To protect your MikroTik RouterOS™, you should do following things:
[edit]
Change admin's password
Just select the Password menu within the winbox GUI, for example:
Or, type the following command in the CLI:
[admin@MikroTik] > / password
old password:
new password: ******
retype new password: ******
This will change your current admin's password to what you have entered twice. Make sure you remember the password! If you forget it, there is no recovery. You need to reinstall the router!
[edit]
Add users to the system
You should add each user that is going to log on to the router as a separate user and specify group of privileges. Add yourself as user of group full (same as for admin), for example:
You may create new groups for users with specific tasks.
[edit]
Set up packet filtering
All packets with destination to the router are processed against the ip firewall filter's input chain. Note, that the input chain does not affect packets which are being transferred through the router!
You can add following rules to the input chain under /ip firewall filter (just 'copy and paste' to the router using Terminal Console or configure the relevant arguments in WinBox):
/ ip firewall filter
add chain=input connection-state=established comment="Accept established connections"
add chain=input connection-state=related comment="Accept related connections"
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
add chain=input protocol=udp action=accept comment="UDP" disabled=no
add chain=input protocol=icmp limit=50/5s,2 comment="Allow limited pings"
add chain=input protocol=icmp action=drop comment="Drop excess pings"
add chain=input protocol=tcp dst-port=22 comment="SSH for secure shell"
add chain=input protocol=tcp dst-port=8291 comment="winbox"
# Edit these rules to reflect your actual IP addresses! #
add chain=input src-address=159.148.172.192/28 comment="From Mikrotikls network"
add chain=input src-address=10.0.0.0/8 comment="From our private LAN"
# End of Edit #
add chain=input action=log log-prefix="DROP INPUT" comment="Log everything else"
add chain=input action=drop comment="Drop everything else"
Use /ip firewall filter print input stats command to see how many packets have been processed against these rules. Use reset-counters-all command to reset the counters. Examine the system log file /log print to see the packets which have been dropped.
You may need to include additional rules to allow access from certain hosts, etc. Remember that firewall rules are processed in the order they appear on the list! After a rule matches the packet, no more rules are processed for it. After adding new rules, move them up using the move command.
Note, if you mis-configured the firewall and have locked yourselves out from the router, you may use MAC telnet from another router or workstation on the same LAN to connect to your router and correct the problem.
© Copyright 1999-2003, MikroTik
13 Maret 2008
Tingkatkan Dollar Adsense Anda dengan High Paying Keywords
Bagi anda para pemula di adsense, jika telah mengikuti langkah-langkah yang disebutkan dalam tiga artikel saya sebelumnya (adsense, niche, dan adwords), berarti sekarang anda sudah punya sebuah web atau blog yang sudah ditempelin iklan adsense. Ibarat jualan toko sudah jadi, sekarang tinggal mencari pembeli, atau traffic situs anda. Ada banyak cara untuk meningkatkan traffic, seperti dari search engine, forum, komunitas, mailing list, ezine publishing, pay per click advertising dan lain-lain. Namun sebelum mempromosikan situs anda, ada baiknya dilihat lagi tema atau niche situs anda, apakah kata kunci di situs termasuk kata kunci yang dibayar tinggi atau high paying keywords (HPK) atau tidak, agar aktivitas promosi anda tidak sia-sia dan bisa menghasilkan income yang berarti.
Catatan : Tulisan ini dalam konteks jika tipe situs anda adalah tipe marketer yang menyediakan informasi yang dibutuhkan sesuai dengan tuntutan market, bukan berdasarkan pada hobi atau keahlian anda.
High Paying Keywords (HPK) adalah kata-kata kunci yang mempunyai nilai pay per click (PPC) yang tinggi, tentu setiap adsenser ingin iklan yang muncul di situsnya mempunyai nilai PPC yang tinggi, bagaimana cara agar iklan HPK ini muncul, ya tentu saja dengan membuat situs dengan tema / niche High Paying Keyword. Berapa sih nilai keyword yang bisa disebut HPK? Itu sih relative, tapi menurut saya keyword dengan nilai PPC lebih besar dari 10 dolar per klik sudah termasuk HPK.
