login">Login</a></li>
                    <li><a href="status">Status</a></li>
                    <li><a href="logout?erase-cookie=true">Logout</a></li>
                </ul>
            </div>
        </div>
    </div>

    <div id="bottom-menu">
        <div class="container">
            <div class="row">
                <div class="col-md-2 mylogo">
                    <a href="http://agratitudesign.blogspot.com/" ref="index.html"><img src="img/agratitudesignlogo2.png" alt="logo"></a>
                </div> 
                <div class="col-xs-10 textlogo">
                    <h1>Agratitudesign Hotspot</h1>
                </div>
            </div>
        </div>
    </div>

    <div class="container">
        <div class="col-md-6 col-sm-12">        
            <div class="row">
                $(if error)
                    <div class="alert alert-danger">$(error)</div>
                $(endif)

                <div class="alert alert-info">Please log on to use the hotspot service.</div>

                $(if trial == 'yes')
                    <div class="alert alert-info">
                        Free trial available, <a href="$(link-login-only)?dst=$(link-orig-esc)&amp;username=T-$(mac-esc)">click here</a>.
                    </div>
                $(endif)
            </div>

            <div class="row">            
                <div class="panel panel-default">                    
                    <div class="panel-body">
                        <form id="loginForm" class="form-horizontal" role="form" action="$(link-login-only)" method="post">
                            <input type="hidden" name="dst" value="$(link-orig)"/>
                            <input type="hidden" name="popup" value="true"/>

                            <div class="form-group">
                                <label for="inputLogin" class="col-sm-2 control-label">Login</label>

                                <div class="col-sm-10">
                                    <input type="text" class="form-control input-lg" id="inputLogin" name="username"
                                           placeholder="Login" autofocus required>
                                </div>
                            </div>
                            <div class="form-group">
                                <label for="inputPassword" class="col-sm-2 control-label">Password</label>

                                <div class="col-sm-10">
                                    <input type="password" class="form-control input-lg" id="inputPassword" name="password"
                                           placeholder="Password" required>
                                </div>
                            </div>
                            <div class="form-group">
                                <div class="col-sm-offset-2 col-sm-10">
                                    <button type="submit" class="btn btn-primary btn-block btn-lg">OK</button>
                                </div>
                            </div>
                        </form>
                    </div>
                </div>
            </div>
        </div>

        <div class="col-md-6 col-sm-12">
            <div class="panel panel-default">
                <div class="panel-body">

                    <div class="card hovercard">
                        <div class="cardheader">
                        </div>
                        <div class="avatar">
                        <img alt="" src="img/agratitudesignlogo.png">
                        </div>
                        <div class="info">
                        <div class="title">
                        <a href="http://agratitudesign.blogspot.com/">Agratitudesign HighSpeed Hotspot</a>
                        </div>
                        <div class="desc">Website Hotspot Interface For Free</div>
                        <div class="desc">created by <a target="_blank" href="http://agratitudesign.blogspot.com/" title="Agratitudesign Hotspot Templates">agratitudesign.blogspot.com</a></div>
                        <div class="desc">supported by <a target="_blank" href="http://wiswaweb.com/" title="Agratitudesign Hotspot Templates">wiswaweb.com</a></div>
                        </div>
                        <div class="bottom">
                        <a class="btn btn-primary btn-twitter btn-sm" href="https://twitter.com/agratitudesign"><i class="fa fa-twitter"></i></a>
                        <a class="btn btn-danger btn-sm" rel="publisher" href="https://plus.google.com/+KetutAgusSuardika"><i class="fa fa-google-plus"></i></a>
                        <a class="btn btn-primary btn-sm" rel="publisher" href="https://www.facebook.com/pages/Agratitudesign/451131721572773"><i class="fa fa-facebook"></i></a>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<div id="footer">
    <div class="container">
        <p class="text-muted">Powered by <a href="http://agratitudesign.blogspot.com/">Agratitudesign</a></p>
    </div>
</div>

<script type="text/javascript" src="js/jquery.min.js"></script>
<script type="text/javascript" src="js/bootstrap.min.js"></script>

$(if chap-id)
    <script type="text/javascript" src="md5.js"></script>
    <script type="text/javascript">
        $('#loginForm').submit(function () {
            var password = $('#inputPassword');
            password.val(hexMD5('$(chap-id)' + password.val() + '$(chap-challenge)'));
        });
    </script>
$(endif)

</body>
</html>

Additional css rule on custom.css file

.navbar {
    margin-bottom: 0px;
}
.navbar-inverse {
    background-color: #153E5D;
    border-color: #2B78C5;
}
.navbar-inverse .navbar-nav > .active > a, .navbar-inverse .navbar-nav > .active > a:hover, .navbar-inverse .navbar-nav > .active > a:focus {
    background-color: #0F8093;
}
#bottom-menu {
    background: url(../img/sky.jpg);
    padding: 10px 0px;
    height: 100px;
    color: #fff;
}
#bottom-menu .mylogo {
    width: 100px;
    float: left;
}
#bottom-menu .textlogo {
    width: 350px;
}

#footer {
    background-color: #153E5D;
}

.text-muted {
    color: #B7B7B7;
}
.textlogo h1 {
    font-family: "Arial",Helvetica,sans-serif;
    font-size: 2em;
    color: #fff;
    font-weight: bold;
    text-shadow: 3px 3px 0px rgba(0, 0, 0, 0.3);
}
.card {
    padding-top: 20px;
    margin: 0;
    background-color: rgba(214, 224, 226, 0.2);
    border-top-width: 0;
    border-bottom-width: 2px;
    -webkit-border-radius: 3px;
    -moz-border-radius: 3px;
    border-radius: 3px;
    -webkit-box-shadow: none;
    -moz-box-shadow: none;
    box-shadow: none;
    -webkit-box-sizing: border-box;
    -moz-box-sizing: border-box;
    box-sizing: border-box;
}
.card .card-heading {
    padding: 0 20px;
    margin: 0;
}
.card .card-heading.simple {
    font-size: 20px;
    font-weight: 300;
    color: #777;
    border-bottom: 1px solid #e5e5e5;
}
.card .card-heading.image img {
    display: inline-block;
    width: 46px;
    height: 46px;
    margin-right: 15px;
    vertical-align: top;
    border: 0;
    -webkit-border-radius: 50%;
    -moz-border-radius: 50%;
    border-radius: 50%;
}
.card .card-heading.image .card-heading-header {
    display: inline-block;
    vertical-align: top;
}
.card .card-heading.image .card-heading-header h3 {
    margin: 0;
    font-size: 14px;
    line-height: 16px;
    color: #262626;
}
.card .card-heading.image .card-heading-header span {
    font-size: 12px;
    color: #999999;
}
.card .card-body {
    padding: 0 20px;
    margin-top: 20px;
}
.card .card-media {
    padding: 0 20px;
    margin: 0 -14px;
}
.card .card-media img {
    max-width: 100%;
    max-height: 100%;
}
.card .card-actions {
    min-height: 30px;
    padding: 0 20px 20px 20px;
    margin: 20px 0 0 0;
}
.card .card-comments {
    padding: 20px;
    margin: 0;
    background-color: #f8f8f8;
}
.card .card-comments .comments-collapse-toggle {
    padding: 0;
    margin: 0 20px 12px 20px;
}
.card .card-comments .comments-collapse-toggle a,
.card .card-comments .comments-collapse-toggle span {
    padding-right: 5px;
    overflow: hidden;
    font-size: 12px;
    color: #999;
    text-overflow: ellipsis;
    white-space: nowrap;
}

.card-comments .media-heading {
    font-size: 13px;
    font-weight: bold;
}
.card.people {
    position: relative;
    display: inline-block;
    width: 170px;
    height: 300px;
    padding-top: 0;
    margin-left: 20px;
    overflow: hidden;
    vertical-align: top;
}
.card.people:first-child {
    margin-left: 0;
}
.card.people .card-top {
    position: absolute;
    top: 0;
    left: 0;
    display: inline-block;
    width: 170px;
    height: 150px;
    background-color: #ffffff;
}
.card.people .card-top.green {
    background-color: #53a93f;
}
.card.people .card-top.blue {
    background-color: #427fed;
}
.card.people .card-info {
    position: absolute;
    top: 150px;
    display: inline-block;
    width: 100%;
    height: 101px;
    overflow: hidden;
    background: #ffffff;
    -webkit-box-sizing: border-box;
    -moz-box-sizing: border-box;
    box-sizing: border-box;
}
.card.people .card-info .title {
    display: block;
    margin: 8px 14px 0 14px;
    overflow: hidden;
    font-size: 16px;
    font-weight: bold;
    line-height: 18px;
    color: #404040;
}
.card.people .card-info .desc {
    display: block;
    margin: 8px 14px 0 14px;
    overflow: hidden;
    font-size: 12px;
    line-height: 16px;
    color: #737373;
    text-overflow: ellipsis;
}
.card.people .card-bottom {
    position: absolute;
    bottom: 0;
    left: 0;
    display: inline-block;
    width: 100%;
    padding: 10px 20px;
    line-height: 29px;
    text-align: center;
    -webkit-box-sizing: border-box;
    -moz-box-sizing: border-box;
    box-sizing: border-box;
}
.card.hovercard {
    position: relative;
    padding-top: 0;
    overflow: hidden;
    text-align: center;
    background-color: rgba(140, 225, 242, 0.2);
}
.card.hovercard .cardheader {
    background: url("../img/bedugul.jpg");
    background-size: cover;
    width: auto;
    height: 135px;
}
.card.hovercard .avatar {
    position: relative;
    top: -50px;
    margin-bottom: -50px;
}
.card.hovercard .avatar img {
    width: 100px;
    height: 100px;
    max-width: 100px;
    max-height: 100px;
    -webkit-border-radius: 50%;
    -moz-border-radius: 50%;
    border-radius: 50%;
    border: 5px solid rgba(255,255,255,0.5);
}
.card.hovercard .info {
    padding: 4px 8px 10px;
}

