Border Gateway Protocol ( BGP Backdoor )
After we learned , External Border Gateway Protocol (EBGP Peering Physical Interface) On Mikrotik We will learn about BGP Backdoor. BGP Backdoor is...
Home » Penelusuran JARINGAN KOMPUTER
Border Gateway Protocol ( BGP Backdoor )
By default, the value of AD EBGP is 20, EBGP certainly would be an advantage compared with IGP protocols such as OSPF, EIGRP, etc.. With BGP Backdoor, we can manipulate so IGP routing protocol takes precedence over EBGP
We will configure BGP Peering between R1 to R3 and R2 to R3. While the link between R1 and R2, we will only configure OSPF
R1(config)#int e0/0
R1(config-if)#no sh R1(config-if)#ip add 12.12.12.1 255.255.255.0 R1(config-if)#int e0/1 R1(config-if)#no sh
R1(config-if)#ip add 13.13.13.1 255.255.255.0
R1(config-if)#int l0 R1(config-if)#ip add 1.1.1.1 255.255.255.255
R1(config-if)#router bgp 1
R1(config-router)#nei 13.13.13.3 remote-as 3
R1(config-router)#net 1.1.1.1 mask 255.255.255.255
R1(config-router)#router ospf 1
R1(config-router)#net 12.12.12.0 0.0.0.255 are 0
R1(config-router)#net 1.1.1.1 0.0.0.0 are 0
R2(config)#int e0/0
R2(config-if)#no sh
R2(config-if)#ip add 12.12.12.2 255.255.255.0
R2(config-if)#int e0/1 R2(config-if)#no sh
R2(config-if)#ip add 23.23.23.2 255.255.255.0
R2(config-if)#router bgp 2
R2(config-router)#nei 23.23.23.3 remote-as 3
R2(config-router)#router ospf 1
R2(config-router)#net 12.12.12.0 0.0.0.255 are 0
R2(config-if)#no sh
R2(config-if)#ip add 12.12.12.2 255.255.255.0
R2(config-if)#int e0/1 R2(config-if)#no sh
R2(config-if)#ip add 23.23.23.2 255.255.255.0
R2(config-if)#router bgp 2
R2(config-router)#nei 23.23.23.3 remote-as 3
R2(config-router)#router ospf 1
R2(config-router)#net 12.12.12.0 0.0.0.255 are 0
R3(config)#int e0/0
R3(config-if)#no sh
R3(config-if)#ip add 13.13.13.3 255.255.255.0
R3(config-if)#int e0/1 R3(config-if)#no sh
R3(config-if)#ip add 23.23.23.3 255.255.255.0
R3(config-if)#router bgp 3
R3(config-router)#nei 13.13.13.1 remote-as 1
R3(config-router)#nei 23.23.23.2 rempte-as 2
R3(config-if)#no sh
R3(config-if)#ip add 13.13.13.3 255.255.255.0
R3(config-if)#int e0/1 R3(config-if)#no sh
R3(config-if)#ip add 23.23.23.3 255.255.255.0
R3(config-if)#router bgp 3
R3(config-router)#nei 13.13.13.1 remote-as 1
R3(config-router)#nei 23.23.23.2 rempte-as 2
Now we check the routing table on R2
R2(config-router)#do sh ip ro
1.0.0.0/32 is subnetted, 1 subnets
B 1.1.1.1 [20/0] via 23.23.23.3, 00:06:15
12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 12.12.12.0/24 is directly connected, Ethernet0/0
23.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 23.23.23.0/24 is directly connected, Ethernet0/1
1.0.0.0/32 is subnetted, 1 subnets
B 1.1.1.1 [20/0] via 23.23.23.3, 00:06:15
12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 12.12.12.0/24 is directly connected, Ethernet0/0
23.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 23.23.23.0/24 is directly connected, Ethernet0/1
[Note]: R2 prefer to use EBGP routing protocol to heading 1.1.1.1 than OSPF. And if using BGP, R2 R3 must pass first. Whereas if you use OSPF, should R2 can go straight to R1. Why R2 can choose BGP than OSPF ?? because the value of AD BGP is 20 while the value of OSPF is 110 AD.
