All About Computer: Februari 2011

Jumat, 18 Februari 2011

Instalasi HTB Bandwidth Management pada Opensuse 11.3

download file tarbal HTB pada link dibawah ini:

http://htb-tools.skydevel.ro/

setelah file selesai di download, ekstrak file tersebut,dengan cara:

# tar -zxvf HTB-tools-0.3.0a-i486-1.tgz

akan muncul folder etc, install, usr, sbin.

pindahkan isi semua folder sbin nya htb tools di /sbin server

#cd /home/malayin/Downloads/sbin
#mv htb /sbin
#mv htbgen /sbin
#mv q_checkcfg /sbin
#mv q_parser /sbin
#mv q_show /sbin

Masuk ke folder etc htb tools pindahkan folder htb ke /etc di server

#cd /home/malayin/Downloads/etc #mv htb /etc

hilangkan tulisan new yang ada di folder htb yang udah kita pindahin tadi

#mv /etc/htb/eth0-qos.cfg.new /etc/htb/eth0-qos.cfg #mv /etc/htb/eth1-qos.cfg.new /etc/htb/eth1-qos.cfg

masuk ke folder rc.d nya di etc htb tools

#cd /home/malayin/Downloads/etc/rc.d

masukkan file rc.htb new ke folder init.d nya server kita dan ganti jadi rc.htb

#mv rc.htb.new /etc/init.d/rc.htb

beri hak akses filetersebut, dengan cara sebagai berikut :

#chmod 755 /etc/init.d/rc.htb

konfigurasi eth0-qos cfg dan eth1-qos cfg sesuai kebutuhan, pada kali ini penulis akan menjelaskan mengenai eth0.

# vi /etc/htb/eth0-qos.cfg

################

# eth0-qos.cfg #

################

# for how to configure and use see docs/HowTo/

class malayin {

bandwidth 1024;

limit 2048;

burst 2;

priority 1;

client bos {

bandwidth 256;

limit 512;

burst 2;

priority 1;

src {

192.168.1.0/24;

};

client admin {

bandwidth 128;

limit 256;

burst 2;

priority 1;

src {

192.168.2.0/24;

};

client hotspot {

bandwidth 128;

limit 64;

burst 2;

priority 1;

src {

192.168.3.0/24;

};

};
class default { bandwidth 8; };

setelah selesai di edit, jalankan daemon dari HTB tool.

#/etc/init.d/rc.htb start_eth1

untuk melihat hasilnya, bisa dilihat dengan perintah
#/etc/init.d/rc.htb show_eth1

Load Balancing yang bersahabat dengan NAT

Sebuah organisasi berlangganan koneksi INTERNET ke lebih dari satu ISP (Internet Service Provider). Salah satu metoda untuk mengoptimalisasikan penggunaan bandwidth adalah menggabungkan koneksi-koneksi tersebut sehingga trafik dari jaringan lokal organisasi tersebut ke INTERNET secara otomatis tersebar melalui beberapa ISP. Konsep ini dinamakan Load Balancing.

Sebuah jaringan lokal yang beranggotakan PC1 (192.168.0.1) dan PC2 (192.168.0.2). PC1 dan PC2 memiliki default gateway yang menunjuk ke 192.168.0.254 yang merupakan alamat IP dari interface eth0 milik ROUTER1. ROUTER1 sebagai gateway dari network 192.168.0.0/24 memiliki dua buah gateway ke INTERNET, yang pertama melalui interface eth1 (10.0.0.1) ke GW1 (10.0.0.2), dan yang kedua melalui interface eth2 (10.0.1.1) ke GW2 (10.0.1.2).
GW1 dan GW2 adalah milik dua buah ISP yang berbeda. Karena bukan milik sendiri, GW1 maupun GW2 tidak mengenal routing ke jaringan 192.168.0.0/24. Oleh karena itu, ROUTER1 melakukan NAT sehingga trafik dari PC1 dan PC2 terbungkus oleh IP yang dikenal oleh GW1 dan GW2.
Penjelasan pada artikel Routing for multiple uplinks/providers sudah dapat menerangkan konsep load balancing sederhana. Akan tetapi metoda pada artikel tersebut tidak mendukung penggunaan NAT. Artikel tersebut hanya dapat diterapkan jika PC1 dan PC2 menggunakan alamat IP publik, yang dikenal oleh server-server di INTERNET dan juga router-router antara (dalam hal ini GW1 dan GW2).
Tanpa penanganan khusus, pemakaian NAT pada load balancing akan menimbulkan kekacauan. Misal, paket pertama sebuah trafik dari PC1 dialirkan melalui GW1, dalam hal ini paket tersebut akan dibungkus proses NAT oleh ROUTER1 sehingga memiliki IP 10.0.0.1 sebelum diteruskan ke GW1. Tanpa penanganan khusus, tidak ada jaminan paket berikutnya tetap melalui GW1. Misalkan paket ketiga dialirkan melalui GW2, yang sebelumnya akan dibungkus oleh ROUTER1 sehingga memiliki IP 10.0.1.1. Server tujuan akan menolak paket tersebut karena IP asal tidak sesuai dengan IP asal paket-paket sebelumnya.
CONNMARK adalah modul pada iptables dan netfilter yang dapat digunakan untuk mengatasi permasalahan konsistensi routing pada load balancing yang menggunakan NAT. Sebuah trafik ditandai (diberi MARK) yang konsisten. Jika paket pertama diberi tanda 1, maka paket-paket berikutnya dari trafik tersebut diberi tanda 1 pula. Jika paket pertama diberi tanda 2, maka paket-paket berikutnya dari trafik tersebut akan diberi tanda 2 pula.
Berikut adalah contoh script yang dapat digunakan. Ini hanyalah merupakan sebuah contoh yang dibuat sesederhana mungkin untuk memudahkan pemahaman. Harap sesuaikan dengan kebutuhan.

