Temukan Panduan

» » »

Praktek Konfigurasi Static Route: Panduan Langkah demi Langkah

Static route adalah dasar dari routing di jaringan komputer. Artikel ini akan memberikan panduan praktis lengkap untuk konfigurasi static route dengan berbagai skenario nyata menggunakan MikroTik.

Persiapan Lab

Sebelum memulai, siapkan lingkungan lab berikut:

  • 2-3 Router MikroTik (bisa virtual menggunakan CHR atau GNS3)
  • Kabel jaringan atau koneksi virtual
  • Winbox/Webfig untuk management
  • 2-3 PC/Client untuk testing

Topologi Dasar:

[PC1]---[Router A]---[Router B]---[Router C]---[PC2] 192.168.1.0/24 10.0.0.0/30 10.0.0.4/30 192.168.2.0/24

Skenario 1: Basic Static Route (2 Router)

Topologi:

 LAN A WAN Link LAN B 192.168.1.0/24 ---- 10.0.0.0/30 ---- 192.168.2.0/24 | | | [PC1] [Router A] [Router B] .100 .1 .2 .1 .100 | | [PC2] [PC3]

Step-by-Step Konfigurasi:

Router A Konfigurasi:

		# Reset konfigurasi (opsional)
		/system reset-configuration no-defaults=yes
		# Set identity
		/system identity set name=Router-A
		# Konfigurasi interface
		/interface ethernet
		set ether1 name=LAN
		set ether2 name=WAN
		# IP Addresses
		/ip address
		add address=192.168.1.1/24 interface=LAN
		add address=10.0.0.1/30 interface=WAN
		# DHCP Server untuk LAN
		/ip pool
		add name=dhcp-pool-a ranges=192.168.1.100-192.168.1.200
		/ip dhcp-server
		add name=dhcp-a interface=LAN address-pool=dhcp-pool-a disabled=no
		/ip dhcp-server network
		add address=192.168.1.0/24 gateway=192.168.1.1 dns-server=8.8.8.8
		# Static Route ke LAN B
		/ip route
		add dst-address=192.168.2.0/24 gateway=10.0.0.2 distance=1 comment="Route to LAN B"
		# NAT untuk internet (jika ada)
		/ip firewall nat
		add chain=srcnat out-interface=WAN action=masquerade

Router B Konfigurasi:

		# Reset konfigurasi
		/system reset-configuration no-defaults=yes /system identity set name=Router-B
		# Konfigurasi interface
		/interface ethernet
		set ether1 name=WAN
		set ether2 name=LAN

		# IP Addresses
		/ip address
		add address=10.0.0.2/30 interface=WAN
		add address=192.168.2.1/24 interface=LAN

		# DHCP Server
		/ip pool
		add name=dhcp-pool-b ranges=192.168.2.100-192.168.2.200

		/ip dhcp-server
		add name=dhcp-b interface=LAN address-pool=dhcp-pool-b disabled=no

		/ip dhcp-server network
		add address=192.168.2.0/24 gateway=192.168.2.1 dns-server=8.8.8.8

		# Static Route ke LAN A
		/ip route
		add dst-address=192.168.1.0/24 gateway=10.0.0.1 distance=1 comment="Route to LAN A"

		# NAT
		/ip firewall nat
		add chain=srcnat out-interface=WAN action=masquerade

Testing Konektivitas:

 # Dari Router A
	[admin@Router-A] >
	ping 10.0.0.2
	[admin@Router-A] >
	ping 192.168.2.1
	# Dari Router B
	[admin@Router-B] >
	ping 10.0.0.1
	[admin@Router-B] >
	ping 192.168.1.1

	# Cek routing table
	[admin@Router-A] >
	ip route print
	[admin@Router-B] >
	ip route print

	# Test dari client PC
	PC1 (192.168.1.100): ping 192.168.2.100
	PC2 (192.168.2.100): ping 192.168.1.100

Skenario 2: Triangle Network dengan 3 Router

Topologi:

	[Router A] / \ /10.0.0.0/30 \10.0.0.4/30 / \ 
	[Router B]-----------[Router C] \10.0.0.8/30 / \ / \ / 
	[All Networks]
LAN Networks:
• Router A: 192.168.1.0/24
• Router B: 192.168.2.0/24
• Router C: 192.168.3.0/24