.card.hovercard .info .title {
    margin-bottom: 4px;
    font-size: 24px;
    line-height: 1;
    color: #262626;
    vertical-align: middle;
}
.card.hovercard .info .desc {
    overflow: hidden;
    font-size: 12px;
    line-height: 20px;
    color: #737373;
    text-overflow: ellipsis;
}
.card.hovercard .bottom {
    padding: 0 20px;
    margin-bottom: 17px;
}
.card .btn{ border-radius: 50%; width:32px; height:32px; line-height:18px;  }

4. Optimizing Internal Hotspot Web Interface Login Page

Mikrotik router has limited system resources, please check your router system resource! click on System > Resources, and you will see free memory that still remain and HDD Space of the type of mikrotik routherboard. Do you know what it means? Creating or customizing the Internal Hotspot Web Interface Login Page must be considering the capabilities of your router that you have used.

Using many effect, behavior and images on the hotspot web interface can effect or disturbing the performance of router. This is possible to make the hotspot login page doesn’t work properly. Compress the image file that you are using, do not create the excessive thing here, unless the router has a large capacity.

5. The Complete Project of the Internal Hotspot Web Interface Login Page

This the complete project of the Internal Hotspot Web Interface, so you are more clearly in customizing your hotspot interface login page. I know there among of you who feel lazy start from the beginning, or just want the practical and instantly to create by changing the images and text, it is up to you. First you need to remove hotspot files on your router and change with the complete hotspot web interface project, that you can change to create a new style as you like!

Download

Redirect HTTPS Hotspot Login Page Mikrotik Self-Signed Certificate

noreply@blogger.com (Agratitudesign) — Fri, 03 Apr 2015 12:12:00 +0000

In order to provide the best service for your client, and for those of you who just start a new business or just want to share the internet connection using mikrotik hotspot servers, you need to know the aspects of the accessing https hotspot login page. Before we go further to create the web login template/interface to the hotspot login, I think it is require to improve the understanding of the access https hotspot login page, so that can be resolve the problems that may be found in the future, this is the one of the important things that we must know in building hotspot server systems.

HTTPS is a secure HTTP connection that using SSL (Secure Socket Layer) protocol to encrypt transmissions to provide protection from eavesdroppers attacks that use port 443. In other word, HTTPS is using for the secure connection over the clients that will increase the confidence of the client to use the website page connection. Using HTTPS connections associated with SSL Certificates that contains the data files of the organization's.

To use HTTPS connections that allow the clients access Hotspot login page, we need to install SSL certificate that will initiate secure sessions to the browsers. Keep in mind Hotspot login page will act as the web server to our hotspot client that the files is located in the router. Actually when the clients want to access the login page the internet connection is already up to the clients but to use the internet they have to login through the hotspot server rules. So the clients request to use firewall rules into hotspot login page using the account member.

Look at the picture above! This is the previous configuration of the hotspot server profile that only use HTTP CHAP. This is the standard method access the hotspot login page, HTTP CHAP is unencrypted connection for the security consideration it is not recommended, so that the client can access the login page Using HTTP Connection.

The client will be redirecting to the login page when typing such agratitudesign.blogspot.com, wiswaweb.com that only use HTTP connection, and google.com, youtube.com that uses both connection, HTTP and HTTPS.

But when the client using such a facebook.com, github.com, this is very strict just only use HTTPS connections as their trusted identity. or inadvertently entered through the complete url like this https://www.youtube.com/. Our clients will not redirecting to the login page.

What do you think if the clients meet like this, oh error, trouble, bad service. Actually the internet connection is already but where is the login page? they should use the HTTP connection to login or just typing such 192.168.1.1/login or hotspot dns name such hotspot.wiswaweb.com. But not any advice, the something like a boom and they have stuck and this is likely not a good service for them.

As I said before, to use redirect HTTPS hotspot login page connections, we must use SSL Certificate. For widespread use for the professional website server, the SSL certificates should be excluded from the authorities, actually we must pay for this to be signed by trusted authority. When we have decided to buy SSL certificate make sure you must have domain name to be certified. Or when you have public IP you can create a free domain for the hotspot login page.

Ok no matter whether buy or get for free of the SSL certificate, I will show Self-Signed Certificate to prove how the process redirect https login page works using openSSL. You can download openssl-0.9.8k_WIN32 and openssl-0.9.8k_WIN64 depending on your system. Extract the zip file, and just put the folder/directory OpenSSL on the desktop and rename the folder as “openssl”. On the folder openssl, go to bin folder and click on openssl.exe to run openssl command prompt.

1. Creating self –signed our own CA (Certificate Authority)

First we generate the RSA Private Key in order Create CA (Certificate Authority). Certificate is containing our identity and organization details. For more faster just paste it on openssl command prompt one by one (look at the number of this command lines!).

genrsa -des3 -out ca.key 4096
req -config C:\Users\agus\Desktop\openssl\openssl.cnf -new -x509 -days 3650 -key ca.key -out ca.crt

The final goal in this step is creating “ca.key and ca.crt”. “C:\Users\agus\Desktop\openssl\openssl.cnf” is the path where the openssl.cnf file is located. “Common Name : hotspot.wiswaweb.com” is a dns name of the hotspot server profile that used.

2. Creating self-signed hotspot server certificate

We generate the RSA Private Key, Certificate Signing Request (CSR) and finally self-signed hotspot server certificate itself.

genrsa -des3 -out server.key 4096
req -config C:\Users\agus\Desktop\openssl\openssl.cnf -new -key server.key -out server.csr
x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

After this we can close openSSL command prompt, and now we have three hotspot server certificate files, that is server.key, server.csr, and server.crt.

3. Upload and Import the self-signed certifate hotspot server files

Copy that tree server files and place into 1 folder, just named as key. Now we are going to upload the three files in folder key, we can also use winSCP, fireFTP, etc, to make easier to upload and put the certificate files against another files on the router.

After upload the files we are going to import them to the router as the self-signed sertificate on the router system. Using winbox click System>Certificates. On the tab certificates, press import and and we look for the files that have been uploaded, as shown like the right picture above. First we have to import server.crt, then server.key. In this case we just require server certificate the file that has extension .crt and the key files. We can see the information identity details of the self-signed certificate.

4. Change the configuration of the hotspot server mikrotik

After import the certificate, now we have certificate on the router system with the name cert_1. Go to the hotspot server profiles and activate HTTPS option Login by and use SSL certificate cert_1. Don’t to activate SSL service port on the IP Service List that now using cert_1 certificate. Look at the pictures below!

Now we can see how the Self-Signed Certificate redirect https login page works on the hotspot clients. When I use 2 options login by “HTTP and HTTPS” with SSL Certificate “cert_1”

The clients type : google.com, youtube.com, bloger.com, all the kind web server that use 2 type connections (HTTPS and HTTP) or the web server that just only have HTTP access, such wiswaweb.com. It’s no problem, the client could be redirected to login page https://hotspot.wiswaweb.com/login?...

The clients using the complete url : https://www.google.com/, https:// youtube.com /, https:// bloger.com. that means the clients use https access for the kind web server. In this case the clients will meet the security warning with add exception choice, before could be redirected to login page https://hotspot.wiswaweb.com/login?...

The clients type : facebook.com, github.com and other web server that very strict just only use HTTPS connections. In this case the clients will meet the security warning with the notification only valid for https://hotspot.wiswaweb.com/login?...

But the security warning will be different on another browser, in this case I have use Mozilla Firefox. Self-signed certificate is the internal application that just signed by me or yourself, this is for our local system, but when using the internet connection, it won't recognize as trusted unless you buy the external certificate authority to remove the security warning. But at least self-signed certificate as the prove how the process redirecting HTTPS works, and the clients got the security warning that can add the exception and notification to access the hotspot login page.

Somebody said that this security warning can be resolve using the squid proxy on the internal network, but I still can not prove it. So the best choice to remove the security warning is the external certificate authority for your hotspot login page. Using a certificate free version still can not recognize your hotspot login page as trusted.

If you still consider that it is important and you have decided to buy an external certificate authority, you will get the certificate file and the key, and just need to import the files as I show above on your router. But you must prepare your domain name. This is the best way for those of you who already have the website domain, and the hotspot login page is using a sub domain, such a hotspot.wiswaweb.com. There are much websites that provide SSL certificate authority services like startssl.com.

So that's all I can inform you about redirecting HTTPS hotspot login page, have a try and good luck!

