Lab 3: Dynamic Port Knocking (Multi-Stage Unlock)

🎯 Sasaran Praktikum

Port management tersembunyi total dan hanya terbuka jika admin mengetuk urutan port rahasia.

• Tingkat Kesulitan: ADVANCED
• Estimasi Waktu: 30 Menit
• Target RouterOS: RouterOS v7 (v7.12+ recommended)

🗺️ Topologi Jaringan

[Admin] ---> Knock TCP 7000 ---> Knock TCP 8000 ---> Winbox 8291 Terbuka 1 Jam

Daftar Perangkat dalam Topologi:

• External-Network (internet) - Interfaces: wan1, wan2, wan3, wan4
• R1-Knock-Gateway (mikrotik) - Interfaces: ether1 (mgmt), ether2, ether3, ether4
• Corporate-LAN (pc) - Interfaces: eth1

🛠️ Langkah Konfigurasi Lengkap (RouterOS v7)

Langkah 1: R1-Hardened - Konfigurasi rule 2-stage port knocking

# Node: R1-Hardened
/ip firewall filter add chain=input protocol=tcp dst-port=7000 in-interface=ether2 action=add-src-to-address-list address-list=Knock_Stage1 address-list-timeout=15s
/ip firewall filter add chain=input protocol=tcp dst-port=8000 src-address-list=Knock_Stage1 in-interface=ether2 action=add-src-to-address-list address-list=Knock_Authorized address-list-timeout=1h
/ip firewall filter add chain=input protocol=tcp dst-port=8291 src-address-list=Knock_Authorized action=accept comment="Accept Authorized Admin"
/ip firewall filter add chain=input in-interface=ether2 action=drop comment="Drop All Other Ingress"

📥 Panduan Lengkap & Resource

Gunakan panduan lengkap seluruh lab MikroTik certification di Panduan Lengkap Skenario Lab MikroTik atau ikuti kelas resmi tatap muka kami di Daftar Pelatihan MikroTik.