Apa Itu Firewall?

Firewall adalah sistem keamanan jaringan yang memonitor dan mengontrol lalu lintas jaringan berdasarkan aturan (rules) yang telah ditentukan. Firewall bertindak sebagai gerbang penjaga antara jaringan internal (trusted) dan jaringan eksternal (untrusted).

Pada router, firewall bekerja di Layer 3-4 (Network & Transport) dengan memeriksa:

  • IP Address sumber dan tujuan
  • Port TCP/UDP
  • Protocol (TCP, UDP, ICMP, dll)
  • State koneksi (new, established, related, invalid)

Konsep Chain: Input, Forward, Output

Memahami chain adalah fundamental sebelum menulis rule firewall. Chain menentukan di titik mana paket diperiksa.

Diagram Alur Paket

image.png

Penjelasan Chain

Chain Arah Traffic Contoh Penggunaan
input Dari luar ke router itu sendiri Akses SSH, Winbox, DNS server di router, ping ke router
forward Melewati router (dari satu interface ke interface lain) Traffic client internet, antar-VLAN, LAN ke WAN
output Dari router ke luar Router melakukan ping, DNS lookup, NTP sync, update

Penting: Kebanyakan serangan menargetkan chain input (langsung ke router). Chain ini yang paling kritis untuk di-hardening.

Connection Tracking (Conntrack)

Connection tracking adalah mekanisme firewall yang melacak status setiap koneksi yang melewati router. Ini adalah fondasi dari stateful firewall.

Status Koneksi

Status Penjelasan
new Paket pertama dari koneksi baru (belum pernah dilihat)
established Paket milik koneksi yang sudah terjalin (reply sudah diterima)
related Paket terkait koneksi yang sudah ada (misal: ICMP error, FTP data)
invalid Paket yang tidak bisa diidentifikasi atau tidak sesuai state koneksi
untracked Paket yang sengaja di-bypass dari connection tracking

Mengapa Connection Tracking Penting?

Tanpa conntrack, kamu harus menulis rule dua arah untuk setiap koneksi. Dengan conntrack, cukup izinkan koneksi established,related sekali, lalu filter hanya new connections:

Iklan
TANPA conntrack (stateless):
  Rule 1: allow src=LAN dst=internet port=80   → keluar
  Rule 2: allow src=internet dst=LAN port=80   → masuk (BERBAHAYA!)

DENGAN conntrack (stateful):
  Rule 1: allow connection-state=established,related  → semua reply aman
  Rule 2: allow src=LAN dst=internet connection-state=new  → hanya koneksi baru dari LAN
  Rule 3: drop all  → sisanya ditolak

Tip: Selalu letakkan rule established,related di paling atas setiap chain. Ini mempercepat proses karena 90%+ traffic adalah paket dari koneksi yang sudah ada — tidak perlu diperiksa rule lain.

NAT (Network Address Translation)

NAT mengubah alamat IP sumber atau tujuan pada paket yang melewati router. Ada dua jenis utama:

1. Source NAT (srcnat) — Keluar

Mengubah IP sumber paket. Digunakan agar jaringan private (10.x, 172.16.x, 192.168.x) bisa mengakses internet.

Sebelum NAT:
  [Src: 192.168.1.100] ──→ Router ──→ [Dst: 8.8.8.8]

Sesudah NAT:
  [Src: 203.0.113.1]   ──→ Internet ──→ [Dst: 8.8.8.8]

Dua cara melakukan srcnat:

Metode Cara Kerja Kapan Digunakan
masquerade Otomatis menggunakan IP interface keluar IP WAN dinamis (DHCP/PPPoE)
src-nat (to-addresses) Manual menentukan IP sumber pengganti IP WAN statik, lebih efisien

Tip: masquerade meng-clear conntrack setiap kali link berubah, sehingga sedikit lebih lambat. Jika IP WAN statik, selalu gunakan src-nat dengan to-addresses.

2. Destination NAT (dstnat) — Masuk

Mengubah IP tujuan paket. Digunakan untuk port forwarding — membuka akses dari internet ke server/layanan di jaringan internal.

Dari internet:
  [Dst: 203.0.113.1:8080]  ──→ Router (dstnat) ──→ [Dst: 192.168.1.10:80]

User internet mengakses IP publik port 8080, tapi sebenarnya
diarahkan ke web server internal di 192.168.1.10 port 80.

