Limit Download Extention Mikrotik

Firewall Filter
/ip firewall filter
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment="Filter Download iso" content=.iso disabled=no protocol=tcp \
    src-address=192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=mpg content=.mpg disabled=no protocol=tcp src-address=\
    192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=mp3 content=.mp3 disabled=no protocol=tcp src-address=\
    192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=avi content=.avi disabled=no protocol=tcp src-address=\
    192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=exe content=.exe disabled=no protocol=tcp src-address=\
    192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=rar content=.rar disabled=no protocol=tcp src-address=\
    192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=mwv content=.mwv disabled=no protocol=tcp src-address=\
    192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=zip content=.zip disabled=no protocol=tcp src-address=\
    192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=3gp content=.3gp disabled=no protocol=tcp src-address=\
    192.168.0.0/24
add action=add-dst-to-address-list address-list=cekek address-list-timeout=1h chain=forward comment=mp4 content=.mp4 disabled=no protocol=tcp src-address=\
    192.168.0.0/24

Firewall Mangle
/ip firewall mangle add chain=forward \
protocol=tcp src-address-list=cekek \
action=mark-packet new-packet-mark=cekek-bw

Queue
/queue simple add name=download-files \
max-limit=32000/32000 packet-marks=cekek-bw

Limit Streaming Mikrotik

Layer Protocol
/ip firewall layer7-protocol
add name=http-video-streaming regexp="http/(0\\.9|1\\.0|1\\.1)[\\x09-\\x0d ][1-5\
    ][0-9][0-9][\\x09-\\x0d -~]*(content-type: video)"

Firewall Mangle
/ip firewall mangle
add action=mark-connection chain=prerouting comment="Limit Streaming Video" \
    disabled=no layer7-protocol=http-video-streaming new-connection-mark=\
    http-video-streaming-1 passthrough=yes
add action=mark-packet chain=prerouting disabled=no layer7-protocol=\

Queue
/queue type
add kind=pcq name=Pcq-Download pcq-burst-rate=0 pcq-burst-threshold=0 \
    pcq-burst-time=10s pcq-classifier=dst-address pcq-dst-address-mask=32 \
    pcq-dst-address6-mask=128 pcq-limit=50 pcq-rate=0 pcq-src-address-mask=\
    32 pcq-src-address6-mask=128 pcq-total-limit=2000
add kind=pcq name=Pcq-Upload pcq-burst-rate=0 pcq-burst-threshold=0 \
    pcq-burst-time=10s pcq-classifier=src-address pcq-dst-address-mask=32 \
    pcq-dst-address6-mask=128 pcq-limit=50 pcq-rate=0 pcq-src-address-mask=\
    32 pcq-src-address6-mask=128 pcq-total-limit=2000

/queue tree
add burst-limit=128k burst-threshold=24k burst-time=4s disabled=no limit-at=\
    32k max-limit=32k name=Streaming packet-mark=http-video-streaming \
    parent=global-total priority=8 queue=Pcq-Download

Standar Firewall Mikrotik

Address List
/ip firewall address-list
add address=192.168.0.8 disabled=no list=local-addr ( ip address yg di izinkan untuk acces winbox )

 Firewall Filter
/ip firewall filter
add action=add-src-to-address-list address-list=-FTP address-list-timeout=4w2d \
    chain=input comment="Filter - Wan Access FTP" disabled=no dst-port=21 \
    protocol=tcp src-address-list=!local-addr
add action=drop chain=input disabled=no src-address-list=-FTP
add action=accept chain=input disabled=no dst-port=21 protocol=tcp \
    src-address-list=local-addr
add action=add-src-to-address-list address-list=-SSH address-list-timeout=4w2d \
    chain=input comment="Filter - Wan Access SSH" disabled=no dst-port=22 \
    protocol=tcp src-address-list=!local-addr
add action=drop chain=input disabled=no src-address-list=-SSH
add action=accept chain=input disabled=no dst-port=22 protocol=tcp \
    src-address-list=local-addr
add action=add-src-to-address-list address-list=-TELNET address-list-timeout=\
    4w2d chain=input comment="Filter - Wan Access TELNET" disabled=no dst-port=\
    23 protocol=tcp src-address-list=!local-addr
add action=drop chain=input disabled=no src-address-list=-TELNET
add action=accept chain=input disabled=no dst-port=23 protocol=tcp \
    src-address-list=local-addr
add action=add-src-to-address-list address-list=-WEB address-list-timeout=4w2d \
    chain=input comment="Filter - Wan Access WEB" disabled=no dst-port=80 \
    protocol=tcp src-address-list=!local-addr
add action=drop chain=input disabled=no src-address-list=-WEB
add action=accept chain=input disabled=no dst-port=80 protocol=tcp \
    src-address-list=local-addr
add action=add-src-to-address-list address-list=-WINBOX address-list-timeout=\
    4w2d chain=input comment="Filter - Wan Access WINBOX" disabled=no dst-port=\
    8291 protocol=tcp src-address-list=!local-addr
add action=drop chain=input disabled=no src-address-list=-WINBOX
add action=accept chain=input disabled=no dst-port=8291 protocol=tcp \
    src-address-list=local-addr
add action=add-src-to-address-list address-list=-VPN address-list-timeout=4w2d \
    chain=input comment="Filter - Wan Access VPN" disabled=no dst-port=1723 \
    protocol=tcp src-address-list=!local-addr
add action=drop chain=input disabled=no src-address-list=-VPN
add action=accept chain=input disabled=no dst-port=1723 protocol=tcp \
    src-address-list=local-addr
add action=add-src-to-address-list address-list="Filter - Port Scanners" \
    address-list-timeout=2w chain=input comment="Filter - Port Scanners" \
    disabled=no protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input disabled=no protocol=tcp tcp-flags=\
    fin,syn
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input disabled=no protocol=tcp tcp-flags=\
    syn,rst
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input disabled=no protocol=tcp tcp-flags=\
    fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input disabled=no protocol=tcp tcp-flags=\
    fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input disabled=no protocol=tcp tcp-flags=\
    !fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input disabled=no protocol=tcp tcp-flags=\
    fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input disabled=no src-address-list="port scanners"
add action=accept chain=forward comment=Connections connection-state=\
    established disabled=no
add action=accept chain=forward connection-state=related disabled=no
add action=drop chain=forward comment="Blok Ping Out" disabled=no \
    out-interface=modem1 protocol=icmp src-address=!192.168.0.8