In order R2 prefer use OSPF routing protocol, we can configure BGP Backdoor
R2(config)#router bgp 2
R2(config-router)#net 1.1.1.1 mask 255.255.255.255 backdoor Now we check the routing table on R2
R2(config-router)#do sh ip ro
1.0.0.0/32 is subnetted, 1 subnets
O 1.1.1.1 [110/11] via 12.12.12.1, 00:00:06, Ethernet0/0
12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C
12.12.12.0/24 is directly connected, Ethernet0/0
23.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C
23.23.23.0/24 is directly connected, Ethernet0/1
1.0.0.0/32 is subnetted, 1 subnets
O 1.1.1.1 [110/11] via 12.12.12.1, 00:00:06, Ethernet0/0
12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C
12.12.12.0/24 is directly connected, Ethernet0/0
23.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C
23.23.23.0/24 is directly connected, Ethernet0/1
Note that at this time has chosen R2 using OSPF routing protocol BGP compared to heading 1.1.1.1 z 5:51 PM Admin Bandung Indonesia
Peering EBGP when there are two or more routers that have different AS Number. The following topology which we will use. First, configure the IP address on R1 and R2 based topology above
[admin@MikroTik] > system identity set name=R1
[admin@R1] > interface bridge add name=lo0
[admin@R1] > ip address
[admin@R1] /ip address>add address=22.22.22.1/24 interface=ether1
[admin@R1] /ip address> add address=192.168.0.1/24 interface=lo0
and
[admin@MikroTik] > system identity set name=R2
[admin@R2] > interface bridge add name=lo0
[admin@R2] > ip address
[admin@R2] /ip address> add address=22.22.22.2/24 interface=ether1
[admin@R2] /ip address> add address=192.168.1.1/24 interface=lo0
Next, We Peering BGP configuration on R1 and R2
[admin@R1] > routing bgp [admin@R1] /routing bgp> instance set 0 as=100 [admin@R1] /routing bgp> peer add remote-address=22.22.22.2 remote-as=200 [admin@R1] /routing bgp> network add network=192.168.0.0/24
and
[admin@R2] > routing bgp [admin@R2] /routing bgp> instance set 0 as=200 [admin@R2] /routing bgp> peer add remote-address=22.22.22.1 remote-as=100 [admin@R2] /routing bgp> network add network=192.168.1.0/24
For testing we look at the routing table on R1, R1 sure to recognize the 192.168.1.0/24 network through BGP.
[admin@R1] /routing bgp> /ip route print Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit # DST-ADDRESS PREF-SRC GATEWAY DISTANCE 0 ADC 22.22.22.1/24 22.22.22.1 ether1 0 1 ADC 192.168.0.0/24 192.168.0.1 lo0 0 2 ADb 192.168.2.0/24 22.22.22.2 20
External Border Gateway Protocol (EBGP Peering Physical Interface) On Mikrotik
We have learned EBGP Loopback On Mikrotik
Peering EBGP when there are two or more routers that have different AS Number. The following...
the same reason IBGP peering using a loopback interface that we
discussed earlier. That is because the loopback interface will never be down as long as at least one active interface on the router.
For The First First, we configure the IP address on both routers according to the topology.
[admin@MikroTik] > system identity set name=R1
[admin@R1] > interface bridge add name=lo0 [admin@R1] > ip address
[admin@R1] /ip address> add address=12.12.12.1/24 interface=ether1
[admin@R1] /ip address> add address=192.168.1.1/24 interface=lo0
[admin@MikroTik] > system identity set name=R2
[admin@R2] > interface bridge add name=lo0
[admin@R2] > ip address
[admin@R2] /ip address> add address=12.12.12.2/24 interface=ether1
[admin@R2] /ip address> add address=192.168.2.1/24 interface=lo0
Before configuring EBGP peering using a loopback interface, we must introduce IP Loopback R1 to R2, and vice versa. We can use static routing or dynamic routing (OSPF).