#!/bin/bash
# Inisialisasi awal iptables
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Inisialisasi target-target CONNMARK
# Pada contoh ini, dibuat 2 buah target (2 ISP), sesuaikan dengan kebutuhan
iptables -t mangle -N CONNMARK1
iptables -t mangle -N CONNMARK2
iptables -t mangle -A CONNMARK1 -j MARK –set-mark 1
iptables -t mangle -A CONNMARK1 -j CONNMARK –save-mark
iptables -t mangle -A CONNMARK2 -j MARK –set-mark 2
iptables -t mangle -A CONNMARK2 -j CONNMARK –save-mark
# tandai ulang dengan tanda sebelumnya jika paket merupakan
# kelanjutan dari koneksi yang sudah ada
iptables -t mangle -A PREROUTING -p tcp -m state –state ESTABLISHED,RELATED \
-j CONNMARK –restore-mark
# tandai paket-paket pertama pada awal koneksi
iptables -t mangle -A PREROUTING -p tcp -m state –state NEW \
-m statistic –mode nth –every 2 –packet 0 -j CONNMARK1
iptables -t mangle -A PREROUTING -p tcp -m state –state NEW \
-m statistic –mode nth –every 2 –packet 1 -j CONNMARK2
# NAT koneksi keluar
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
# buat tabel routing baru
if ! cat /etc/iproute2/rt_tables | grep -q ‘^251′
then
echo ‘251 koneksi1′ >> /etc/iproute2/rt_tables
fi
if ! cat /etc/iproute2/rt_tables | grep -q ‘^252′
then
echo ‘252 koneksi2′ >> /etc/iproute2/rt_tables
fi
# kosongkan tabel routing khusus
ip route flush table koneksi1 2>/dev/null
ip route add table koneksi1 default dev eth1
ip route flush table koneksi2 2>/dev/null
ip route add table koneksi2 default dev eth2
# bikin aturan routing sehingga paket di-routing ke tabel routing
# sesuai dengan tanda yang dimiliki
ip rule del from all fwmark 0×1 lookup koneksi1 2>/dev/null
ip rule del from all fwmark 0×2 lookup koneksi2 2>/dev/null
ip rule del from all fwmark 0×2 2>/dev/null
ip rule del from all fwmark 0×1 2>/dev/null
ip rule add fwmark 1 table koneksi1
ip rule add fwmark 2 table koneksi2
# flush cache tabel routing
ip route flush cache

Menggabungkan 2 koneksi ISP ( Load Balancing ) Menggunakan Linux Ubuntu

Satu Router Untuk 2 Koneksi ISP

Ilustrasi IP sebagai berikut
Speedy 1 (ADSL)
ip address
192.168.0.1
ISP Lain(Wireless)
ip address
192.168.2.1

Konfigurasi :

Sambungan Speedy melalui eth2 IP address 192.168.1.222
dengan gateway IP 192.168.1.1.

Sambungan Wireless melalui eth0 IP address 203.134.148.2 dengan gateway 203.134.148.1

Sambungan LAN melalui eth1 IP address 192.168.0.222.