Fix and Stabilize DNS Server Mikrotik Internet Connection

noreply@blogger.com (Agratitudesign) — Wed, 01 Apr 2015 14:39:00 +0000

This is about the analysis of the problem dns server on mikrotik network system in distributing internet connection from ISP to the server and the clients network using mikrotik router. This problem may often found during we have made the internet network using dhcp and hotspot server of the network system that no need to set the workgrouph and the IP for the clients unit . Perhaps some of you think that is easy problem to fix but for the beginner especially, This could be the biggest problem make they have stuck for long time to find the solution.

Actually the problem that indicates by “your dns server that might be unavailable” or other warning that blame dns server in problem, this is because the clients that using the internet can’t access or get dns server which can be caused by many things on the network system. This problem also can be caused by abnormality or the conflict on the client network system itself. You must think about where the source of the problem is. By comparing, analyzing and feeling, you should be able to guess where the main problem come, and minimize the problem scope.

Here I assume there is no problem with the lan cables, connector, router, access point and another equipment that you have used on your network and the individual or relative client problem. But the problem is just caused by the router, access point and wan server configuration that you may have made which is the sole responsibility of us. Ok let’s see the network scheme that I have made for the example study case!

Based on the network scheme, when we have found the problem such “your dns server might be unavailable” which one do you blame? from experience that I have found, the internet connection with Dns from ISP has reached to the wan server and router. But when the router continue to distribute the internet to the access point and finally to the clients are losing the DNS.

It looks like the router has failed to give the dns access that sometime bring the conflict on dns between wan server and the router. And this problem occurs is not consistent. The instability dns that frequently occurs is not entirely due to the fault router. It also depends on the kind internet connection from your ISP. My ISP does not allow me to use another dns, such a google and opendns. If you are using the kind ISP, building local dns server will be the best choice to overcome this problem.

1. Using DHCP Client to Get Dynamic Network Address from WAN Server

In this case I have to change of the mikrotik router configurations especially to public interface setting. I have use dhcp client to get dynamic network address of dial-up connection ISP that is shared from wan server 192.168.137.1. It will create dynamic address list, change the Pref. Source, and create a new gateway reachable wan. Don’t forget to remove the static network adress list of the public interface and the gateway route that we have used previously! look at the pictures below!

/ip dhcp-client
add interface=wan use-peer-dns=yes add-default-route=yes disabled=no

2. Create Local DNS Server on Wan Server

If you have used wan server to share the internet connection from ISP (dial-up connection) you can create local dns server here. Local dns server will be collecting and covering dns from ISP and other dns. So if the client is directed to local dns server, this will be more faster . In some case local dns server can be fix problem and stabilize dns server from mikrotik router to the client. You can build local dns server using Simple Dns plus and Bind.

3. Ensuring DNS Server Setting on The Router

Check dns settings on the router that now using dynamic servers of the wan server. This is going to be the main suspect the cause of the problem dns server that might be unavailable. If you are not using dynamic servers, try to reset dns setting by removing this configuration at first, restart the router and try to set a new dns setting that use opendns server!

/ip dns
set allow-remote-requests=yes cache-max-ttl=1w cache-size=5000KiB max-udp-packet-size=512 servers=208.67.222.222,208.67.220.220

4. Fix the Internal Network System of Wan Server & Clients from The Conflict

Wan server should not be installed by many software that may bring any conflict which can cause the internal conflicts of the network systems. If you are not sure the network system of wan server work normally. Try to reset the network system using Complete Internet Repair to fix the internal conflict network system, select the option that you want to reset! Then you setup a new configuration on wan server and build local dns server, to create dns request works more stable and faster to your network clients.

5. Bypass The Access Point using IP Bindings on The Router Hotspot Server

This is an additional on Hotspot network system, if you are using Access Point and Hotspot Server separately. IP address or Mac address of the Access Point should be bypassed on Hotspot Server configuration. We can use IP Binding to bypass Access Point, for more clearly let's see The Access Point configuration on the pictures below!

In this case Access Point is using static IP address and the dhcp server is disabled because the Access Point is the client on the hotspot server system. So the Access Point should be made as static address on the router. Click IP > ARP then on the ARP List window, right click on the IP address or Mac address Access Point and Make it Static. Next click on new terminal and choose one of the following IP Binding rules to make the configuration on the router hotspot server to bypass the Access Point IP address or Mac address that we use, look at the pictures below!

/ip hotspot ip-binding add mac-address=F4:EC:38:D6:2E:F5 type=bypassed comment "bypass access point mac address"
/ip hotspot ip-binding add address=192.168.1.254 type=bypassed comment "bypass access point ip address"

So this is all that I have done to fix and stabilize dns server system on mikrotik network, and now the hotspot clients can be access the internet that more stable. take care!

Basic GitHub & Migrating All GoogleCode SVN Projects

noreply@blogger.com (Agratitudesign) — Sat, 28 Mar 2015 06:31:00 +0000

GitHub is the most popular for website server hosting project files that based on Git repository system, which offers all of the distributed revision control and source code management (SCM) as the social coding of the project files server. Github allow you to work on the project files and collaborate between you and your group to build a new release projects. Using version control system, Github is like subversion system when you usually use google code SVN project hosting.

As probably you know Google Code will be turning down until August 201, as the alternative server Google Code recommends to migrate the projects files to GitHub, Bitbucket, or SourceForge. Google code also has provide the exporter tool that make you easy to move the SVN projects to the GitHub Repository automatically, we just need to have a GitHub account as the place that you can transfer/move your projects.

When we using google code exporter is not all directories files of the SVN project successfully transferred, that’s why we must understand the repository project on GitHub at first so that you can move all the project files on SVN directories of the google code. For example if you have put the project files on tag SVN directory. This Project files can not be moved using google code exporter, we must do it manually.

Project Files Repository Git Hub

GitHub has Repository as the staging project area where you put the project files. 1 Repository which are classified into 2 main categories, such as branches and tags. But in Google Gode we have SVN Project which are classified into 4 categories, such as branches, tags, trunk and wiki.

Master is a default branch on GitHub repository, it is equal with Trunk on SVN as the main development area. This is where the major release of the project files lives.

Branches is a development releases that usually use to do bug fixes and make a new release. This is like the experiment area. In Github Master is one of the branch, but in Google Code SVN it was separated as Trunk.

Tags is a stable or final releases , in Github the files on this staging can not be removed, unless you remove the tag itself.

The URL Raw Link of The Project Files on GitHub

When we have use Google Code SVN Project to get the URL link for each project files, we usually use this format URL!

https://your-project-name.googlecode.com/svn/trunk/file_name.ext

It is not only for the files, but we can get the URL link for any directory that may have some files inside. So we can use the format URL like this!

https://your-project-name.googlecode.com/svn/trunk/
https://your-project-name.googlecode.com/svn/trunk/directory-name

But in GitHub just can get the URL Raw link just for the files generally. You can open any file that you need to get the URL link on your repository and click on the Raw button to see the URL link of the file.

So we can see the format URL link like this !

https://raw.githubusercontent.com/suardika/agratitudesign-template/master/jquery.easing.1.3.js

The URL raw link is using “raw.githubusercontent.com” we can access and use it as the link on your coding project website or blog but this is call the local url, for link js file it’s work, but in some other extension file, it may doesn’t work properly. Therefore you must be change the URL link using alias url link of the file. You can open http://rawgit.com/, to change the URL link of the raw file. Copy the URL raw link file and paste it this web page you can get 2 alias url file link. Use the URL alias on the right side that using "cdn.rawgit.com", the is more faster and stable to load even in high traffic like the picture below!.

Next to work with GitHub repository project, we can use the Git-Bash tool from git-scm, you learn much about git system here. Git-Bash is the application that can remote the repository project that you need. So that we can add, remove, edit, and update the files just from the local folder that have been initialized to the repository staging and otherwise. I think GitHub has more simple operation with Git-Bash tool rather then using tortoiseSVN.

I have demonstrate how to migrate all google code projects to the GitHub repository, for more clearly you can see the article video. But here I just give a notice of command line in several cases that using on the video! As also the notice for me at least.