Time Acces Internet with Kantor

/ip proxy
set always-from-cache=no cache-administrator="webmaster" cache-hit-dscp=4 \
    cache-on-disk=no enabled=yes max-cache-size=none max-client-connections=\
    600 max-fresh-time=3d max-server-connections=600 parent-proxy=0.0.0.0 \
    parent-proxy-port=0 port=3128 serialize-connections=no src-address=\
    0.0.0.0

===========================================================================

/ip proxy access
add action=deny comment=proxy disabled=no src-address=192.168.20.0/24

===========================================================================

/ip firewall nat
add action=redirect chain=dstnat comment=Redirect disabled=no in-interface=\
local port=3128 protocol=\
tcp src-address-list=!allow to-ports=3128

===========================================================================

/system script
add name=allow policy=\
    ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive source=\
    "/ip proxy access set [find comment=\"proxy\"] action=allow"
add name=deny policy=\
    ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive source=\
    "/ip proxy access set [find comment=\"proxy\"] action=deny"

===========================================================================

/system scheduler
add comment="" disabled=no interval=1w name=allow on-event=allow policy=\
    reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    may/02/2012 start-time=12:00:00
add comment="" disabled=no interval=1w name=deny on-event=deny policy=\
    reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    may/02/2012 start-time=13:00:00

Loadbalancing 2 Speedy

/interface
Set 0 name=modem1
Set 1 name=modem2
Set 2 name=local

============================================================================

/ip address
add address=192.168.1.2/24 netmask=255.255.255.0 interface=modem1
add address=192.168.2.2/24 netmask=255.255.255.0 interface=modem2
add address=192.168.20.1/24 netmask=255.255.255.0 interface=local

============================================================================
/ip firewall mangle
 add chain=prerouting action=mark-connection new-connection-mark=modem1
     passthrough=yes connection-state=new in-interface=local nth=2,1

 add chain=prerouting action=mark-routing new-routing-mark=modem1
     passthrough=no in-interface=local connection-mark=modem1

 add chain=prerouting action=mark-connection new-connection-mark=modem2
     passthrough=yes connection-state=new in-interface=local nth=2,2

 add chain=prerouting action=mark-routing new-routing-mark=modem2
     passthrough=no in-interface=local connection-mark=modem2 

============================================================================


/ip firewall nat
add chain=srcnat action=masquerade out-interface=modem1
add chain=srcnat action=masquerade out-interface=modem2

============================================================================

/ip route 
add gateway=192.168.1.1 
add gateway=192.168.2.1 routing-mark=modem2

Eoip Tunelling Mikrotik

 

MikroTik Jakarta

ip public = 111.111.111.111

ether1 =  192.168.1.1/24

ether2 = 192.168.0.1/24

MikroTik Medan

ip public = 222.222.222.222

ether1 = 192.168.1.2/24

ether2 = 192.168.0.2/24

Seting di kedua Mikrotik

1. admin@jakarta > Ip address add address=192.168.1.1/24 interface=ether1 disabled=no  
2. admin@jakarta > Ip address add address=192.168.0.1/24 interface=ether2 disabled=no  
3. admin@medan > Ip address add address=192.168.1.2/24 interface=ether1 disabled=no  
4. admin@medan > Ip address add address=192.168.0.2/24 interface=ether2 disabled=no

 Seting di Mikrotik Jakarta

1. interface pptp-server server set enabled=yes   
2. interface pptp-server add name=medan user=medan disabled=no  
3. ppp secret add name=medan password=medan local-address=10.0.1.1 remote-address=10.0.1.2 service=pptp disabled=no  

  Seting di Mikrotik Medan

1. interface pptp-client add name=jkt-mdn user=medan password=medan connect-to=111.111.111.111 disabled=no 

  Seting di kedua Mikrotik

1. admin@jakarta > interface eoip add name=eoip remote-address=10.0.1.2 tunnel-id=1 disabled=no  
2. admin@medan > interface eoip add name=eoip remote-address=10.0.1.1 tunnel-id=1 disabled=no  

Seting di kedua Mikrotik

1. interface bridge add name=bridge disabled=no  
2. interface bridge port add bridge=bridge interface=eoip, ether2