Langkah konfigurasi pc-router menggunakan linux ubuntu adalah sebagai berikut :

Code:

$ sudo bash

tekan [enter] hingga muncul tanda string ( # )
Edit informasi interface pada file /etc/network/interfaces, dapat dilakukan menggunakan vi

Code:

# vi /etc/network/interfaces

Code:

auto eth0

iface eth0 inet static

address 203.134.148.2

netmask 255.255.255.240

auto eth1

iface eth1 inet static

address 192.168.0.222

netmask 255.255.255.0

auto eth2

iface eth2 inet static

address 192.168.1.222

netmask 255.255.255.0

Install aplikasi layanan ssh agar bisa remote dari komputer klien

Code:

# apt-get install openssh-server

# /etc/init.d/ssh restart

Selanjutnya kita perlu menset routing dan load balancing yang secara sederhana adalah sebagai berikut

Code:

# /sbin/ip link set lo up

# /sbin/ip link set eth0 up

# /sbin/ip link set eth1 up

# /sbin/ip link set eth2 up

# /sbin/ip route flush table speedy

# /sbin/ip route flush table wireless

# /sbin/ip route flush table internet

# /sbin/ip addr add 127.0.0.1/8 brd 127.0.0.255 dev lo

# /sbin/ip addr add 192.168.1.222/24 brd 192.168.1.255 dev eth2

# /sbin/ip addr add 203.134.148.2/28 brd 203.134.148.15 dev eth0

# /sbin/ip addr add 192.168.0.222/24 brd 192.168.0.255 dev eth1

# /sbin/ip rule add prio 10 table main

# /sbin/ip rule add prio 20 table speedy

# /sbin/ip rule add prio 30 table wireless

# /sbin/ip rule add prio 40 table internet

# /sbin/ip route del default table main

# /sbin/ip route del default table speedy

# /sbin/ip route del default table wireless

# /sbin/ip route del default table internet

# /sbin/ip rule add prio 20 from 192.168.1.0/24 table speedy

# /sbin/ip route add default via 192.168.1.1 dev eth2 src 192.168.1.222 proto static table speedy

# /sbin/ip route append prohibit default table speedyl metric 1 proto static

# /sbin/ip rule add prio 30 from 203.134.148.0/28 table wireless

# /sbin/ip route add default via 203.134.148.1 dev eth0 src 203.134.148.2 proto static table wireless

# /sbin/ip route append prohibit default table wireless metric 5 proto static# Set up load balancing gateways

# /sbin/ip rule add prio 40 table internet

# /sbin/ip route add default proto static table internet

# nexthop via 192.168.1.1 dev eth2 weight 1

# nexthop via 203.134.148.1 dev eth0 weight 1

Konfigurasi di atas membutuhkan tiga (3) tabel routing tambahan, yaitu, Speedy, wireless dan internet yang kita masukan dalam file /etc/iproute2/rt_tables, isinya kira-kira sbb,

Code:

Speedy

wireless

internet

Selanjutnya kita perlu menset NAT / proxy agar dapat sekaligus melakukan NAT ke dua (2) interface yang berbeda, yaitu, 192.168.1.222 dan 203.134.148.2. Adapun perintahnya adalah sebagai berikut,

Code:

# /bin/echo 1 > /proc/sys/net/ipv4/ip_forward

# /sbin/iptables -F

# /sbin/iptables -P INPUT DROP

# /

# /sbin/iptables -A INPUT -i eth1 -j ACCEPT

# /sbin/iptables -A INPUT -i eth0 -p tcp -s 0/0 –dport 25 -j ACCEPT

# /sbin/iptables -A INPUT -i eth2 -p tcp -s 0/0 –dport 25 -j ACCEPT

# /sbin/iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

# /sbin/iptables -A INPUT -p tcp -i eth0 -j REJECT –reject-with tcp-reset

# /sbin/iptables -A INPUT -p tcp -i eth2 -j REJECT –reject-with tcp-reset

# /sbin/iptables -A INPUT -p udp -i eth0 -j REJECT –reject-with icmp-port-unreachable

# /sbin/iptables -A INPUT -p udp -i eth2 -j REJECT –reject-with icmp-port-unreachable

# /sbin/iptables -t nat -A POSTROUTING -o eth2 -j SNAT –to 192.168.1.222

# /sbin/iptables -t nat -A POSTROUTING -o eth0 -j SNAT –to 203.134.148.2

booting ulang atau restart komputer

Code:

# reboot

Selamat mencoba, dan mudah2an berhasil..

Install Bandwidth management di OpenSuse menggunakan HTB Bandwidth Management

Kebetulan lagi ngisi kekosongan waktu, kali ini saya mau menjelaskan gimana caranya management bandwidth di server make htb tools. kegunaan management bandwidth ini sangat penting bagi kalangan perkantoran, perguruan tinggi, isp, atau lembaga - lembaga sosial. Langsung aja yah..