Untuk ilustrasi lebih jauh, contohnya sebagai berikut : Misalkan anda mempunyai dua buah situs, misalkan situs pertama dengan topic A yang mempunyai nilai PPC rata-rata 1 dolar per klik, sedangkan situs kedua dengan topic B mempunyai nilai PPC yang termasuk HPK dengan nilai 12 dolar per klik. Untuk mempromosikan situs , usaha yang anda keluarkan sama (kalaupun beda pasti tidak terlalu jauh), dan diakhir bulan hasil klik yang anda dapatkan kutang lebih sama, misalkan 100 klik untuk kedua situs. Berapa pendapatan masing-masing situs ? situs pertama dengan topic A dapat 1 dolar dikali 100, sama dengan 100 dolar, situs kedua dengan topic B yang bernilai HPK dapat 12 dolar kali 100, sama dengan 1200 dolar, jauh sekali kan bedanya?. Bisa diibaratkan seperti manajer di Indonesia dan Amerika yang bekerja di sebuah perusahaan sama, mempunyai posisi dan pekerjaan yang sama, kemampuan sama, tapi gajinya beda, karena yang di Amerika mempunyai nilai High Paying Keywords J….
Pertanyaan selanjutnya, bagaimana menemukan high paying keywords? Ini memang susah-susah gampang, untuk mengetahuinya anda perlu melakukan trial di Google Adwords ( lihat artikel adwords sebelumnya untuk mengetahui cara membuat account), masukkan satu keyword dan cek berapa PPC-nya., dari pengalaman, kata-kata yang termasuk HPK adalah keyword di bidang keuangan seperti insurance, loan dan frasa-frasanya ( auto insurance, home loan, etc, silahkan dikembangkan lagi dengan tools di adwords), atau yang berhubungan dengan internet sendiri, seperti domain name, server hosting, pay per click, search engine marketing dan sejenisnya.
OK, sekarang jika anda sudah menemukan keyword yang bernilai HPK, sebelum mengimplementasikannya, ada satu test atau pengecekan lagi yang perlu dilakukan, yaitu apakah iklan yang ditampilkan relevan dengan HPK yang anda bidik?. Ini sanagt perlu, karena meskipun situs anda mempunyatema yang sesuai dengan HPK, tetapi iklan yang kelaur tidak relevan dengan HPK, ya sama saja sia-sia. Sebagai contoh coba bandingkan dua website berikut http://ppcsem.blogspot.com/ dan http://insurance-guide.blogspot.com/ . Kedua situs tersebut mempunyai High Paying Keywords, yang pertama situs dengan topic pay per click dan search engine marketing, yang kedua tentang insurance. Coba perhatikan iklan yang keluar dari situs diatas. Yang pertama , iklan Ads by Google yang ditampilkan sejalan atau relevan dengan isi website , artinya isi situs berhasil mencapai target, sedangkan yang kedua kurang sejalan atau ada yang tidak relevan, , padahal umur situs http://ppcsem.blogspot.com/ lebih pendek dari http://insurance-guide.blogspot.com/ ,dan artikelnya lebih sedikit, kenapa situs yang kedua tidak menghasilkan iklan yang relevan? Karena keywords insurance meskipun termasuk HPK, dia tidak bernilai global, maksudnya para pengiklan insurance hanya mau iklannya muncul di Negara tertentu saja, misalkan amerika atau eropa, tidak di seluruh dunia, karena kebutuhan untuk produk insurance belum merata secara global. Sedangkan untuk keyword pay per click, merupakan HPK yang bernilai global, dan targetnya bisa berlaku di seluruh dunia.
Jadi, kesimpulannya, jika situs anda bertipe marketer penyedia informasi, pilihlah topic yang mempunyai High Paying Keyword, setelah mendapatkan HPK, lakukan tes dan seleksi, pilih HPK yang bernilai global, sehingga iklan yang keluar di situs anda juga bernilai tinggi.