HTTPS URL That Will Use to Remote and Clone The Projects

It is Recommended to use HTTPS to remote or clone any project of the URL link, Such as

https://your-project-name.googlecode.com/svn/trunk/
https://code.google.com/p/your-project-name/source/browse/trunk/
https://agratitudesign-template.googlecode.com/svn/tags/
https://code.google.com/p/agratitudesign-template/source/browse/tags/

General Command lines in Git Bash

pwd : command to find out where we currently are
cd d:/backup : jump another drive directory local
cd ~/desktop/ : jump to default user directory
mkdir new-folder : create a new folder to the active directory git-bash
rm -r path/to/folder : remove the folder using the path folder
mv path/to/file.ext different/path/file.ext : move file from the path to the path
cd desktop : desktop must be existing in current active directory
cd .. : out from the current directory
ls : view the current content directory
clear : clearing the screen command line
rm folder : remove folder of the existing active current directory
rm "selfi - copy.jpg" : remove file with the name that using space
git add README.md : add a new or changed file extension but in between local and staging
git add folder : add a new or changed all files in directory
vim README.md : editing file using vim app git-bash
nano README.md editing file using nano app git-bash
git status : check the status process
git commit -m "comment for Commit" : give the statement to change the file or directory
git log : check the log process
git push -u origin master : transfer the changes and commit to the staging area

Fix Problem Remoting or Cloning the Url Projects

Use another/Change : (origin | destination | branch | tags), another solution you can rename or delete the existing remote and change the new remote.

git remote add origin https://github.com/suardika/agratitudesign-template.git
fatal : already exist

Renaming
git remote -v : check the existing remote
git remote rename origin destination : rename the origin remote to destination remote
git remote -v : make sure to check the existing remote

Deleting
git remote -v : check the existing remote
git remote rm origin : remove the origin remote
git remote –v : make sure to check the existing remote

Method I Download Upload Add Update Project Files Repositoy Github

We download repository project from the staging to the local directory. You have found a new folder name as the project repository name that has already initialized. If you have clone no need initialize or remote the folder again.

git config --global user.name "suardika"
git config --global user.email "agratitudesign@gmail.com"
git clone add origin https://github.com/suardika/agratitudesign-template.git
cd agratitudesign-template

After this you can add or edit any file of the initial folder and update the changes to the staging repository

git add * or git anyfile.js
git commit -m "adding new file"
git status
git push origin master

type username and password of your github account, new file or editing file with the commit will be updating to the staging repository.
If you or your group do any changes from the staging repository github, and want to update the local files

git status
git pull origin master

Method II Migrating Tags Project Google Code SVN to The Git Hub

Tags are used for creating stable releases

git svn clone https://agratitudesign-template.googlecode.com/svn/tags/

tags will be cloned to your local computer, we need to remove the initial file from the SVN and the tags folder will be initialized and remoted from git hub repository.

cd tags
rm -rf .git
git config --global user.name "suardika"
git config --global user.email "agratitudesign@gmail.com"
git init
git remote add origin https://github.com/suardika/agratitudesign-template.git

Still in the tags folder/directory of the active command line, the tags folder from googlecode now have initialed and remoted to the repository. We creating a new tag to the github repository

git add *
git commit -m "adding googlecode tags"

now we need to push the tags folder to the github as a tag project

git tag balinese
git push --tags

If you want to remove the tag project on github repository

git tag -d balinese
git push origin :balinese

Method III Create and Manage Branches Project on Git Hub

Branches are used for development releases. Right click on the local folder project that will move as a new branch. We need to initialize and remote the repository, after this we can add and give the commit to upload this project folder as a branch to the repository.

git config --global user.name "suardika"
git config --global user.email "agratitudesign@gmail.com"
git init
git remote add origin https://github.com/suardika/agratitudesign-template.git
git add *
git commit -m "commit branch 1"

Now the folder folder still in between local and github repository, we push this folder project as a branch "-b" to create a new branch

git checkout -b branch1
git push origin branch1

To work with this branch: "git checkout branch1" and to see what branches you currently have : git branch -v. But sometime when you want to remove the branch on the repository.

git checkout master git branch -D branch1
git push origin :branch1

Method IV Simple Add & Remove The Project Repository Files

Sometime I just want just a simple way without using many command line, when I just have any files on the folder that I want to upload and download, editing and updating from or to github repository. Right Click Folder anything that you want and click git-bash on the option. And I just to copy and paste the command lines.

Sometime I want the foldes or files folder on the github project repository. I just right click the intention folder.

git rm -rf emoticon
git add *
git commit -m "commit new files"
git push origin master

Build Hotspot Server Web Login Pages of the User Profiles

noreply@blogger.com (Agratitudesign) — Sun, 15 Mar 2015 06:10:00 +0000

This is the second part of the building hotspot network, I hope you've been following the previous articles, for the make you easy to understand of this term and conditions. I have explained the scheme and configuration and building the hotspot network before by using DHCP server, all clients can use the internet from the hotspot network to with the same username and password because just using single login from the wireless access point, this is not using the Hotspot Server and User Profiles to manage the hotspot network login.

This structure of the network system that I use ise the same as before, but in this case I did not use login from wireless TP-link as the access point. It will allows everyone to be able to access the web login page but to use the internet connection, client must login as the user hotspot server that we will build on the router. So wireless security of the access point will be disable as shown below!

First I remove the previous dhcp server with the IP Pool configuration, and also Firewall Filters and Nat to prevent the conflict with the hotspot server configuration that will also create a new dhcp server, IP pool, firewall filters and firewall nat automatically. You can also check the file list on the winbox should remove it because we will create as new hotspot files. While the mangle, layer 7 protocols and queue tree still you can use. So the basic configuration that should be remain as shown like the picture below!

1. Setup and configuration The Hotspot Server

If you have adjusted the basic configuration of your router, we will begin to setup the hotspot server and the user profiles. Open your winbox, Click IP > Hotspot on the Hotspot | Server (Hotspot window on tab server) you click Hotspot Setup and select your local interface name that was connected to hotspot network.

Next step the hotspot setup will create masquerade and network IP pool for the hotspot network. It will also create dhcp server with IP Pool to give a dynamic IP for hotspot user when connected.

Just follow the next of the setup hotspot, and you will ask any certificate that will be used by the hotspot server and define the SMTP Server. For more quickly Just follow as the pictures below!

Next step is defining the hotspot Dns Name, that allow the users to access hotspot web login page through web browsers and finally setup the Admin User and you will get the massage “setup has completed successfully.

After this you will find the rules on firewall filter and firewall nat, dhcp server and the hotspot web login files will be created automatically on file list router when you have setup the hotspot server like above. For more details you can see the video!

2 Adjustment Hotspot Server and User Profiles

On the Hotspot | Server (Hotspot window on tab server), Click hotspot1, you can the configuration of hotspot server of "hotspot1" that you have just created and you can see the configuration, change the value "Address per MAC" : 1, to make the hotspot server more secure. Each hotspot server refers to local interface that used and IP Pool for dynamic IP network.

Hotspot | Server Profiles, click on hsprof1 you can the configuration! Each server profiles will have DNS Name for login page that related to HTML Directory that placed on File List router. Click on tab login, uncheck the option Cookie as shown like the right picture below!

Hotspot | User Profiles, we will create the some user profiles for the user hotspot. Click (+) on the tab user profiles. Give the name and the limit speed for the user who use this profile, the user will be classify using this user profile, look at the picture below!

You can use the scripts to make each user if don’t want to do manually, like the scripts below!

/ip hotspot user profile
add advertise=no address-pool=hs-pool-2 idle-timeout=none keepalive-timeout=2m name=VIP open-status-page=http-login rate-limit=720k/720k shared-users=1 status-autorefresh=1m transparent-proxy=no
add advertise=no address-pool=hs-pool-2 idle-timeout=none keepalive-timeout=2m name=Gold open-status-page=http-login rate-limit=512k/512k shared-users=1 status-autorefresh=1m transparent-proxy=no
add advertise=no address-pool=hs-pool-2 idle-timeout=none keepalive-timeout=2m name=Silver open-status-page=http-login rate-limit=256k/256k shared-users=1 status-autorefresh=1m transparent-proxy=no

Hotspot | User , first you just only have the admin user with use all hotspot server that you have, you change the configuration and choose the user profile! Just look the picture below!

If you don’t want to create the hotspot user manually, use the scripts like this!

/ip hotspot user
add disabled=no name=neeraj password=123456 profile=VIP server=hotspot1
add disabled=no name=doorat password=123456 profile=Gold server=hotspot1
add disabled=no name=weerat password=123456 profile=Silver server=hotspot1

Congratulations you have just build the hotspot server and profiles for your hotspot network. Now you can access the internet from the hotspot server using user hotspot. You will find the web login hotspot that you must type the username and password that you have created. Look at the picture below!

When you login as the user hotspot, you can access the internet that the bandwidth will be limited by user profile. This rule will show automatically when login on the simple queue rule of the hotspot. The bandwidth user will be managed by user profile that you have defined it, if you don’t use queue tree rules of the connection packets like we have talked about on the hotspot network with just using dhcp server.

You can combine the using of simple queue hotspot with queue tree rules if you require. But you must understand that the queue tree rules will handle first of the user bandwidth, It is up to you to manage which one do you like or you can combine it.

3. Customizing the Web Login Page of the hotspot user

The hotspot server profiles will related to the web login page, this file will created automatically on the File List of the router files. The hotspot web login page becomes very important thing for a variety of your purposes. This could be a medium to promote your company a long as your radius hotspot coverage.

In order to customize and edit the hotspot login page, you can use the application such a winSCP that allow access and manage the hotspot router files. You can use the script editor such a Sublime Text that make you easily in editing the scripts that based on website scripting.

Your knowledge in HTML, CSS, Javascript, and little bit PHP is website language scripts that allow you to make the hotspot login page as your website company as you like and make it more beautiful as your website pages. I will give the example of the hotspot login pages for make you easily in customizing. But I will prepare now to move google code project hosting because google code will be turning down.

If there are problems during this implementation, let us analyze something that may cause failure on mikrotik hotspot server system to Fix and Stabilize DNS Server System.

Fix Problem IP Cloud Access Router Remotely Via Internet

noreply@blogger.com (Agratitudesign) — Fri, 13 Mar 2015 17:46:00 +0000

Now I want to talk about the IP Cloud as a new feature in Router OS Version 6. For those of you who want to access the router wherever you want as long as you are connected to the Internet, the IP cloud will help to get your router DNS Name easily so that you can access the router remotely via internet. For more details you can see on this video!