Konfigurasi Lengkap:

Router A:

 /interface ethernet set ether1 name=LAN set ether2 name=WAN-B set ether3 name=WAN-C
		/ip address
		add address=192.168.1.1/24 interface=LAN
		add address=10.0.0.1/30 interface=WAN-B
		add address=10.0.0.5/30 interface=WAN-C

		# Static Routes:
		/ip route
		add dst-address=192.168.2.0/24 gateway=10.0.0.2 distance=1 comment="To LAN B via direct"
		add dst-address=192.168.2.0/24 gateway=10.0.0.6 distance=2 comment="To LAN B via C (backup)"
		add dst-address=192.168.3.0/24 gateway=10.0.0.6 distance=1 comment="To LAN C via direct"
		add dst-address=192.168.3.0/24 gateway=10.0.0.2 distance=2 comment="To LAN C via B (backup)"

Router B:

 /interface ethernet set ether1 name=LAN set ether2 name=WAN-A set ether3 name=WAN-C
	/ip address
	add address=192.168.2.1/24 interface=LAN
	add address=10.0.0.2/30 interface=WAN-A
	add address=10.0.0.9/30 interface=WAN-C

	# Static Routes:
	/ip route
	add dst-address=192.168.1.0/24 gateway=10.0.0.1 distance=1 comment="To LAN A via direct"
	add dst-address=192.168.1.0/24 gateway=10.0.0.10 distance=2 comment="To LAN A via C (backup)"
	add dst-address=192.168.3.0/24 gateway=10.0.0.10 distance=1 comment="To LAN C via direct"
	add dst-address=192.168.3.0/24 gateway=10.0.0.1 distance=2 comment="To LAN C via A (backup)"

Router C:

 /interface ethernet set ether1 name=LAN set ether2 name=WAN-A set ether3 name=WAN-B
	/ip address
	add address=192.168.3.1/24 interface=LAN
	add address=10.0.0.6/30 interface=WAN-A
	add address=10.0.0.10/30 interface=WAN-B

	# Static Routes:
	/ip route
	add dst-address=192.168.1.0/24 gateway=10.0.0.5 distance=1 comment="To LAN A via direct"
	add dst-address=192.168.1.0/24 gateway=10.0.0.9 distance=2 comment="To LAN A via B (backup)"
	add dst-address=192.168.2.0/24 gateway=10.0.0.9 distance=1 comment="To LAN B via direct"
	add dst-address=192.168.2.0/24 gateway=10.0.0.5 distance=2 comment="To LAN B via A (backup)"

Testing Redundancy:

 # Test primary path [admin@Router-A] > ping 192.168.2.1 count=5 [admin@Router-A] > traceroute 192.168.2.1
# Simulasi link failure
[admin@Router-A] > interface disable WAN-B

# Test backup path
[admin@Router-A] > ping 192.168.2.1 count=5
[admin@Router-A] > traceroute 192.168.2.1

# Restore link
[admin@Router-A] > interface enable WAN-B

# Cek routing table status
[admin@Router-A] > ip route print status

Skenario 3: Hub and Spoke dengan Default Route

Topologi:

 [Internet] | 203.0.113.1 | [HQ Router] / | \ / | \ Branch1 Branch2 Branch3 10.0.1.0/30 10.0.2.0/30 10.0.3.0/30 | | | [BR1] [BR2] [BR3] 192.168.1.0/24 192.168.2.0/24 192.168.3.0/24

Konfigurasi HQ Router:

 # HQ Router Configuration
# Interface setup
/interface ethernet
set ether1 name=WAN-Internet
set ether2 name=LAN-HQ
set ether3 name=WAN-Branch1
set ether4 name=WAN-Branch2
set ether5 name=WAN-Branch3

# IP Addresses
/ip address
add address=203.0.113.2/29 interface=WAN-Internet
add address=192.168.88.1/24 interface=LAN-HQ comment="HQ Local Network"
add address=10.0.1.1/30 interface=WAN-Branch1 comment="Link to Branch1"
add address=10.0.2.1/30 interface=WAN-Branch2 comment="Link to Branch2"
add address=10.0.3.1/30 interface=WAN-Branch3 comment="Link to Branch3"