1. masuk dulu di folder /usr/local/src
#cd /usr/local/src

2. download paket htb tools
#wget http://www.geocities.com/safinatuddin/HTB-tools-0.3.0a-i486-1.tgz

3. ekstrak file nya
#tar -zxvf HTB-tools-0.3.0a-i486-1.tgz

akan muncul folder etc, install, folder, sbin

4. pindahkan isi semua folder sbin nya htb tools di /sbin server

#cd /usr/local/src/sbin
#mv htb /sbin
#mv htbgen /sbin
#mv q_checkcfg /sbin
#mv q_parser /sbin
#mv q_show /sbin

5. Masuk ke folder etc nya htb tools pindahin folder htb ke /etc nya server
#cd /usr/local/src/etc
#mv htb /etc

6 hilangkan tulisan new yang ada di folder htb yang udah kita pindahin tadi
#mv /etc/htb/eth0-qos.cfg.new /etc/htb/eth0-qos.cfg
#mv /etc/htb/eth1-qos.cfg.new /etc/htb/eth1-qos.cfg

7. masuk ke folder rc.d nya di etc htb tools
#cd /usr/local/src/etc/rc.d

8. masukkan file rc.htb new ke folder init.d nya server kita dan ganti jadi rc.htb
#mv rc.htb.new /etc/init.d/rc.htb

9. chmod file rc.htb nya
#chmod 755 /etc/init.d/rc.htb

10. konfigurasi eth0-qos cfg dan eth1-qos cfg sesuai kebutuhan, kali ini gue mau jelasin untuk eth1, yaitu ip lokal kita. (contoh doang lho)
#nano /etc/htb/eth1-qos.cfg

-- contoh konfigurasi --
# Pengaturan bandwidth kantorptblablabla

class kantorptblablabla {
bandwidth 1024;
limit 2048;
burst 2;
priority 1;

client bos {
bandwidth 256;
limit 512;
burst 2;
priority 1;
dst {
192.168.168.5/32;
};
};

client hotspot {
bandwidth 32;
limit 256;
burst 2;
priority 1;
dst {
192.168.168.6/32;
};
};

client sekretaris {
bandwidth 64;
limit 256;
burst 2;
priority 1;
dst {
192.168.168.7/32;
};
};

client karyawan_utama {
bandwidth 256;
limit 512;
burst 2;
priority 1;
dst {
192.168.168.11/32;
192.168.168.12/32;
192.168.168.13/32;
192.168.168.14/32;
192.168.168.15/32;
192.168.168.16/32;
192.168.168.17/32;
192.168.168.18/32;
192.168.168.19/32;
192.168.168.20/32;
192.168.168.21/32;
192.168.168.22/32;
192.168.168.23/32;
192.168.168.24/32;
192.168.168.25/32;
};
};

client karyawan_sisa {
bandwidth 256;
limit 512;
burst 2;
priority 1;
dst {
192.168.100.0/24;
};
};
};

class default { bandwidth 8; };

-- berakhir diatas tulisan ini --
simpen make ctrl+x tekan y kemudian enter

ket:
- untuk boss dapet bandwidth dengan ip sendiri maksimal 512 (1:2 baca satu banding dua) artinya kalo trafic bagus dia dapat 512, tapi kalo trafic terlalu full dia dapat 256, tapi disini si boss bakalan dapet 512, soalnya limit maksimal bandwidth juga pass di setting/menej 2 mega sich.

- untuk server hotspot (misalnya kalo make hotspot) dapet bandwidth 512 (1:8).
- untuk sekretaris dapet bandwidth 256 (1:4)
- untuk karyawan utama dengan ip yang ditulis diatas dapet bandwidth 512 (1:2) disini pada karyawan utama bandwidthnya kita gunain sistem sharing..
- untuk karyawan sisa dengan ip mulai dari 192.168.100.0 - 192.168.100.255 akan dapet bandwidth 512 (1:2)

(itu management bandwidth asal aja lho, pandai-pandai kalian management lah, intinya kudu ngerti konsep ip address sama bandwidth management he, he, he..)

11. kalo udah di edit, jalankan htb tools nya
#/etc/init.d/rc.htb start_eth1

12. kalo mau lihat hasilnya jalan trafic nya bisa dilihat dengan perintah
#/etc/init.d/rc.htb show_eth1

udah ah capek, kalo ada yang kurang jelas tanya yach.... eh sedikit lagi, untuk setiap pengeditan di eth1-qos.cfg sebaiknya htb tools dimatiin dulu caranya "/etc/init.d/rc.htb stop_eth1" (tanpa tanda kutip), kalo udah di edit baru di jalankan lagi, ok.....

salam

Load Balancing 2 Koneksi Speedy pada OpenSUSE

Catatan : Tutorial ini menggunakan openSUSE 10.3 sebagai sistem untuk testing.
[ Speedy #1 ]
192.168.1.1
?
?
?
?
eth0: 192.168.1.2
?
[ Proxy Server ] eth2: 192.168.0.1 ??? [ LAN - 192.168.00/24 ]
?
eth1: 192.168.2.2
?
?
?
?
192.168.2.1
[ Speedy #2 ]

Asumsi:

Tersedia 2 Koneksi Speedy:
IP Address pada Modem Speedy #1: 192.168.1.1
IP Address pada Modem Speedy #2: 192.168.2.1
Tersedia 3 Ethernet Card, masing-masing adalah eth0, eth1, dan eth2.
System telah berfungsi sebagai router dan mendukung IPv4 Forwarding.
Dalam mengikuti artikel ini, pastikan Anda login sebagai root.