In order to control your mikrotik router from outside your network there are several ways, but here I will talk about the IP Cloud. To setup IP Cloud, there are a few things that you must be understand, what is needed, and how it could happen. We can access the router from outside network by using public IP address that is related to your ISP services.

You must know the kind of public IP that provided by ISP to fix the problem that you may found during the configuration of the IP Cloud. Some of this terms probably is my own term to classify public IP to make understanding of the public IP that was given by ISP when you use the internet connection.

Special Public IP : ISP have provided a specific public IP for you, you have full rights to use and manage this public IP into your network, because this public IP specifically for you and no one can use it. You like given the address or name on the internet to your network. ISP will give you a special price for this.

Common Public IP : ISP is not given special IP address or name to you on the internet, but you still use public IP to be connected to the internet. In this case you will use the public ip together with all clients of your ISP and this public ip fully managed by ISP itself. You like being under their clients network there is no special name for your network.

Static Public IP : Public IP that is used will not be changed because it is not planned to be changed, this public IP can be Special Public IP or Common Public IP as our terms.

Dynamic Public IP : Public IP that always be changed dynamically when you use connect to internet, the changes have ranges as the network mask of the public IP that used by ISP. Same like Static Public IP, it can be Special Public IP or Common Public IP.

Private IP is the addresss of your local network, you are free to give the IP address for all network units, but it can not be known that can not be accessing directly via internet without forwarding the public IP itself. In other word Private IP is a relative IP address to your network and Public IP is an Absolute IP address to your network.

1. Setup IP Cloud in QoS Ros for the Version 6.14 and Above

To obtain a DNS name using IP Cloud Mikrotik you can be done in a very simple way. Click IP > Cloud, at Cloud window and tick on enable and update time option and click Apply!

Furthermore, if you see the warning like this! "DDNS server received request from IP 49.128.190.10 but your local IP was 103.10.151.2; DDNS service might not work." It means your public interface router is just using Private IP. In this situation you can not use this DNS Name by IP Cloud to access the router from outside network or the internet. For more information about configuring IP Cloud you can click on this wiki mikrotik link here.

Therefore to fix this problem understanding of the public IP that provided by ISP and the IP address that you use to the router public interface becomes very important. When you want to access you router remotely via internet, it means you want to accces the router from outside of your network by using internet that will be open the port of your router public interface. You can ask your ISP or check by typing IP on Google Search, or you can use any website to detect your public Ip that currently used!

If you have Special Public IP in my own term from your ISP to your network, but the public IP that you have is in dynamic public IP that can be changed at any time by your ISP, IP cloud will be the best solution that will update your public IP automatically so you do not lose your dns name from the current public IP to access router from outside network. This is going to be the main goal of the IP Cloud as the solution for dynamic public IP.

In this case I do not have a special public ip which means I just only have private ip on my router public interface, but my ISP uses static public IP, I just need to make some adjustments of the IP network of my router public interface and the IP gateway of wan server to make the IP Cloud can be working. And it still allow me to access the router using DNS name by IP Cloud or the common public ip of my ISP. It means that's me who was claimed this public ip by ISP as the address for my router, does it not?

2. Change The Network IP of the Public Interface (Wan) on Address List

Open winbox using the current IP address of the interface that you connected, In this case I have connected to the router from wan server. Click IP > Addresses, and click wan interface on the address List, then I need to change address and network to adjust with the public IP 49.128.190.10, you can see as shown like the picture below!

3. Change The IP address of Wan Server

Open Network Connection, Right click on the wan adapter as the internet server and choose the properties and change the IP address. In this case I have to change the IP address to be 49.128.190.1 as the internet gateway of the router, as shown like the picture below!

4. Change the Gateway Route according to IP address of the internet gateway of Wan server

Open winbox using the new IP address of the public interface, and click IP > Routes. On the Route List you click on unreachable gateway that need to change to be the new IP Gateway of Wan Server in this case 49.128.190.1, click ok and you have changed the IP network of the public router according to public IP by ISP as shown like the picture below!

And Finally you can check your router DNS Name. Still on winbox, click IP > Cloud and now you can find the IP Cloud has been updated. With this DNS Name you can access your router from the internet remotely.

This is going to be the basic understanding to access all the equipment that using IP Address on the network such a CCTV network, same like the router you can access the video CCTV network from outside just using internet connection.

For more clearly about understand mikrotik IP Cloud, I have been update a new video in order to access Mikrotik Router remotely that has been installed after the main provider router, it means hiding behind the provider router, lets watch this video below!

Implementing QoS ROS V6 in Building DHCP Hotspot Network

noreply@blogger.com (Agratitudesign) — Sun, 08 Mar 2015 08:20:00 +0000

In order to create the system that is a little bit more complex, we must start from the simple things. Although this a simple do not think that it does not mean anything. I am sure the understanding of a simple things will help us to improve it into a more complex system that has never been seen before. Regardless of any shortcomings that exist in this blog, there are a negative comments and dislike in the video that I get, the passion in the new exploration is become the soul of agratitudesign want to brings a little solve for the knowledge through the case study using the experience and experiment.

In this article I will show you about the implementation QoS ROS V6 in building a simple hotspot network, how we can manage of the bandwidth management. As probably you know QoS ROS Version 6 is the improvements of all the shortcomings during along the review of the previous versions. Also i want to show you the initial configuration in building a network using your favorite router. As an example in this case I will build a simple hotspot network using QoS V6. You can see in detail the entire configuration process through this following video!

1. Setup and Configuring Mikrotik to build a Simple Hotspot

In order to build a simple hotspot system you see the schematic picture above! Using the internet connection to the hotspot network system. I am using a modem that that will shared through 1 unit computer server connected win lan cable leading to the interface ether1 of the interface Mikrotik router RB 750. The internet will be distribute via ether2 interface to the hotspot network that will be routed through the Wireless TP-link as the access point where the client by using wifi terminal connected to the access point at first.

For that you have to do some configuration to your access point that is adjusted to the ip address of the router network configuration. You can use another access point if you don't have wireless router terminal on mikrotik router. If your router already have wireless terminal you can directly configure the router network that allow the client that is connected to your network.

The above pictures are an example of the configuration of wireless TP-Link as an access point of your router if the router don't have any wireless terminal for the access point. If you are using wireless TP-Link, please adjust the IP configuration to your network Mikrotik interfaces that you are using. The access points must use router gateway. In this case I do not use dhcp server of the access point, because the final I want to do much configuration using dhcp server from Mikrotik router centrally!

Assuming that you've done in configuring of your access point , and has connected to the router that has the Internet gateway, then we will do the mikrotik configuration using Winbox from the client that is connected to the access point. You need to set up the IP address as you have planned for the final configuration as the schematic plan above.

We have not done anything on the mikrotik configuration, we can only access the Winbox from the client using mac address as shown like the picture above. Once we enterd to Winbox, we do not use the default configuration of the router. Click on the Remove Configuration, we will do some configuration manually according to the schematic plan.

Give the name of your interface list, adjust it depends on where the interface router that you put with, in this case I have use ether1 and ether2, if it is not so clear, let you see the video tutorial

Ether1=wan |Ip Network =192.168.137.2/24 (public interface)
Ether2=hotspot |Ip Network =192.168.1.1/24 (local interface)

Then for more quickly you enter this following scripts to the new terminal winbox!

/ip address
add address=192.168.137.2/24 interface=wan
add address=192.168.1.1/24 interface=hotspot
/ip dns
set allow-remote-requests=yes cache-max-ttl=1w cache-size=5000KiB max-udp-packet-size=512 servers=8.8.8.8,8.8.4.4
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.137.1
/ip firewall nat 
add action=masquerade chain=srcnat out-interface=wan src-address=192.168.1.0/24 disabled=no comment="Masquerade Public Traffic"

Make sure your network interfaces and the gateway has been reachable, see on the Route List of your router as the left picture above, then you can setup your dhcp server for your clients. And now you can restart the router and reconnect your wireless access point to get a new ip address as a client from the dhcp server router. After this you can access the winbox using ip address 192.168.1.1 as the gateway of your router. Untill this step your internet access has been occurred.

2. Mangle and Queue tree rules as the QoS implementation in version 6

In this case we are not using hotspot to manage the bandwidth for each client logins, I will talk about this next time. For now just enough in using general QoS to manage your clients bandwidth that connected to dhcp server so you can see about the QoS works in version 6. Ok we start by defining the configuration in Layer 7 Protocols, for more quickly, please insert the script below as usually you do in version 5!

/ip firewall layer7-protocol
add comment="download" name=high regexp="^.*get.+\\.(exe|rar|iso|zip|7zip|0[0-9][1-9]|flv|mkv|avi|mp4|3gp|rmvb|mp3|img|dat|mov).*\$"
add comment="download" name=document regexp="^.*get.+\\.(pdf|doc|docx|xlsx|xls|rtf|ppt|ppt).*\$"
add comment="video" name=youtube regexp="^.*get.+\\.(c.youtube.com|cdn.dailymotion.com|metacafe.com|mccont.com).*\$"
add comment="video" name=streaming regexp="videoplayback|video"
add comment="video" name=youtube_matcher regexp="(GET \\/videoplayback\\\?|GET \\/crossdomain\\.xml)"

You can add any definition else to create the kind of connection packets that you need as the QoS of your router. Now how can we mark the connection packets in version 6, look at the mangle scripts below!