Selamat mencoba . Semoga Sukses.
Author: adehendra Published: 4th May 2007
Catatan : Tulisan ini dalam konteks jika tipe situs anda adalah tipe marketer yang menyediakan informasi yang dibutuhkan sesuai dengan tuntutan market, bukan berdasarkan pada hobi atau keahlian anda.
High Paying Keywords (HPK) adalah kata-kata kunci yang mempunyai nilai pay per click (PPC) yang tinggi, tentu setiap adsenser ingin iklan yang muncul di situsnya mempunyai nilai PPC yang tinggi, bagaimana cara agar iklan HPK ini muncul, ya tentu saja dengan membuat situs dengan tema / niche High Paying Keyword. Berapa sih nilai keyword yang bisa disebut HPK? Itu sih relative, tapi menurut saya keyword dengan nilai PPC lebih besar dari 10 dolar per klik sudah termasuk HPK.
Untuk ilustrasi lebih jauh, contohnya sebagai berikut : Misalkan anda mempunyai dua buah situs, misalkan situs pertama dengan topic A yang mempunyai nilai PPC rata-rata 1 dolar per klik, sedangkan situs kedua dengan topic B mempunyai nilai PPC yang termasuk HPK dengan nilai 12 dolar per klik. Untuk mempromosikan situs , usaha yang anda keluarkan sama (kalaupun beda pasti tidak terlalu jauh), dan diakhir bulan hasil klik yang anda dapatkan kutang lebih sama, misalkan 100 klik untuk kedua situs. Berapa pendapatan masing-masing situs ? situs pertama dengan topic A dapat 1 dolar dikali 100, sama dengan 100 dolar, situs kedua dengan topic B yang bernilai HPK dapat 12 dolar kali 100, sama dengan 1200 dolar, jauh sekali kan bedanya?. Bisa diibaratkan seperti manajer di Indonesia dan Amerika yang bekerja di sebuah perusahaan sama, mempunyai posisi dan pekerjaan yang sama, kemampuan sama, tapi gajinya beda, karena yang di Amerika mempunyai nilai High Paying Keywords J….
Pertanyaan selanjutnya, bagaimana menemukan high paying keywords? Ini memang susah-susah gampang, untuk mengetahuinya anda perlu melakukan trial di Google Adwords ( lihat artikel adwords sebelumnya untuk mengetahui cara membuat account), masukkan satu keyword dan cek berapa PPC-nya., dari pengalaman, kata-kata yang termasuk HPK adalah keyword di bidang keuangan seperti insurance, loan dan frasa-frasanya ( auto insurance, home loan, etc, silahkan dikembangkan lagi dengan tools di adwords), atau yang berhubungan dengan internet sendiri, seperti domain name, server hosting, pay per click, search engine marketing dan sejenisnya.
OK, sekarang jika anda sudah menemukan keyword yang bernilai HPK, sebelum mengimplementasikannya, ada satu test atau pengecekan lagi yang perlu dilakukan, yaitu apakah iklan yang ditampilkan relevan dengan HPK yang anda bidik?. Ini sanagt perlu, karena meskipun situs anda mempunyatema yang sesuai dengan HPK, tetapi iklan yang kelaur tidak relevan dengan HPK, ya sama saja sia-sia. Sebagai contoh coba bandingkan dua website berikut http://ppcsem.blogspot.com/ dan http://insurance-guide.blogspot.com/ . Kedua situs tersebut mempunyai High Paying Keywords, yang pertama situs dengan topic pay per click dan search engine marketing, yang kedua tentang insurance. Coba perhatikan iklan yang keluar dari situs diatas. Yang pertama , iklan Ads by Google yang ditampilkan sejalan atau relevan dengan isi website , artinya isi situs berhasil mencapai target, sedangkan yang kedua kurang sejalan atau ada yang tidak relevan, , padahal umur situs http://ppcsem.blogspot.com/ lebih pendek dari http://insurance-guide.blogspot.com/ ,dan artikelnya lebih sedikit, kenapa situs yang kedua tidak menghasilkan iklan yang relevan? Karena keywords insurance meskipun termasuk HPK, dia tidak bernilai global, maksudnya para pengiklan insurance hanya mau iklannya muncul di Negara tertentu saja, misalkan amerika atau eropa, tidak di seluruh dunia, karena kebutuhan untuk produk insurance belum merata secara global. Sedangkan untuk keyword pay per click, merupakan HPK yang bernilai global, dan targetnya bisa berlaku di seluruh dunia.