Konfigurasi:

3 Ethernet pada Server:
- eth0 —> Speedy #1 (IP Address: 192.168.1.2)
- eth1 —> Speedy #2 (IP Address: 192.168.2.2)
- eth2 —> LAN Warnet (IP Address: 192.168.0.1)

Implementasi:

1. Edit file /etc/iproute2/rt_tables sehingga menjadi seperti berikut:

#
# reserved values
#
255 local
254 main
253 default
0 unspec
120 warnet
125 office
130 internet
#
# local
#
#1 inr.ruhep

2. Buatlah file yang berisi script sebagai berikut:

#!/bin/sh
/sbin/ip link set lo up
/sbin/ip link set eth0 up
/sbin/ip link set eth1 up
/sbin/ip link set eth2 up
/sbin/ip route flush table warnet
/sbin/ip route flush table office
/sbin/ip route flush table internet
/sbin/ip rule add prio 10 table main
/sbin/ip rule add prio 20 table warnet
/sbin/ip rule add prio 25 table office
/sbin/ip rule add prio 30 table internet
/sbin/ip route del default table main
/sbin/ip route del default table warnet
/sbin/ip route del default table office
/sbin/ip route del default table internet
/sbin/ip rule add prio 20 from 192.168.1.0/24 table warnet
/sbin/ip route add default via 192.168.1.1 dev eth0 src 192.168.1.2 proto static table warnet
/sbin/ip route append prohibit default table warnet metric 1 proto static
/sbin/ip rule add prio 25 from 192.168.2.0/24 table office
/sbin/ip route add default via 192.168.2.1 dev eth1 src 192.168.2.2 proto static table office
/sbin/ip route append prohibit default table office metric 1 proto static
/sbin/ip rule add prio 30 table internet
/sbin/ip route add default scope global nexthop via 192.168.1.1 dev eth0 weight 1 nexthop via 192.168.2.1 dev eth1 weight 1

Dan pastikan script tersebut selalu diLoad secara otomatis pada saat Booting.
3. Set opsi Routing sehingga sekaligus dapat malakukan NAT pada 2 interface yang berbeda, yaitu eth0 (192.168.1.2) dan eth1 (192.168.2.2).

iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.0.0/24 –dport 80 -j DNAT –to-destination 192.168.0.1:3128
iptables -t nat -A POSTROUTING -o eth0 -j SNAT –to 192.168.1.2
iptables -t nat -A POSTROUTING -o eth1 -j SNAT –to 192.168.2.2
iptables -t nat -A POSTROUTING -j MASQUERADE

Pastikan kedua konfigurasi tersebut, baik settingan IPRoute-nya maupun IPTables-nya dapat diLoad otomatis setiap pada saat booting, agar konfigurasi tidak hilang pada saat system reboot.
Selamat Mencoba

LOAD BALANCING + PROXY UBUNTU "Poker & Poinblank No Ip Ilegal Lagi

Tutorial ini saya buat untuk menjawab byk pertanyaan tentang cara menggabungkan 2 line Speedy dgn Proxy Ekternal sekaligus solusi agar game online terutama Poker dan Poinblank tidak di deteksi sebagai ip ilegal lagi.

BAHAN-BAHAN :
- RB750 VER 4.9
- 2 Line Speedy Paket Office
- Ubuntu Versi 10.10

SISI MIKROTIK :

/ip adrress

- 192.168.1.1/24 interface modem-1
- 192.168.2.1/24 interface modem-2
- 192.168.3.1/24 interface proxy
- 192.168.4.1/24 interface lan

catatan : - Dial lewat mikrotik dgn modem sbg brigde
- IP Mesin Ubuntu 192.168.3.1

URUTAN SETTINGAN DI MIKROTIK :

1. Address List

/ip firewall address-list
add address=192.168.4.0/24 comment="" disabled=no list=lanNET
add address=192.168.3.0/24 comment="" disabled=no list=proxyNET