/ip firewall mangle
add action=mark-connection chain=forward disabled=no in-interface=wan new-connection-mark=all-outconn passthrough=yes comment="DOWNSTEAM CONNECTION"
add action=mark-packet chain=forward connection-mark=all-outconn disabled=no new-packet-mark=all-outpkt passthrough=yes comment="DOWNSTEAM"
 
/ip firewall mangle
add action=mark-packet chain=forward layer7-protocol=high new-packet-mark=dpkt packet-mark=all-outpkt passthrough=no comment="CLIENT DOWNLOAD FILES"
add action=mark-packet chain=forward layer7-protocol=document new-packet-mark=dpkt packet-mark=all-outpkt passthrough=no comment=""
add action=mark-packet chain=forward connection-bytes=1000000-0 src-port=80,443 passthrough=yes new-packet-mark=dpkt packet-mark=all-outpkt protocol=tcp comment=""
 
/ip firewall mangle
add action=mark-packet chain=forward layer7-protocol=youtube new-packet-mark=spkt packet-mark=all-outpkt passthrough=no comment="CLIENT VIDEO STREAMING"
add action=mark-packet chain=forward layer7-protocol=streaming new-packet-mark=spkt packet-mark=all-outpkt passthrough=no comment=""
add action=mark-packet chain=forward layer7-protocol=youtube_matcher new-packet-mark=spkt packet-mark=all-outpkt passthrough=no comment=""
 
/ip firewall mangle
add action=mark-packet chain=forward connection-bytes=0-1000000 src-port=80,443 passthrough=no new-packet-mark=bpkt packet-mark=all-outpkt protocol=tcp comment="CLIENT BROWSING"

We just need to create the mangle rules using chain=forward with in-interface=wan (public interface) then we will separate into the kind of connection packet else, how long can you defining the connection packets, you can expand this rules as your requirements!
And second you can create the mangle rules using chain=postrouting with out-interface=hotspot (local interface) as you can see on the scripts below!

/ip firewall mangle
add action=mark-connection chain=postrouting disabled=no out-interface=hotspot new-connection-mark=all-outconn passthrough=yes comment="DOWNSTEAM CONNECTION"
add action=mark-packet chain=postrouting connection-mark=all-outconn disabled=no new-packet-mark=all-outpkt passthrough=yes comment="DOWNSTEAM"

/ip firewall mangle
add action=mark-packet chain=postrouting layer7-protocol=high new-packet-mark=dpkt packet-mark=all-outpkt passthrough=no comment="CLIENT DOWNLOAD"
add action=mark-packet chain=postrouting layer7-protocol=document new-packet-mark=dpkt packet-mark=all-outpkt passthrough=no comment=""
add action=mark-packet chain=postrouting connection-bytes=1000000-0 src-port=80,443 passthrough=yes new-packet-mark=dpkt packet-mark=all-outpkt protocol=tcp comment=""

/ip firewall mangle
add action=mark-packet chain=postrouting layer7-protocol=youtube new-packet-mark=spkt packet-mark=all-outpkt passthrough=no comment="CLIENT VIDEO"
add action=mark-packet chain=postrouting layer7-protocol=streaming new-packet-mark=spkt packet-mark=all-outpkt passthrough=no comment=""
add action=mark-packet chain=postrouting layer7-protocol=youtube_matcher new-packet-mark=spkt packet-mark=all-outpkt passthrough=no comment=""

 /ip firewall mangle
add action=mark-packet chain=postrouting connection-bytes=0-1000000 src-port=80,443 passthrough=no new-packet-mark=bpkt packet-mark=all-outpkt protocol=tcp comment="CLIENT BROWSING"

Choose the mangle rule from the above scripts as you like, but don’t use both methods together, understand ? next we will implemented the queue type of the pcq rules in order to manage the bandwidth equal for all clients without knowing the ip address clients that was given by dhcp server. Then adjust this rates depends on how much bandwidth do you have, right?

/queue type
add name=pcq_upsteam kind=pcq pcq-rate=512k pcq-classifier=src-address
add name=pcq_downsteam kind=pcq pcq-rate=512k pcq-classifier=dst-address
add name=pcq_browsing kind=pcq pcq-rate=512k pcq-classifier=dst-address
add name=pcq_download kind=pcq pcq-rate=512k pcq-classifier=dst-address
add name=pcq_video kind=pcq pcq-rate=512k pcq-classifier=dst-address

And this is going to be the most important and specific rules in queue tree in QoS Version 6, how you can capture the kind connection packets that you have marked along as mangle rules. We don’t need to give any marking for upload connection packets. So this will makes the mangle rules more short against in version 5. Look at the queue tree rules below!

/queue tree
add name=Upsteam parent=wan queue=pcq_upsteam packet-mark=all-outpkt priority=8 max-limit=1000k
add name=Downsteam parent=global queue=pcq_downsteam packet-mark=all-outpkt priority=8 max-limit=1000k
add name=1.Browsing parent=Downsteam queue=pcq_browsing packet-mark=bpkt priority=1 limit-at=256k max-limit=512k
add name=2.Download parent=Downsteam queue=pcq_download packet-mark=dpkt priority=2 limit-at=256k max-limit=512k
add name=3.Video parent=Downsteam queue=pcq_video packet-mark=spkt priority=3 limit-at=256k max-limit=512k

We use the same packet-mark for upload and download, which decisive is the parent that you have used in queue tree rules. In this case upload using parent=wan as the public interface of the router and Download using parent=global then you can continue for the kind of download packets else. So this is the different when we implement the QoS in Router OS Version 6. And finally can expand this rules as your requirements to manage your bandwidth system as you like, see you!

Comparing QoS V5 and QoS V6 Mikrotik Router OS

noreply@blogger.com (Agratitudesign) — Wed, 04 Mar 2015 12:11:00 +0000

I am writing this article to answer for many questions to this blog about the implementation Scripts QoS that so far I have made based on RouterOS with QoS Version 5. It is frequently asked from many agratitudesign visitors, that may also including you, It encourages me to find the answer into my experiment, so this is my noted here as the comparison of QoS V5 and QoS V6 on Mikrotik Router System.

I am going to explain, how the QoS is implemented to the RouterOS in Version 6. using in an experiment lab that contained the process upgrade and downgrade of the Mikrotik Router OS, so you can see as the comparison QoS from the previous version to the latest version in more details on this following lab video!

Mikrotik as the router that is very popular until this day and has been used extensively for many companies or individuals around the world. Mikrotik Router Operating System (ROS) is based on Linux System. The Latest version which has been in the release QoS ROS Version 6 today. Version 6 was made to enhance and improve the leakage system on QoS ROS Version 5, it is more powerful Router OS, effective and more easily to use.

The process to upgrade and downgrade Router System you can do it for your mikrotik router system byself. For example, if you now use QoS ROS V5 and want to upgrade into the QoS ROS V6 as the latest version system, you have to download RouterOS Version Package at first! select and download according to your mikrotik hardware series !

When you have finished to download the Version Package (routeros-mipsbe-6.27.npk), right click and copy that package file, open mikrotik winbox terminal and paste the package into the file list winbox as shown like the left picture below! After this we have already in updating the version package. Click System>Reboot, wait until the router was rebooted by itself after the upgrading process finished that may takes around 1 minute.

Now you can open your winbox again to look the changes on the router version system that now should be upgraded to QoS ROS V.6 that shown like the picture below! QoS Ros V6, there is the Quick Set feature that allow you to setup and configuring your system depending on your network more Easily and you can continue more with some adjustments as your network configuration.

For some other reason if you want to perform your network configuration using as the previous version system, and it has become your decision. Downgrade process you can do at any time you want in a way that is very easy as the upgrade process above.

For example I wan to go back to QoS Ros V5 after I have upgraded the routerOS in Version 6. To do that, download the downgrade Package as your router type as I mention above. You can move and drag the previous version package file into the File List window as the left picture below! Then you must go to the packages system winbox by Clicking System >Packages, look at the right picture below!

One step more to downgrade your RouterOS when you want to go back to QoS Ros V5, you just need to click downgrade. Your routerOS will back to the previous version after downgrade process have finished and the router will rebooted by itself after downgrade process. I think this is not a difficult task, after this you need to adjust on your queue rules especially for the parent that depending on QoS RouterOS Version System.

Basic Comparison on QoS ROS V5 and QoS ROS V6

QoS ROS V5

No specific queue for traffic to the router, global-in will process the traffic into the router and the traffic through the router
Two times queue processing (global-in and global out) for traffic through the router.
Queue tree – PCQ on parent interface – natted network, queue for uplink traffic does not work perfectly, because PCQ done after src-nat.
Src-address already changed to router ip address in src-nat. while pcq see only one src-address
Simple Queue – There are 2 type of target: target address and interface Desstination use only IP address (not interface), Same priority parameter for downlink and uplink

QoS ROS V6

No more global-in and global-out, replaced by "global" located after the "input" and at global-out position
Simple Queue – queue is a specific process, located after "global", Target address and interface combined to "target", dst-address changed to "dst", can take IP address and also interface. Completely new algorithm, build in kernel, faster.