[admin@MikroTik] > system identity set name=R2
[admin@R2] > interface bridge add name=lo0
[admin@R2] > ip address
[admin@R2] /ip address> add address=12.12.12.2/24 interface=ether1
[admin@R2] /ip address> add address=192.168.2.1/24 interface=lo0
we need to configure the multihop on R1. This is because the IP Address Loopback R2 is not considered to be directly connected By R1, as well as the R2. For testing, we look at the routing table on R1
[admin@R1] /routing bgp> /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADC 12.12.12.0/24 12.12.12.1 ether1 0
1 ADC 192.168.1.0/24 192.168.1.1 lo0 0
2 A S 192.168.2.0/24 12.12.12.2 1
3 Db 192.168.2.0/24 192.168.2.1 20
z
11:56 PM
Admin
Bandung IndonesiaFlags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADC 12.12.12.0/24 12.12.12.1 ether1 0
1 ADC 192.168.1.0/24 192.168.1.1 lo0 0
2 A S 192.168.2.0/24 12.12.12.2 1
3 Db 192.168.2.0/24 192.168.2.1 20
EBGP Peering (Loopback Interface) On Mikrotik
We learn EBGP peering using a loopback interface on the proxy. For
the same reason IBGP peering using a loopback interface that we
discussed earlier....
Broadly speaking, this brute force attack is a technique of trying to break into someone else's device (ex: Mikrotik) by way of trying random possibilities and user passwords on such devices. And this is very often the case if there is a proxy "Public IP"
Everyone must have their own security to keep the device so that other people can not get in, and certainly with a password that only he and those around him who would know. But indirectly brute force attack is very disturbing.
Let not happen like this again, in Mikrotik can add multiple filters.
z
11:31 PM
Admin
Bandung Indonesia
Everyone must have their own security to keep the device so that other people can not get in, and certainly with a password that only he and those around him who would know. But indirectly brute force attack is very disturbing.
Let not happen like this again, in Mikrotik can add multiple filters.
- Filter first, drop FTP. Equate just like this picture
Filter above, if there are IP that tries to enter but failed (503 Login Incorrect) will be included in the address list with the names ftp_blacklist, and if there is a sign in using the IP in the address list (ftp_blacklist) via port 21 / FTP action be in drop
- Second, Drop SSH
The function is similar to the above drop FTP
- similar to filter FTP but uses the stage. If there is a sign in using an existing IP Address in the list (ssh_blacklist) via port 22 / ssh the action will be dropped And in the results of the second filter
To see how many IP are used brute force attacker. can be seen in the Address list.
This is an example that happened in my own router, when only a day using this filter but already there are 13 incoming IP address list
PREVENT Bruteforce ATTACK IN MIKROTIK
Broadly speaking, this brute force attack is a technique of trying to break into someone else's device (ex: Mikrotik) by way of trying random possibilities...
yang pertama paling penting brader - brader sekalian sudah berlangganan internet dengan ISP dan memiliki IP PUBLIC STATIC. kenapa harus static karena gak berubah-ubah. kalo IP PUBLIC DYNAMIC bisa disetting dimikrotik. cuma setiap kali IP Publicnya berubah. kalian juga harus update settingan NAT nya dimikrotik.#ribet.
saya asumsikan disini semua alat dan bahan sudah tersedia. lanjut yah
Login ke Mikrotik anda dan masuk ke Menu IP > FIREWALL > NAT
Tab "General"
Chain : dstnat
Dst.Address : 100.200.100.200 (IP Public Static kamu dari Penyedia layanan internet)
Protocol : 6 (tcp)
Dst.Port : 8000 (Protocol tcp dan port 8000 inilah untuk akses PC CCTV / DVR / NVR anda).
In.Interface : pppoe-speedy (Interface pppoe client yang sebelumnya sudah disetting dari hasil bridging)
Masuk ke tab-2 "Action"
Action : dst-nat
To Addresses : 192.168.0.200 ( IP Local baik itu PC / DVR / NVR)
To Ports : 8000 (bisa berbeda - beda Tergantung perangkat anda)
Terakhir Klik Apply / OK
dan coba lihat hasilnya dengan aplikasi EAGLE EYES / IVMS.
Kesimpulan dari artikel Port Forwarding CCTV, DVR, NVR, dan IP Camera dapat dilakukan jika memiliki IP PUBLIC Static, dan untuk kecepatan akses dan pergerakan dan kualitas gambar. tergantung bandwidth internet dan perangkat yang anda gunakan.
Port Forwarding CCTV, DVR, NVR dan IP Camera
Berawal dari Otodidakers dapet permintaan CCTV kantor bisa di akses dari luar ama bos. dia pengennya control kantor walaupun dia lagi diluar. pertama...