2. Membuat Proxy Hit

/ip firewall mangle
add action=mark-packet chain=forward comment=proxy-hit disabled=no dscp=12 \
new-packet-mark=Hit passthrough=no
add action=mark-connection chain=forward comment="" disabled=no \
dst-address-list=lanNET new-connection-mark=Hit passthrough=yes protocol=\
tcp src-address-list=proxyNET
add action=mark-packet chain=forward comment="" connection-mark=Hit disabled=\
no new-packet-mark=Hit passthrough=no

/queue tree
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=HIT packet-mark=Hit parent=global-out priority=1 \
queue=default

3. Scaner IP PB & FB

/ip firewall mangle
add action=mark-connection chain=prerouting comment="POKER + POINT BLANK" \
disabled=no dst-address-list="Poker + PB" dst-port=49100 \
new-connection-mark="Trafik PB + POKER" passthrough=yes protocol=tcp
add action=mark-connection chain=prerouting comment="" disabled=no \
dst-address-list="Poker + PB" dst-port=40000-40010 new-connection-mark=\
"Trafik PB + POKER" passthrough=yes protocol=udp
add action=mark-connection chain=prerouting comment="" disabled=no \
dst-address-list="Poker + PB" dst-port=39190 new-connection-mark=\
"Trafik PB + POKER" passthrough=yes protocol=tcp
add action=mark-connection chain=prerouting comment="" disabled=no \
dst-address-list="Poker + PB" dst-port=9339 new-connection-mark=\
"Trafik PB + POKER" passthrough=yes protocol=tcp
add action=mark-connection chain=prerouting comment="" disabled=no \
dst-address-list="Poker + PB" dst-port=843 new-connection-mark=\
"Trafik PB + POKER" passthrough=yes protocol=tcp
add action=mark-packet chain=prerouting comment="" connection-mark=\
"Trafik PB + POKER" disabled=no new-packet-mark="PB + Poker" passthrough=\
yes
add action=mark-routing chain=prerouting comment=\
"ROUTING POKER + POINT BLANK" connection-mark="Trafik PB + POKER" \
disabled=no dst-address-list="Poker + PB" in-interface=lan \
new-routing-mark="Poker + PB" passthrough=no src-address=192.168.4.0/24
add action=add-dst-to-address-list address-list="Poker + PB" \
address-list-timeout=0s chain=forward comment=\
"SCANNER POKER + POINT BLANK" disabled=no dst-port=40000-40010 protocol=\
udp
add action=add-dst-to-address-list address-list="Poker + PB" \
address-list-timeout=0s chain=forward comment="" disabled=no dst-port=\
39100 protocol=tcp
add action=add-dst-to-address-list address-list="Poker + PB" \
address-list-timeout=0s chain=forward comment="" disabled=no dst-port=\
39110 protocol=tcp
add action=add-dst-to-address-list address-list="Poker + PB" \
address-list-timeout=0s chain=forward comment="" disabled=no dst-port=\
39220 protocol=tcp
add action=add-dst-to-address-list address-list="Poker + PB" \
address-list-timeout=0s chain=forward comment="" disabled=no dst-port=\
39190 protocol=tcp
add action=add-dst-to-address-list address-list="Poker + PB" \
address-list-timeout=0s chain=forward comment="" disabled=no dst-port=\
49100 protocol=tcp
add action=add-dst-to-address-list address-list="Poker + PB" \
address-list-timeout=0s chain=forward comment="" disabled=no dst-port=843 \
protocol=tcp
add action=add-dst-to-address-list address-list="Poker + PB" \
address-list-timeout=0s chain=forward comment="" disabled=no dst-port=\
9339 protocol=tcp