Jadi, kesimpulannya, jika situs anda bertipe marketer penyedia informasi, pilihlah topic yang mempunyai High Paying Keyword, setelah mendapatkan HPK, lakukan tes dan seleksi, pilih HPK yang bernilai global, sehingga iklan yang keluar di situs anda juga bernilai tinggi.
Selamat mencoba . Semoga Sukses.
Author: adehendra Published: 4th May 2007
Simple Queue, Memisah Bandwidth Lokal dan Internasional
Selama mengelola Mikrotik Indonesia, banyak sekali muncul pertanyaan bagaimana cara melakukan pemisahan queue untuk trafik internet internasional dan trafik ke internet Indonesia (OpenIXP dan IIX). Di internet sebetulnya sudah ada beberapa website yang menampilkan cara pemisahan ini, tapi kami akan coba menampilkan kembali sesederhana mungkin supaya mudah diikuti.
Pada artikel ini, kami mengasumsikan bahwa:
1. Router Mikrotik melakukan Masquerading / src-nat untuk client. Client menggunakan IP privat.
2. Gateway yang digunakan hanya satu, baik untuk trafik internasional maupun IIX.
3. Anda bisa menggunakan web-proxy internal ataupun tanpa web-proxy. Jika Anda menggunakan web-proxy, maka ada beberapa tambahan rule yang perlu dilakukan. Perhatikan bagian NAT dan MANGLE pada contoh di bawah ini.
Jika ada parameter di atas yang berbeda dengan kondisi Anda di lapangan, maka konfigurasi yang ada di artikel ini harus Anda modifikasi sesuai dengan konfigurasi network Anda.
Pengaturan Dasar
Berikut ini adalah diagram network dan asumsi IP Address yang akan digunakan dalam contoh ini.
Untuk mempermudah pemberian contoh, kami mengupdate nama masing-masing interface sesuai dengan tugasnya masing-masing.
[admin@MikroTik] > /interface pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R ether-public ether 0 0 1500
1 R ether-local ether 0 0 1500
Untuk klien, akan menggunakan blok IP 192.168.0.0/24, dan IP Address 192.168.0.1 difungsikan sebagai gateway dan dipasang pada router, interface ether-local. Klien dapat menggunakan IP Address 192.168.0-2 hingga 192.168.0.254 dengan subnet mask 255.255.255.0.
[admin@MikroTik] > /ip ad pr
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 202.0.0.1/24 202.0.0.0 202.0.0.255 ether-public
1 192.168.0.1/24 192.168.0.0 192.168.0.255 ether-local
Jangan lupa melakukan konfigurasi DNS server pada router, dan mengaktifkan fitur "allow remote request".
Karena klien menggunakan IP private, maka kita harus melakukan fungsi src-nat seperti contoh berikut.
[admin@MikroTik] > /ip fi nat pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=ether-public
action=masquerade
Jika Anda menggunakan web-proxy transparan, Anda perlu menambahkan rule nat redirect, seperti terlihat pada contoh di bawah ini (rule tambahan yang tercetak tebal).
[admin@MikroTik] > /ip fi nat pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=ether-public
action=masquerade
1 chain=dstnat in-interface=ether-local protocol=tcp
dst-port=80 action=redirect to-ports=8080
Jangan lupa mengaktifkan fitur web-proxy, dan men-set port layanan web-proxynya, dan disesuaikan dengan port redirect pada contoh di atas.
CEK: Pastikan semua konfigurasi telah berfungsi baik. Lakukanlah ping (baik dari router maupun dari klien) ke luar network Anda secara bergantian.