Konfigurasi Firewall & NAT

1. MikroTik RouterOS — Firewall Filter

Template Firewall Input (Hardening Router)

/ip firewall filter

# ============================================
# CHAIN: INPUT — Proteksi router itu sendiri
# ============================================

# 1. Accept established & related (WAJIB di atas)
add chain=input action=accept connection-state=established,related \
    comment="Accept established & related"

# 2. Drop invalid
add chain=input action=drop connection-state=invalid \
    comment="Drop invalid packets"

# 3. Accept ICMP (ping) — tapi rate limit
add chain=input action=accept protocol=icmp \
    icmp-options=8:0 limit=5,10:packet \
    comment="Accept ping (rate limited 5pps)"

# 4. Accept dari jaringan lokal (LAN)
add chain=input action=accept in-interface=bridge-lan \
    comment="Accept all from LAN"

# 5. Accept Winbox dari LAN saja
add chain=input action=accept protocol=tcp dst-port=8291 \
    in-interface=bridge-lan \
    comment="Winbox from LAN only"

# 6. Accept SSH dari LAN saja (+ rate limit brute force)
add chain=input action=accept protocol=tcp dst-port=22 \
    in-interface=bridge-lan connection-state=new \
    comment="SSH from LAN only"

# 7. Accept DNS dari LAN (jika router = DNS server)
add chain=input action=accept protocol=udp dst-port=53 \
    in-interface=bridge-lan \
    comment="DNS from LAN"
add chain=input action=accept protocol=tcp dst-port=53 \
    in-interface=bridge-lan \
    comment="DNS TCP from LAN"

# 8. Drop semua input dari WAN
add chain=input action=drop in-interface=ether1-wan \
    comment="DROP all input from WAN"

# ============================================
# CHAIN: FORWARD — Traffic yang melewati router
# ============================================

# 1. Accept established & related
add chain=forward action=accept connection-state=established,related \
    comment="Accept established & related"

# 2. Drop invalid
add chain=forward action=drop connection-state=invalid \
    comment="Drop invalid forward"

# 3. Accept dari LAN ke internet
add chain=forward action=accept in-interface=bridge-lan \
    out-interface=ether1-wan connection-state=new \
    comment="LAN to WAN"

# 4. Drop forward dari WAN ke LAN (kecuali dstnat)
add chain=forward action=drop in-interface=ether1-wan \
    connection-state=new connection-nat-state=!dstnat \
    comment="Drop WAN to LAN (except port forward)"

# 5. Drop sisanya
add chain=forward action=drop \
    comment="Drop everything else"

Template NAT

/ip firewall nat

# ============================================
# SOURCE NAT — LAN ke Internet
# ============================================

# Jika IP WAN dinamis (DHCP/PPPoE):
add chain=srcnat action=masquerade out-interface=ether1-wan \
    comment="Masquerade LAN to WAN"

# Jika IP WAN statik (lebih efisien):
# add chain=srcnat action=src-nat to-addresses=203.0.113.1 \
#     out-interface=ether1-wan \
#     comment="SNAT LAN to WAN (static IP)"

# ============================================
# DESTINATION NAT — Port Forwarding
# ============================================

# Web server internal
add chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=80 \
    protocol=tcp dst-port=8080 in-interface=ether1-wan \
    comment="Port Forward: 8080 → Web Server :80"

# CCTV / DVR
add chain=dstnat action=dst-nat to-addresses=192.168.1.50 to-ports=554 \
    protocol=tcp dst-port=554 in-interface=ether1-wan \
    comment="Port Forward: RTSP CCTV"

Mangle & Address List

# ============================================
# ADDRESS LIST — Grupkan IP untuk rule
# ============================================

# Daftar IP yang boleh akses SSH dari WAN
/ip firewall address-list
add list=ssh-allowed address=10.0.0.0/8 comment="NOC network"
add list=ssh-allowed address=192.168.88.0/24 comment="Management VLAN"

# Blacklist otomatis: brute force SSH
/ip firewall filter
add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh-blacklist action=drop \
    comment="Drop SSH brute force"

add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh-stage3 action=add-src-to-address-list \
    address-list=ssh-blacklist address-list-timeout=1d \
    comment="SSH blacklist after 3 attempts"

add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh-stage2 action=add-src-to-address-list \
    address-list=ssh-stage3 address-list-timeout=1m \
    comment="SSH stage 3"

add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh-stage1 action=add-src-to-address-list \
    address-list=ssh-stage2 address-list-timeout=1m \
    comment="SSH stage 2"

add chain=input protocol=tcp dst-port=22 connection-state=new \
    action=add-src-to-address-list \
    address-list=ssh-stage1 address-list-timeout=1m \
    comment="SSH stage 1"

# ============================================
# MANGLE — Marking untuk QoS / Routing
# ============================================

/ip firewall mangle

# Mark connection dari LAN
add chain=prerouting action=mark-connection new-connection-mark=lan-conn \
    src-address=192.168.1.0/24 connection-state=new passthrough=yes \
    comment="Mark LAN connections"

# Mark packet untuk QoS
add chain=prerouting action=mark-packet new-packet-mark=lan-traffic \
    connection-mark=lan-conn passthrough=no \
    comment="Mark LAN packets for QoS"