4. Mangle ( Untuk PB & FB tdk di loadbalancing)

/ip firewall mangle
add action=mark-connection chain=input comment=mark_all_ppoe_conn \
connection-state=new disabled=no in-interface=pppoe_1 \
new-connection-mark=pppoe1_conn passthrough=yes
add action=mark-connection chain=input comment="" connection-state=new \
disabled=no in-interface=pppoe_2 new-connection-mark=pppoe2_conn \
passthrough=yes
add action=mark-connection chain=prerouting comment="" connection-state=\
established disabled=no in-interface=pppoe_1 new-connection-mark=\
pppoe1_conn passthrough=yes
add action=mark-connection chain=prerouting comment="" connection-state=\
established disabled=no in-interface=pppoe_2 new-connection-mark=\
pppoe2_conn passthrough=yes
add action=mark-connection chain=prerouting comment="" connection-state=\
related disabled=no in-interface=pppoe_1 new-connection-mark=pppoe1_conn \
passthrough=yes
add action=mark-connection chain=prerouting comment="" connection-state=\
related disabled=no in-interface=pppoe_2 new-connection-mark=pppoe2_conn \
passthrough=yes
add action=mark-routing chain=output comment="" connection-mark=pppoe1_conn \
disabled=no new-routing-mark=pppoe_1 passthrough=no
add action=mark-routing chain=output comment="" connection-mark=pppoe2_conn \
disabled=no new-routing-mark=pppoe_2 passthrough=no
add action=mark-connection chain=prerouting comment=mark_http_conn \
connection-state=new disabled=no dst-address-list="!Poker + PB" \
dst-address-type=!local dst-port=80 in-interface=proxy \
new-connection-mark=http_pppoe_1 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/0 protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=new \
disabled=no dst-address-list="!Poker + PB" dst-address-type=!local \
dst-port=80 in-interface=proxy new-connection-mark=http_pppoe_2 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=\
established disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local dst-port=80 in-interface=proxy new-connection-mark=http_pppoe_1 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=\
established disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local dst-port=80 in-interface=proxy new-connection-mark=http_pppoe_2 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=\
related disabled=no dst-address-list="Poker + PB" dst-address-type=!local \
dst-port=80 in-interface=proxy new-connection-mark=http_pppoe_1 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=\
related disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local dst-port=80 in-interface=proxy new-connection-mark=http_pppoe_2 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 \
protocol=tcp
add action=mark-connection chain=prerouting comment=mark_non_http_conn \
connection-state=new disabled=no dst-address-list="!Poker + PB" \
dst-address-type=!local dst-port=!80 in-interface=lan \
new-connection-mark=non.http_pppoe_1 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/0 protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=new \
disabled=no dst-address-list="!Poker + PB" dst-address-type=!local \
dst-port=!80 in-interface=lan new-connection-mark=non.http_pppoe_2 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=\
established disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local dst-port=!80 in-interface=lan new-connection-mark=non.http_pppoe_1 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=\
established disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local dst-port=!80 in-interface=lan new-connection-mark=non.http_pppoe_2 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=\
related disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local dst-port=!80 in-interface=lan new-connection-mark=non.http_pppoe_1 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=\
related disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local dst-port=!80 in-interface=lan new-connection-mark=non.http_pppoe_2 \
passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1 \
protocol=tcp
add action=mark-connection chain=prerouting comment="" connection-state=new \
disabled=no dst-address-list="!Poker + PB" dst-address-type=!local \
in-interface=lan new-connection-mark=non.http_pppoe_1 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/0 protocol=udp
add action=mark-connection chain=prerouting comment="" connection-state=new \
disabled=no dst-address-list="!Poker + PB" dst-address-type=!local \
in-interface=lan new-connection-mark=non.http_pppoe_2 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/1 protocol=udp
add action=mark-connection chain=prerouting comment="" connection-state=\
established disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local in-interface=lan new-connection-mark=non.http_pppoe_1 passthrough=\
yes per-connection-classifier=both-addresses-and-ports:2/0 protocol=udp
add action=mark-connection chain=prerouting comment="" connection-state=\
established disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local in-interface=lan new-connection-mark=non.http_pppoe_2 passthrough=\
yes per-connection-classifier=both-addresses-and-ports:2/1 protocol=udp
add action=mark-connection chain=prerouting comment="" connection-state=\
related disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local in-interface=lan new-connection-mark=non.http_pppoe_1 passthrough=\
yes per-connection-classifier=both-addresses-and-ports:2/0 protocol=udp
add action=mark-connection chain=prerouting comment="" connection-state=\
related disabled=no dst-address-list="!Poker + PB" dst-address-type=\
!local in-interface=lan new-connection-mark=non.http_pppoe_2 passthrough=\
yes per-connection-classifier=both-addresses-and-ports:2/1 protocol=udp
add action=mark-routing chain=prerouting comment=mark_http_route \
connection-mark=http_pppoe_1 disabled=no new-routing-mark=pppoe_1 \
passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=\
http_pppoe_2 disabled=no new-routing-mark=pppoe_2 passthrough=yes
add action=mark-routing chain=prerouting comment=mark_non_http_route \
connection-mark=non.http_pppoe_1 disabled=no new-routing-mark=pppoe_1 \
passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=\
non.http_pppoe_2 disabled=no new-routing-mark=pppoe_2 passthrough=yes