Pengaturan IP Address List
Mulai Mikrotik RouterOS versi 2.9, dikenal dengan fitur yang disebut IP Address List. Fitur ini adalah pengelompokan IP Address tertentu dan setiap IP Address tersebut bisa kita namai. Kelompok ini bisa digunakan sebagai parameter dalam mangle, firewall filter, nat, ataupun queue.
Mikrotik Indonesia telah menyediakan daftar IP Address yang diadvertise di OpenIXP dan IIX, yang bisa didownload dengan bebas di URL: http://www.mikrotik.co.id/getfile.php?nf=nice.rsc
File nice.rsc ini dibuat secara otomatis di server Mikrotik Indonesia setiap pagi sekitar pk 05.30, dan merupakan data yang telah di optimasi untuk menghilangkan duplikat entry dan tumpang tindih subnet. Saat ini jumlah baris pada script tersebut berkisar 430 baris.
Contoh isi file nice.rsc :
# Script created by: Valens Riyadi @ www.mikrotik.co.id
# Generated at 26 April 2007 05:30:02 WIB ... 431 lines
/ip firewall address-list
add list=nice address="1.2.3.4"
rem [find list=nice]
add list=nice address="125.162.0.0/16"
add list=nice address="125.163.0.0/16"
add list=nice address="152.118.0.0/16"
add list=nice address="125.160.0.0/16"
add list=nice address="125.161.0.0/16"
add list=nice address="125.164.0.0/16"
.
.
dst...
Simpanlah file tersebut ke komputer Anda dengan nama nice.rsc, lalu lakukan FTP ke router Mikrotik, dan uploadlah file tersebut di router. Contoh di bawah ini adalah proses upload menggunakan MS-DOS prompt.
C:\>dir nice.*
Volume in drive C has no label.
Volume Serial Number is 5418-6EEF
Directory of C:\
04/26/2007 06:42p 17,523 nice.rsc
1 File(s) 17,523 bytes
0 Dir(s) 47,038,779,392 bytes free
C:\>ftp 192.168.0.1
Connected to 192.168.0.1.
220 R&D FTP server (MikroTik 2.9.39) ready
User (192.168.0.1:(none)): admin
331 Password required for admin
Password: ********
230 User admin logged in
ftp> ascii
200 Type set to A
ftp> put nice.rsc
200 PORT command successful
150 Opening ASCII mode data connection for '/nice.rsc'
226 ASCII transfer complete
ftp: 17523 bytes sent in 0.00Seconds 17523000.00Kbytes/sec.
ftp> bye
221 Closing
C:\>
Setelah file diupload, import-lah file tersebut.
[admin@MikroTik] > import nice.rsc
Opening script file nice.rsc
Script file loaded and executed successfully
Pastikan bahwa proses import telah berlangsung dengan sukses, dengan mengecek Address-List pada Menu IP - Firewall
Proses upload ini dapat juga dilakukan secara otomatis jika Anda memiliki pengetahuan scripting. Misalnya Anda membuat shell script pada Linux untuk melakukan download secara otomatis dan mengupload file secara otomatis setiap pk 06.00 pagi. Kemudian Anda tinggal membuat scheduler pada router untuk melakukan import file.
Pengaturan Mangle
Langkah selanjutnya adalah membuat mangle. Kita perlu membuat 1 buah connection mark dan 2 buah packet mark, masing-masing untuk trafik internasional dan lokal.
[admin@MikroTik] > /ip firewall mangle pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting in-interface=ether-local
dst-address-list=nice
action=mark-connection new-connection-mark=conn-iix
passthrough=yes
1 chain=prerouting connection-mark=conn-iix
action=mark-packet new-packet-mark=packet-iix
passthrough=no
2 chain=prerouting action=mark-packet
new-packet-mark=packet-intl passthrough=no
Untuk rule #0, pastikanlah bahwa Anda memilih interface yang mengarah ke client. Untuk chain, kita menggunakan prerouting, dan untuk kedua packet-mark, kita menggunakan passthrough=no.