# MSS Clamping (wajib untuk PPPoE/tunnel)
add chain=forward action=change-mss protocol=tcp tcp-flags=syn \
    new-mss=clamp-to-pmtu passthrough=yes \
    comment="MSS Clamp to PMTU"

2. Cisco (ACL & NAT) — Referensi

! =============================================
! Extended ACL - Filter traffic
! =============================================
ip access-list extended LAN-TO-WAN
  permit tcp 192.168.1.0 0.0.0.255 any eq 80
  permit tcp 192.168.1.0 0.0.0.255 any eq 443
  permit udp 192.168.1.0 0.0.0.255 any eq 53
  permit icmp 192.168.1.0 0.0.0.255 any echo
  deny ip any any log

! Apply ke interface
interface GigabitEthernet0/1
  ip access-group LAN-TO-WAN in

! =============================================
! NAT - Source NAT (PAT/Overload)
! =============================================
ip nat inside source list NAT-LIST interface GigabitEthernet0/0 overload

ip access-list standard NAT-LIST
  permit 192.168.1.0 0.0.0.255

interface GigabitEthernet0/0
  ip nat outside
interface GigabitEthernet0/1
  ip nat inside

! =============================================
! NAT - Port Forwarding (Static NAT)
! =============================================
ip nat inside source static tcp 192.168.1.10 80 203.0.113.1 8080

! =============================================
! Verifikasi
! =============================================
show access-lists
show ip nat translations
show ip nat statistics

3. Juniper JunOS — Filter & NAT Referensi

# =============================================
# Firewall Filter - Proteksi RE (Routing Engine)
# =============================================
set firewall filter PROTECT-RE term accept-established from established
set firewall filter PROTECT-RE term accept-established then accept

set firewall filter PROTECT-RE term accept-icmp from protocol icmp
set firewall filter PROTECT-RE term accept-icmp from icmp-type echo-request
set firewall filter PROTECT-RE term accept-icmp then policer icmp-policer
set firewall filter PROTECT-RE term accept-icmp then accept

set firewall filter PROTECT-RE term accept-ssh from source-prefix-list mgmt-nets
set firewall filter PROTECT-RE term accept-ssh from protocol tcp
set firewall filter PROTECT-RE term accept-ssh from destination-port ssh
set firewall filter PROTECT-RE term accept-ssh then accept

set firewall filter PROTECT-RE term accept-bgp from protocol tcp
set firewall filter PROTECT-RE term accept-bgp from destination-port bgp
set firewall filter PROTECT-RE term accept-bgp then accept

set firewall filter PROTECT-RE term default-deny then discard
set firewall filter PROTECT-RE term default-deny then count denied-packets

# Apply ke loopback
set interfaces lo0 unit 0 family inet filter input PROTECT-RE

# =============================================
# Source NAT
# =============================================
set security nat source rule-set LAN-TO-WAN from zone trust
set security nat source rule-set LAN-TO-WAN to zone untrust
set security nat source rule-set LAN-TO-WAN rule snat-rule match source-address 192.168.1.0/24
set security nat source rule-set LAN-TO-WAN rule snat-rule then source-nat interface

# =============================================
# Destination NAT (Port Forward)
# =============================================
set security nat destination rule-set WAN-TO-LAN from zone untrust
set security nat destination rule-set WAN-TO-LAN rule web-server match destination-address 203.0.113.1/32
set security nat destination rule-set WAN-TO-LAN rule web-server match destination-port 8080
set security nat destination rule-set WAN-TO-LAN rule web-server then destination-nat pool web-pool

set security nat destination pool web-pool address 192.168.1.10/32 port 80

Urutan Rule: Kenapa Posisi Penting?

Firewall memproses rule dari atas ke bawah (first match wins). Urutan yang salah bisa membuat rule tidak bekerja atau malah membuka celah keamanan.

Urutan yang Direkomendasikan

Chain INPUT:
  1. ✅ Accept established, related
  2. ❌ Drop invalid
  3. ✅ Accept ICMP (rate limited)
  4. ✅ Accept layanan dari trusted network (LAN)
  5. ✅ Accept layanan spesifik (SSH dari IP tertentu)
  6. ❌ Drop sisanya (default deny)

Chain FORWARD:
  1. ✅ Accept established, related
  2. ❌ Drop invalid
  3. ✅ Accept LAN → WAN (new)
  4. ✅ Accept port forward / dstnat
  5. ❌ Drop WAN → LAN (yang bukan dstnat)
  6. ❌ Drop sisanya

Warning: Jangan pernah meletakkan rule drop all di atas rule accept established,related. Ini akan memutus semua koneksi yang sedang berjalan, termasuk sesi SSH/Winbox kamu sendiri!