5. NAT

/ip firewall nat
add action=masquerade chain=srcnat comment=MASQUERADE1 disabled=no \
out-interface=pppoe_1
add action=masquerade chain=srcnat comment=MASQUERADE2 disabled=no \
out-interface=pppoe_2
add action=masquerade chain=srcnat comment=MASQUERADE3 disabled=no \
out-interface=proxy
add action=dst-nat chain=dstnat comment=TRANSPARENT-DNS disabled=no dst-port=\
53 in-interface=lan protocol=udp to-ports=53
add action=dst-nat chain=dstnat comment="" disabled=no dst-port=53 \
in-interface=lan protocol=tcp to-ports=53
add action=dst-nat chain=dstnat comment="" disabled=no dst-port=53 \
in-interface=proxy protocol=udp to-ports=53
add action=dst-nat chain=dstnat comment="" disabled=no dst-port=53 \
in-interface=proxy protocol=tcp to-ports=53
add action=dst-nat chain=dstnat comment=TRANSPARENT-proxy disabled=no \
dst-address-list=!proxyNET dst-port=80,8080,3128 in-interface=lan \
protocol=tcp to-addresses=192.168.3.100 to-ports=3128
add action=dst-nat chain=dstnat comment="REMOTE PROXY" disabled=no \
dst-address=125.165.40.xyz dst-port=22 protocol=tcp to-addresses=\
192.168.3.100 to-ports=22

6. Route

/ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
pppoe_1 routing-mark=pppoe_1 scope=30 target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
pppoe_2 routing-mark=pppoe_2 scope=30 target-scope=10
add check-gateway=ping comment=Default-Route-pppoe1-Distance-1 disabled=no \
distance=1 dst-address=0.0.0.0/0 gateway=pppoe_1 scope=30 target-scope=10
add check-gateway=ping comment=Default-Route-pppoe2-Distance-2 disabled=no \
distance=2 dst-address=0.0.0.0/0 gateway=pppoe_2 scope=30 target-scope=10

SETINGAN DI SISI MESIN UBUNTU:

PROXY DG UBUNTU + LUSCA

Lusca Proxy High performance merupakan pengembangan dari squid oleh developer squid Andrian cadd yg didekasikan terutama utk caching file2 dynamic (kayak youtube, google addssense, banner, iklan dll) file2 itu biasanya membuat penuh cache, tapi karena content dynamic oleh squid pasti akan dianggap miss dan akan mendownload lagi jadi bisa membuat posioning cache. Lusca sanggup mencache file2 tsb dan menjadi hit content.. banyaknya file dinamis ini tentu akan jauh menghemat bandwidth yg kita pakai..

Cara Install Ubuntu dan Tunning lihat di sini : http://pung0-c0de.googlecode.com/files/confiq%20on%20ubuntu.rar

Install Paket yg di butuhkan :
#sudo apt-get update
# sudo apt-get install squid
# sudo apt-get install squid squidclient squid-cgi
# sudo apt-get install gcc
# sudo apt-get install build-essential
# sudo apt-get install sharutils
# sudo apt-get install ccze
# sudo apt-get install libzip-dev
# sudo apt-get install automake1.9

Download Lusca lewat terminal ubuntu :
wget httx://pung0-c0de.googlecode.com/files/LUSCA_FMI.tar.gz

lalu ekstrak dan masuk ke foldernya :
# tar xzvf LUSCA_FMI.tar.gz
# cd LUSCA_FMI/

CATATAN : jika memakai ubuntu 64bit lakukan perintah ini #---------> make distclean

Ok sekarang dimulai tahap compile nya :

./configure --prefix=/usr --exec_prefix=/usr --bindir=/usr/sbin --sbindir=/usr/sbin --libexecdir=/usr/lib/squid --sysconfdir=/etc/squid \
--localstatedir=/var/spool/squid --datadir=/usr/share/squid --enable-http-gzip --enable-async-io=24 --with-aufs-threads=24 --with-pthreads --enable-storeio=aufs \
--enable-linux-netfilter --enable-arp-acl --enable-epoll --enable-removal-policies=heap --with-aio --with-dl --enable-snmp \
--enable-delay-pools --enable-htcp --enable-cache-digests --disable-unlinkd --enable-large-cache-files --with-large-files \
--enable-err-languages=English --enable-default-err-language=English --with-maxfd=65536

Selanjutnya, ketik perintah berikut di terminal :
# make
# sudo make install

Edit squid.conf
# Memberikan permission pada folder cache

chown proxy:proxy /cache1
chown proxy:proxy /cache2
chown proxy:proxy /cache3
chown proxy:proxy /videocache
chmod 777 /cache1
chmod 777 /cache2
chmod 777 /cache3
chmod 777 /videocache
chown proxy:proxy /etc/squid/storeurl.pl
chmod 777 /etc/squid/storeurl.pl
chown proxy:proxy /usr/share/squid/refresh.conf
chmod 777 /usr/share/squid/refresh.conf

# Membuat folder-folder swap/cache di dalam folder cache yang telah ditentukan dg perintah :

squid -f /etc/squid/squid.conf -z

# Restart squid
sudo /etc/init.d/squid restart

Reboot CPU nya...

+============ FINISH ==========+