# Static Routes to Branches
/ip route
add dst-address=192.168.1.0/24 gateway=10.0.1.2 distance=1 comment="Branch1 Network"
add dst-address=192.168.2.0/24 gateway=10.0.2.2 distance=1 comment="Branch2 Network"
add dst-address=192.168.3.0/24 gateway=10.0.3.2 distance=1 comment="Branch3 Network"

# Default Route to Internet
/ip route
add dst-address=0.0.0.0/0 gateway=203.0.113.1 distance=1 check-gateway=ping comment="Default Route to Internet"

# NAT Configuration
/ip firewall nat
add chain=srcnat src-address=192.168.88.0/24 out-interface=WAN-Internet action=masquerade comment="NAT for HQ"
add chain=srcnat src-address=192.168.1.0/24 out-interface=WAN-Internet action=masquerade comment="NAT for Branch1"
add chain=srcnat src-address=192.168.2.0/24 out-interface=WAN-Internet action=masquerade comment="NAT for Branch2"
add chain=srcnat src-address=192.168.3.0/24 out-interface=WAN-Internet action=masquerade comment="NAT for Branch3"

# DHCP Server for HQ
/ip pool
add name=dhcp-hq ranges=192.168.88.100-192.168.88.200

/ip dhcp-server
add name=dhcp-hq interface=LAN-HQ address-pool=dhcp-hq disabled=no

/ip dhcp-server network
add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=8.8.8.8,8.8.4.4

Konfigurasi Branch Router (Contoh Branch1):

 # Branch1 Router Configuration
# Interface setup
/interface ethernet
set ether1 name=WAN-HQ
set ether2 name=LAN-Branch

# IP Addresses
/ip address
add address=10.0.1.2/30 interface=WAN-HQ
add address=192.168.1.1/24 interface=LAN-Branch

# Default Route to HQ (dan internet via HQ)
/ip route
add dst-address=0.0.0.0/0 gateway=10.0.1.1 distance=1 comment="Default route via HQ"
add dst-address=192.168.88.0/24 gateway=10.0.1.1 distance=1 comment="Route to HQ LAN"
add dst-address=192.168.2.0/24 gateway=10.0.1.1 distance=2 comment="Route to Branch2 via HQ"
add dst-address=192.168.3.0/24 gateway=10.0.1.1 distance=2 comment="Route to Branch3 via HQ"

# DHCP Server for Branch
/ip pool
add name=dhcp-branch1 ranges=192.168.1.100-192.168.1.200

/ip dhcp-server
add name=dhcp-branch1 interface=LAN-Branch address-pool=dhcp-branch1 disabled=no

/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1 dns-server=8.8.8.8

# Note: Tidak perlu NAT karena HQ melakukan NAT untuk semua branches
# Firewall minimal untuk security
/ip firewall filter
add chain=input connection-state=established,related action=accept
add chain=input connection-state=invalid action=drop
add chain=input protocol=icmp action=accept
add chain=input src-address=10.0.1.0/30 action=accept comment="Allow from HQ"
add chain=input src-address=192.168.1.0/24 action=accept comment="Allow from local LAN"
add chain=input action=drop comment="Drop everything else"

Skenario 4: Load Balancing dengan ECMP

Equal Cost Multi-Path (ECMP)

ECMP memungkinkan load balancing traffic melalui multiple paths dengan cost yang sama.

Topologi:

	[Office Network] | [Main Router] | | [ISP1] [ISP2] 203.0.113.1 198.51.100.1 | | [Internet] [Internet]

Konfigurasi ECMP:

		# Main Router Configuration
		# Interface setup
		/interface ethernet
		set ether1 name=LAN
		set ether2 name=WAN-ISP1
		set ether3 name=WAN-ISP2

		# IP Addresses
		/ip address
		add address=192.168.1.1/24 interface=LAN
		add address=203.0.113.2/29 interface=WAN-ISP1
		add address=198.51.100.2/29 interface=WAN-ISP2

		# ECMP Default Routes
		/ip route
		add dst-address=0.0.0.0/0 gateway=203.0.113.1,198.51.100.1 distance=1 comment="ECMP Load Balancing"

		# Atau dengan weight (jika ingin perbandingan tertentu)
		/ip route
		add dst-address=0.0.0.0/0 gateway=203.0.113.1 distance=1 scope=30 comment="ISP1 Primary"
		add dst-address=0.0.0.0/0 gateway=198.51.100.1 distance=1 scope=30 comment="ISP2 Primary"