Hardening Checklist

Router (MikroTik)

# 1. Disable service yang tidak digunakan
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
# Hanya aktifkan yang dibutuhkan:
set ssh port=22 address=192.168.1.0/24
set winbox port=8291 address=192.168.1.0/24

# 2. Disable interface discovery dari WAN
/ip neighbor discovery-settings set discover-interface-list=LAN

# 3. Disable bandwidth-test server
/tool bandwidth-server set enabled=no

# 4. Disable MAC server dari WAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/tool mac-server ping set enabled=no

# 5. Strong password & disable default user
/user add name=admin-noc password="K0mpl3ks!P@55w0rd" group=full
/user remove admin

# 6. NTP & Logging
/system ntp client set enabled=yes
/system logging add topics=firewall action=memory

Checklist Universal

Item Deskripsi Priority
Default deny policy Drop semua traffic yang tidak di-allow secara eksplisit 🔴 Kritis
Limit akses management SSH/Winbox/Console hanya dari IP/subnet tertentu 🔴 Kritis
Disable unused services Matikan telnet, FTP, HTTP, API jika tidak dipakai 🔴 Kritis
Connection tracking Gunakan stateful firewall, drop invalid packets 🟡 Tinggi
Rate limit ICMP Cegah ICMP flood/DDoS 🟡 Tinggi
Anti brute-force Address-list auto-blacklist untuk SSH/Winbox 🟡 Tinggi
Logging Log dropped packets untuk forensik 🟢 Sedang
Bogon filter Drop traffic dari IP private/reserved di interface WAN 🟢 Sedang
Backup rutin Export konfigurasi secara berkala 🟢 Sedang

Anti-Spoofing & Bogon Filter

Tambahkan filter untuk memblokir traffic dari IP yang seharusnya tidak muncul di interface WAN:

/ip firewall address-list

# RFC 1918 - Private Address
add list=bogon address=0.0.0.0/8 comment="RFC 1122 - This host"
add list=bogon address=10.0.0.0/8 comment="RFC 1918 - Private"
add list=bogon address=100.64.0.0/10 comment="RFC 6598 - CGNAT"
add list=bogon address=127.0.0.0/8 comment="RFC 1122 - Loopback"
add list=bogon address=169.254.0.0/16 comment="RFC 3927 - Link Local"
add list=bogon address=172.16.0.0/12 comment="RFC 1918 - Private"
add list=bogon address=192.0.0.0/24 comment="RFC 6890 - IETF Protocol"
add list=bogon address=192.0.2.0/24 comment="RFC 5737 - Documentation"
add list=bogon address=192.168.0.0/16 comment="RFC 1918 - Private"
add list=bogon address=198.18.0.0/15 comment="RFC 2544 - Benchmark"
add list=bogon address=198.51.100.0/24 comment="RFC 5737 - Documentation"
add list=bogon address=203.0.113.0/24 comment="RFC 5737 - Documentation"
add list=bogon address=224.0.0.0/4 comment="RFC 5771 - Multicast"
add list=bogon address=240.0.0.0/4 comment="RFC 1112 - Reserved"

# Drop bogon dari WAN
/ip firewall filter
add chain=input action=drop in-interface=ether1-wan \
    src-address-list=bogon comment="Drop bogon input"
add chain=forward action=drop in-interface=ether1-wan \
    src-address-list=bogon comment="Drop bogon forward"

Troubleshooting Firewall

Teknik Debug

# 1. Cek rule mana yang match (lihat counter bytes/packets)
/ip firewall filter print stats

# 2. Tambahkan rule log sementara sebelum rule drop
add chain=forward action=log log-prefix="FW-DEBUG:" \
    src-address=192.168.1.100 comment="Temporary debug"

# 3. Cek connection tracking table
/ip firewall connection print where src-address~"192.168.1.100"

# 4. Packet sniffer
/tool sniffer
set interface=ether1-wan filter-ip-address=192.168.1.100/32
start

# 5. Torch (real-time traffic monitor)
/tool torch interface=ether1-wan src-address=192.168.1.100

Masalah Umum

Masalah Penyebab Solusi
Tidak bisa akses router setelah apply rule Rule drop di atas accept Safe Mode (Ctrl+X di terminal) atau reset via serial
Client tidak bisa browsing NAT masquerade belum di-set atau salah interface Cek srcnat rule dan out-interface
Port forward tidak bekerja Lupa allow di chain forward Tambahkan connection-nat-state=dstnat di forward
VPN client tidak bisa akses LAN Forward rule terlalu ketat Allow forward dari interface VPN ke LAN
Traffic lambat setelah banyak rule Rule tidak efisien, conntrack overhead Pindahkan established,related ke atas

Ringkasan Alur Firewall

image.png

Tip: Pahami diagram ini dengan baik. Ini adalah peta yang menjelaskan di titik mana setiap chain dan NAT bekerja. Semua konfigurasi firewall pada dasarnya adalah menempatkan rule di titik-titik yang tepat pada alur ini.