The improvement of queue tree rules is required especially when we have change the router system from 5 to 6 version as the mikrotik routerOS, you can see the improvement completely on this video, so you can change your queue rules by yourself as the basic comparison QoS ROS Version. I suggest you to upgrade your router system in the latest version that available. Qos ROS V6 is the improvements version in mikrotik routerOS to build the network system that more stable and effective.

Remove the Url Link on Blog Comments

noreply@blogger.com (Agratitudesign) — Fri, 27 Feb 2015 07:36:00 +0000

Are you a blogger who is very much concerned about the one of blog component? When a blog or a website already has a lot of visitors, many people want to put the links to your blog or website. One which became users or spammers targets who want to take advantage of our blog / website is the comment component. When comments are not equipped with rel="nofollow" inside anchor link. This is a great opportunity for users and spammers who want to increase the page rank of their url in our page rank.

Blogger itself have prevent spammers has benefits who want to get credit to your blog. Which by default is already implementing rel="nofollow" inside the anchor tag comments, but this still allow the users to add links to their comments, but in this case the links will not get credit to increase of their url in our page rank. Make sure your blog have completed with rel="nofollow" attribute to the comment content. This following picture is how blogspot especially has been implemented rel = "nofollow" attribute from the anchor tag comments from the source code of the template blog.

However sometime the users or spammers will try to put many url links as they want inside the comments even the links doesn’t related with the content post. Ironically many users or spammers give any comments just want to put their links, If you don’t want the users or spammers put any links inside the blog comments, you can remove by disable the href link using javascript. Find the jquery.min.js link whatever the version that you have used on your blog template code and add the javascript below after jquery.min.js link!

<script type='text/javascript'>
 var a = $(this);
 var href = a.attr('href');
 $(document).ready(function() {

 $(".comment-content a[href^='http://']").each(function () {
 if(this.href.indexOf(location.hostname) == -1) {
 $(this).removeAttr("href");
 }
 }
 );
 $(".comment-content a[href^='https://']").each(function () {
 if(this.href.indexOf(location.hostname) == -1) {
 $(this).removeAttr("href");
 }
 }
 );
 });
</script>

The above picture is how we put the javascript code in order to disable the url links on blog comments inside the scripts of the blog template code. After we save it, this new javascript code will be parsed automatically. In this way the url links that inserted by the users will be changed into a plain text. This will reduce the users give the comments just want to put any links as their main purpose. Comments with many URL links can be disturbing the substantive comments itself. In large numbers the url links will lose the focus to the author and actual users in related with the main content itself.

This is the way if you want to adjust the url links of blog comments position that have disabled so as not cluttered. Add css rule as you like .comment-content a { } or if it is necessary add disabled class to adjust it more specific.

And as alternatively the following script works most effectively you can use it before the body tag end

<script type='text/javascript'>
$('.comment-content a[rel$=nofollow]').replaceWith(function(){return($(this).text());});
</script>

Installing Lusca Head for Proxy on Ubuntu Server

noreply@blogger.com (Agratitudesign) — Tue, 24 Feb 2015 16:12:00 +0000

This is the second part of the ubuntu server installation in order build a proxy server using squid Lusca Head. Lusca Head is one of squid development to build a proxy server that based on ubuntu server. lusca Head focus in optimizing the Squid by tweaking the caches of the squid proxy. I would suggest you to use ubuntu server to bulid the proxy server for more powerful and stable.

The process of the installation lusca head can be done from the server itself or from the client on your network. the accessing ubuntu server via remotely from the client that using windows using remote application, it allow you copy and paste some command lines easier. It is probably much those of you who do not like much typing with the command line of linux ubuntu. In this case I was using lusca head-r14809, the process lusca head installation on ubuntu server you can completely see in this following video.

Assuming that we have made ubuntu server with the kind partitions as our plan before, the caches is located into 5 partitions as the storage of the proxy caches. Hit and Miss of the proxy caches will work faster and stable. I have used putty as the application to remote server from the client as shown like the picture below!

You have to know the hostname or ip address of your ubuntu server, and we can access the server using ssh port 22 by default. Then click open, the security warning will be show up, click yes, now you have entered to your ubuntu server and installing lusca head ready to begin. You must enter the server as root, there are some ways as I have talked about!

type : sudo-i
your root password

now you have to be root, and ready to do installation and configuration on ubuntu server

type or paste : apt-get update && apt-get upgrade

this step will update and upgrade some packages for some ubuntu server application, this step need the internet connection to the server.

wget https://lusca-cache.googlecode.com/files/LUSCA_HEAD-r14809.tar.gz

this step will downloading LUSCA Head r14809 from the source-code, the internet connection is required again.

tar -zxvf LUSCA_HEAD-r14809.tar.gz

this step will extract LUSCA_HEAD-r14809.tar.gz in a new directory

cd LUSCA_HEAD-r14809/

Go to lusca head directory root where the extracted files have placed

./configure --prefix=/usr/local/squid --exec-prefix=/usr/local/squid --enable-delay-pools --enable-cache-digests --enable-poll --enable-linux-netfilter --enable-removal-policies --with-maxfd=8192 --enable-storeio=aufs --disable-wccp --enable-x-accelerator-vary --enable-kill-parent-hack --enable-async-io=30 --disable-ident-lookups

Compiling lusca head in some configurations

make all && make install

This step is installing lusca head that will be run as the compile configuration.

/usr/local/squid/sbin/squid -v

It will check squid version

cd /usr/local/squid/etc

Go to etc directory root

mv /usr/local/squid/etc/squid.conf /usr/local/squid/etc/squid.conf.original

Change squid.conf as squid.conf.original as the backup file that may sometime you need

rm -rf squid.conf && touch squid.conf && nano squid.conf

Remove squid.conf now, make a new blank file as squid.conf and open it into terminal editor so that you can fill a new squid.conf configuration.

touch storeurl.pl && nano storeurl.pl

making storeurl.pl file, open into terminal editor and you can fill by your storeurl.pl configuration

chown proxy:proxy squid.conf && chmod 777 squid.conf && chown proxy:proxy storeurl.pl && chmod a+x storeurl.pl

change the own permission of squid.conf and storeurl.pl so that we can change it from any client that connected

chown proxy:proxy /cache-{1,2,3,4,5} && chmod 777 /cache-{1,2,3,4,5}

Because I have created 5 cache partitions, it is also allow to be changed. If you don't create the caches partitions. You must create a new the directory, it is not recommended in order to get an optimal proxy server. but if you want to do so, this is will be the command line : mkdir /cache && chown proxy:proxy /cache && chmod 777 /cache

mkdir /var/log/squid && chown proxy:proxy /var/log/squid && chmod 777 /var/log/squid

Make directory squid and change the own permission 777, if you think it is not secure change to be 644 or anything you want, you must undertand the own permission files number.

cd /var/log/squid && touch access.log cache.log store.log && chmod 777 access.log cache.log store.log && chown proxy:proxy access.log cache.log store.log

Go to squid directory root and make access.log, cache.log, store.log to the current directory and make change the own permission to those files.

/usr/local/squid/sbin/squid -z

Creating swap from the caches

tail -f /var/log/squid/access.log | ccze

To see all the activity of the squid lusca head that shown in access.log

echo "/usr/local/squid/sbin/squid -NDd1 &" >> /etc/rc.local

Somebody said that this can run the squid automatically when you every time reboot, but it doesn't work for me.

This is the alternative steps that works for me in order to make squid lusca head run automatically everytime when ubuntu server first time to start or reboot, it can be squid lusca head run automatically.

cd /etc/init.d : go to init.d
touch runningsquid.sh && nano runningsquid.sh : make and open runningsquid.sh
/usr/local/squid/sbin/squid -NDd1 & : insert this code and save it in runningsquid.sh
chmod +x /etc/init.d/runningsquid.sh : change the own permission of runningsquid.sh
update-rc.d runningsquid.sh defaults : runningsquid.sh will update as default
touch cek && nano cek : still on init.d make open a new file "cek"
tail -f /var/log/squid/access.log | ccze : fill cek file with this command line
chmod +x cek : change the own permission cek
./cek : see the activity access.log in short command line ./cek

Fundamental Ubuntu Server Installation for The Proxy Server

noreply@blogger.com (Agratitudesign) — Tue, 24 Feb 2015 04:32:00 +0000

It is unquestionable that the Linux as the operating system of computer as the advantages in handling the network system. The stability of performance is what the strengths of the linux in building the network server. Here I have proved myself after building the proxy server using linux in ubuntu server version. Ideally the server should be built on the server-based as the operating system. Indeed, if we build any server using any desktop operating system will obviously have less stable performance because desktop operating system doesn't all support to the server.

On this occasion I would like to share again to the users of agratitudesign the knowledge and experiences of the problems that I've found in accordance with the conditions. After this agratitudesign will be widely supported by wiswaweb.com to continue in making the tutorials as the notes of knowledge exploration and as a reminder for us, that may be useful to solve and give an inspiration to your problem as well.

In order to build such a proxy server, in this case I will use ubuntu server as the operating system that may has already explained by another, here I will explain based on my experience and experiment. I was using ubuntu server with version 14:04 32 bit. Perhaps among of you, there is still doubt in installing ubuntu server as the operating system, I'll show it for you.

