ISP-Billing • Kursus PraktisiPanduan Praktik Hands-On
Lab 1: Deploy & Hardening CHR RouterOS v7 di VPS Linux KVM
Praktikum penulisan image CHR via dd di VPS, initial configuration, dan pembuatan rule anti-bruteforce Winbox.
Format: Markdown (.MD)•File:
lab_1_deploy_chr_di_vps_cloud.md•Sasaran: Praktisi & DevOpsFilter Versi CLI:
Tujuan Praktikum #
- Melakukan instalasi CHR v7 menggunakan raw image disk writing (
dd) di instance VPS Linux (Ubuntu/Debian Rescue Mode). - Melakukan initial login via Winbox IP Publik.
- Mengonfigurasi firewall filter perlindungan brute-force SSH & Winbox.
Langkah 1: Script Auto-Installer CHR di Rescue Console VPS #
Jalankan bash command berikut di terminal rescue mode VPS:
BASH
RouterOS v7
# Update repository dan install unzip
apt-get update && apt-get install -y unzip wget
# Download raw image RouterOS v7 terbaru
wget https://download.mikrotik.com/routeros/7.16/chr-7.16.img.zip
unzip chr-7.16.img.zip
# Tentukan disk utama VPS (biasanya /dev/vda atau /dev/sda)
lsblk
# Tulis image ke disk utama VPS
dd if=chr-7.16.img of=/dev/vda bs=4M oflag=sync status=progress
# Reboot server untuk boot ke MikroTik RouterOS
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-triggerLangkah 2: Initial Setup & Firewall Hardening di RouterOS #
Setelah reboot, login menggunakan Winbox ke IP Publik VPS dengan user admin (tanpa password):
ROUTEROS
# 1. Ganti password admin segera!
/user set 0 password="SuperStrongPasswordISP2026!"
# 2. Set Router Identity
/system identity set name="CHR-CORE-ISP-CENTRAL"
# 3. Drop Brute Force Winbox Rule
/ip firewall filter
add chain=input protocol=tcp dst-port=8291 src-address-list=black_list action=drop comment="Drop Brute Force Winbox"
add chain=input protocol=tcp dst-port=8291 connection-state=new src-address-list=winbox_stage3 action=add-src-to-address-list address-list=black_list address-list-timeout=1d comment="Add to Blacklist 1 day"
add chain=input protocol=tcp dst-port=8291 connection-state=new src-address-list=winbox_stage2 action=add-src-to-address-list address-list=winbox_stage3 address-list-timeout=1m
add chain=input protocol=tcp dst-port=8291 connection-state=new src-address-list=winbox_stage1 action=add-src-to-address-list address-list=winbox_stage2 address-list-timeout=1m
add chain=input protocol=tcp dst-port=8291 connection-state=new action=add-src-to-address-list address-list=winbox_stage1 address-list-timeout=1m