		# NAT untuk kedua ISP
		/ip firewall nat
		add chain=srcnat out-interface=WAN-ISP1 action=masquerade comment="NAT for ISP1"
		add chain=srcnat out-interface=WAN-ISP2 action=masquerade comment="NAT for ISP2"

		# Mangle rules untuk connection-based load balancing
		/ip firewall mangle
		add chain=prerouting src-address=192.168.1.0/24 connection-state=new nth=2,1 action=mark-connection new-connection-mark=isp1-conn passthrough=yes
		add chain=prerouting src-address=192.168.1.0/24 connection-state=new nth=2,2 action=mark-connection new-connection-mark=isp2-conn passthrough=yes
		add chain=prerouting connection-mark=isp1-conn action=mark-routing new-routing-mark=to-isp1 passthrough=no
		add chain=prerouting connection-mark=isp2-conn action=mark-routing new-routing-mark=to-isp2 passthrough=no

		# Policy Routing berdasarkan connection mark
		/ip route
		add dst-address=0.0.0.0/0 gateway=203.0.113.1 routing-mark=to-isp1 comment="Route for ISP1 connections"
		add dst-address=0.0.0.0/0 gateway=198.51.100.1 routing-mark=to-isp2 comment="Route for ISP2 connections"

		# Default route untuk traffic tanpa mark
		/ip route
		add dst-address=0.0.0.0/0 gateway=203.0.113.1 distance=2 comment="Default if no mark"

		# Monitoring
		/tool netwatch
		add host=8.8.8.8 interval=30s timeout=5s up-script="" down-script="/log warning "ISP1 Down""
		add host=1.1.1.1 interval=30s timeout=5s up-script="" down-script="/log warning "ISP2 Down""

Skenario 5: Static Route dengan VPN

Topologi Site-to-Site VPN:

	[Site A] --- [Internet] --- [Site B] 192.168.10.0/24 VPN Tunnel 192.168.20.0/24

Konfigurasi IPsec VPN dengan Static Routes:

Site A Configuration:

			# IPsec Phase 1 /ip ipsec profile add name=site-to-site
			/ip ipsec proposal
			add name=site-to-site auth-algorithms=sha256 enc-algorithms=aes-256-cbc

			/ip ipsec policy
			add src-address=192.168.10.0/24 dst-address=192.168.20.0/24 sa-src-address=203.0.113.1 sa-dst-address=198.51.100.1 proposal=site-to-site profile=site-to-site

			# IPsec Peer
			/ip ipsec peer
			add address=198.51.100.1/32 auth-method=pre-shared-key secret=MySecretKey123 profile=site-to-site

			# Static Route via VPN Tunnel
			/ip route
			add dst-address=192.168.20.0/24 gateway=203.0.113.1 distance=1 comment="Route to Site B via VPN"

			# NAT exemption untuk VPN traffic
			/ip firewall nat
			add chain=srcnat src-address=192.168.10.0/24 dst-address=192.168.20.0/24 action=accept comment="Don't NAT VPN traffic"

			# Firewall rules untuk VPN
			/ip firewall filter
			add chain=input src-address=198.51.100.1 protocol=udp dst-port=500,4500 action=accept comment="IPsec from Site B"
			add chain=input src-address=192.168.20.0/24 action=accept comment="Allow from Site B LAN"

Site B Configuration:

		# IPsec Phase 1 /ip ipsec profile add name=site-to-site
		/ip ipsec proposal
		add name=site-to-site auth-algorithms=sha256 enc-algorithms=aes-256-cbc

		/ip ipsec policy
		add src-address=192.168.20.0/24 dst-address=192.168.10.0/24 sa-src-address=198.51.100.1 sa-dst-address=203.0.113.1 proposal=site-to-site profile=site-to-site

		# IPsec Peer
		/ip ipsec peer
		add address=203.0.113.1/32 auth-method=pre-shared-key secret=MySecretKey123 profile=site-to-site

		# Static Route via VPN Tunnel
		/ip route
		add dst-address=192.168.10.0/24 gateway=198.51.100.1 distance=1 comment="Route to Site A via VPN"

		# NAT exemption
		/ip firewall

Postingan Terkait

Formulir Kontak

Nama

Email *

Pesan *