First you have to download the version of ubuntu server still as the open souce software from releases ubuntu, then you burn it into the cd as ubuntu server installer, just like the windows installer cd. In the process of installation, ubuntu will made the partitions on hard drive as the linux partitions. So don't you be surprised if you are trying to see the ubuntu partitions on Windows operating system can not be read at all, because it is different that the windows made partitions as FAT and NTFS system.

Ok let's start your computer and insert the cd of ubuntu server to your cdrom drive, make sure the first boot is from cdrom drive of your computer, if everything is alright and the process of installation ubuntu server is about to begin. The installation process for more complete and clear, you can on this video!

In the video, there are several points in the process of installing ubuntu server that I need to explain to you.

Use a static IP address of ubuntu server same as the client on your network

Before we make to be a real proxy server, there are some updates or upgrades that need the internet access from your gateway. It would be difficult for us to use direct access using a modem, the best choice for use the internet from lan. In order to make ubuntu server can be access from the client, it will be need openssh-sever and openssh-client to be installed through internet.

Suppose the installation process you are connected to the network 192.168.1.0/24, if you use any router with dhcp server on your network, during installation it will be given dynamic ip address automatically. But we need a static IP address to remote or access from other computers that are connected in the network. Therefore you must choose manual configuration network setup from the installation steps below.!

Username and Password configuration on Ubuntu server

It must be remember, because it will be used every time you run the Ubuntu server and for some security reasons the server itself. Especially if you use have private IP public from Internet Provider to your local network, it is not safe if you do not give your password on ubuntu server.

Partitions hard drive in Ubuntu server

The hard drive Partitions in Ubuntu server is using linux partitions system, it's different to the partition that you do like when you're installing windows which typically uses the FAT, FAT32 or NTFS system. Linux system partition can not be read on a Windows operating system. So in the process of installing Ubuntu server is done using one hard drive that will be divided into several kind partitions. So it is impossible to separate one partition for ubuntu and another partition for Windows in one hard drive, unless you are using a virtual mechine.

For the plan in building a proxy server using squid lusca head, we will divide the hard drive into some kind of partitions. This aims to get the proxy server to work optimally, the proxy caches is placed in some partitions so that we can get the proxy hit can impact significantly and more stable. This pictures will discribe you how to divide your hard drive into some partitions using partition method is done manually as shown below!

Distribution of the kind partitions on hard drive must be considering the total capacity of the hard drive and memory (RAM) of your computer. As another reference should see directly from ubuntuserverguide in distributing partition hard drive of the proxy server. In practice sometimes the swap partition can not be 2x RAM, so please you can try too, if there is a problem don't use swap partition exceed the capacity of the RAM. I guess it depends also on the ability of the processor and mainboard of your computer that you want to be a proxy server.

After the installation process is complete, the computer need to reboot and your Ubuntu server ready to use. In order to access ubuntu server from another clients on your network, ubuntu server and clients must be in the same network and need the application to open the ssh port of client-server so that you can be easily to remote ubuntu system configuration through windows operating system for you who are still unfamiliar with the command lines Ubuntu server that based on linux system.

At least you have to know the basics of linux ubuntu command lines. For the first time Ubuntu server is running, you must enter the username and password that you setup in the process installation. You will be usually find

yourname@ubuntu-proxy:~$ : it means you have entered as your username

root@ubuntu-proxy:~# : it means you have entered as root

some command lines in configuring the ubuntu server can not be done just using your username, in this case you need to log in as root, root = administrator in windows system. In order to enter as root there are some ways.

If you have entered to be your username (yourname@ubuntu-proxy:~$), setup the root password firstly

sudo su
type your password
passwd
type a new password that will be root password
password root confirmation
you have come to be root

to enter directly as the root, when the system firstly running or when you have log out

Type root
password root
you have come to be root

when you came as your username and want to be root

sudo -i
type your root password
you have come to be root

For example if you want to install openssh-server openssh-client, if you come as your username (yourname@ubuntu-proxy:~$) you must fill the following command line and it will need a password to be executed:

sudo apt-get install openssh-server openssh-client

Sudo is command on behalf as root, if you have entered to be root (root@ubuntu-proxy:~#) the command line will not require sudo and no need the password :

apt-get install openssh-server openssh-client

this command line will be install openssh-server and openssh-client application using internet connection, this application will be open the ssh port by default is 22 as the port communication.

If you want to cancel any command lines you can do by pressing Ctrl+C

And this for restart, shutdown and else to ubuntu server

shutdown -h now
shutdown -h 0
shutdown -h 18:45 "Server is going down for maintenance"
halt poweroff
reboot
shutdown -r 0

nano /etc/network/interfaces : opening terminal editor for network configurations

That will be the basic command lines that usually need, must be understand at least before you explore more command lines on linux ubuntu system.

For some reasons in configuration of the ubuntu server you to access by remotely through client that using windows operating system, you can using some remote application such as putty or winscp.

Agratitudesign Impression

Agratitudesign Art and Nature Photography and Graphic Design

Plant and Flower Photographs

Park and Outdoor Photographs

Nature and Landscape Photographs

Temple and Building Photographs

Model and Lifestyle Photographs

Interior and Exterior Photographs

Documentary and Editorial Photographs

People and Family Photographs

Animal And Wildlife Photographs

Food And Drink Photographs

Miscellaneous Photographs

Graphic Design and Illustrations

Drawing Designs

Agratitudesign Art and Nature Videography and Animation

Art Nature Music Videos

Original Video Footages

Documentary Videos

Motion Graphics Animations

Life Reflections Videos

Remote Access DVR CCTV Server on Mikrotik from Local Network and Mobile

1. Access DVR CCTV Server Displaying the Cameras View from Local Network

2. Access DVR CCTV Server Displaying the Cameras View from Internet

Smart and Powerful Way to Block Netcut Software on Mikrotik

Configuration Before Block Netcut is Implemented on Mikrotik

Configuration After Block Netcut is Implemented on Mikrotik

Build Web Hosting Server On Mikrotik Double Router Port Forwarding and Script Automatic Update Dynamic IP

1. The First Router Port Forwarding for TCP and UDP Protocol

2. The Second Router Port Forwarding for TCP and UDP Protocol

3. Adjustment Server Configuration on Local Network As Web Hosting Server

4. Script for Automatic Update Dynamic Public IP to No-IP Domain on Mikrotik.

Build Web Hosting Server by self Using Dynamic IP, Wamp Server with Router Port Forwarding

1. Get Free Sub Domain noip.com as the Domain Name your Public IP

2. Setup Router Port Forwarding Public IP to the Web Hosting Server

3. Installing Wamp Server According to Public IP and Port Forwarding

4. Adjust Wamp Server Configuration and Windows Firewall Rules

4. Adjust Wordpress Sites from Localhost to Live Web Hosting Server

Local Port Interfaces same Network different Subnets and Bridge Mikrotik

1. Setup identity, DNS server, and NTP client of the Mikrotik router

2. Setup Interface Port Names for all the Ports that will used

3. Setup Network IP address for the Interface Ports and the Route Gateway

4. Setup DHCP Server and IP Pools for Our Local Subnet Interfaces

5. Create Localnets Masquerade Nat rules on Firewall Nat

6. Setup Bridge for Local Network Port Subnet Interfaces

Setup PPPoE Connection to Mikrotik using Biznet ISP

1. Set the name for the interface Ethernet

2. Setup ip address just for local networks

3. Setup PPPoE client for the ISP Connection on the Router

4. Dns server on the routerOS for PPPoE Connection

5. Masquerade Public Traffic for Lan and Setup DHCP server

Related to this Topic

Effective Way Bandwidth Management with Fasttrack Firewall Filter

1. Upgrade Mikrotik Router OS to the Latest Version

2. Basic Configuration Of Mikrotik Router

3. Fasttrack Firewall Filter Rules for Prioritizing Typical Connection Packets

4. Mark Connection Packets Upload and Download based on Bytes Connection

5. Queue tree with PCQ to manage the priority and speed limitation

Building Squid 3.5.4 Transparent Proxy on Ubuntu Server VMware

A. Installing Squid 3.5.4 on Ubuntu Server

B. Configuration of the Ubuntu Server Virtual Network System

Beginning to install Squid 3.5.4 Ubuntu Proxy Server in Windows using VMware

1. Install Ubuntu Server 14.04 on VMware

2. Adjustment Ubuntu Server VMware on Windows operating system

Building Local Dns Server Using BIND for Windows on the Network

1. Download and Install Bind on windows for Local Dns Server

2. Configuration of the Variables Path to the Bind Installation Root

3. Bind Installation files and Adding a New Folders

4. Create the configuration files in Bind Files and Drivers\etc

Create named.conf in System32\dns\ etc

Create localhost.zone and localhost.rev in System32\dns\etc

Create queries.log in System32\dns\log

Create rndc.key in System32\dns\etc

Create resolve.conf in System32\drivers\etc

5. Run Local Bind Dns Server on Windows Services

6. Setup Network Configuration to Use Bind Dns Server

7. Testing and Resetting Local Bind Dns Server

Quota Bandwidth User Manager Hotspot Mikrotik & Voucher Design

1. Install NTP &User Manager Packages of the All Packages Router

2. Setup Parent Time Zone and Radius Hotspot Mikrotik Router