Jika Anda menggunakan web-proxy internal dan melakukan redirecting trafic, maka Anda membuat 2 buah rule tambahan seperti contoh di bawah ini (rule tambahan yang tercetak tebal).
[admin@MikroTik] > /ip firewall mangle pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting in-interface=ether-local
dst-address-list=nice
action=mark-connection new-connection-mark=conn-iix
passthrough=yes
1 chain=prerouting connection-mark=conn-iix
action=mark-packet new-packet-mark=packet-iix
passthrough=no
2 chain=output connection-mark=conn-iix
action=mark-packet new-packet-mark=packet-iix
passthrough=no
3 chain=prerouting action=mark-packet
new-packet-mark=packet-intl passthrough=no
4 chain=output action=mark-packet
new-packet-mark=packet-intl passthrough=no
Pengaturan Simple Queue
Untuk setiap client, kita harus membuat 2 buah rule simple queue. Pada contoh berikut ini, kita akan melakukan limitasi untuk IP client 192.168.0.2/32, dan kita akan memberikan limitasi iix (up/down) sebesar 64k/256k, dan untuk internasional sebesar (up/down) 32k/128k.
[admin@MikroTik]> /queue simple pr
Flags: X - disabled, I - invalid, D - dynamic
0 name="client02-iix" target-addresses=192.168.0.2/32
dst-address=0.0.0.0/0 interface=all parent=none
packet-marks=packet-iix direction=both priority=8
queue=default-small/default-small limit-at=0/0
max-limit=64000/256000 total-queue=default-small
1 name="client02-intl" target-addresses=192.168.0.2/32
dst-address=0.0.0.0/0 interface=all parent=none
packet-marks=packet-intl direction=both priority=8
queue=default-small/default-small limit-at=0/0
max-limit=32000/128000 total-queue=default-small
Pengecekan Akhir
Setelah selesai, lakukanlah pengecekan dengan melakukan akses ke situs lokal maupun ke situs internasional, dan perhatikanlah counter baik pada firewall mangle maupun pada simple queue.
Anda juga dapat mengembangkan queue type menggunakan pcq sehingga trafik pada setiap client dapat tersebar secara merata.
Queue dengan SRC-NAT dan WEB-PROXY
Pada penggunaan queue (bandwidth limiter), penentuan CHAIN pada MENGLE sangat menentukan jalannya sebuah rule. Jika kita memasang SRC-NAT dan WEB-PROXY pada mesin yang sama, sering kali agak sulit untuk membuat rule QUEUE yang sempurna. Penjelasan detail mengenai pemilihan CHAIN, dapat dilihat pada manual Mikrotik di sini.
Percobaan yang dilakukan menggunakan sebuah PC dengan Mikrotik RouterOS versi 2.9.28. Pada mesin tersebut, digunakan 2 buah interface, satu untuk gateway yang dinamai PUBLIC dan satu lagi untuk jaringan lokal yang dinamai LAN.
Pada artikel ini, kami mengasumsikan bahwa:
1. Router Mikrotik melakukan Masquerading / src-nat untuk client. Client menggunakan IP privat.
2. Gateway yang digunakan hanya satu, baik untuk trafik internasional maupun IIX.
3. Anda bisa menggunakan web-proxy internal ataupun tanpa web-proxy. Jika Anda menggunakan web-proxy, maka ada beberapa tambahan rule yang perlu dilakukan. Perhatikan bagian NAT dan MANGLE pada contoh di bawah ini.
Jika ada parameter di atas yang berbeda dengan kondisi Anda di lapangan, maka konfigurasi yang ada di artikel ini harus Anda modifikasi sesuai dengan konfigurasi network Anda.
Pengaturan Dasar
Berikut ini adalah diagram network dan asumsi IP Address yang akan digunakan dalam contoh ini.
Untuk mempermudah pemberian contoh, kami mengupdate nama masing-masing interface sesuai dengan tugasnya masing-masing.
[admin@MikroTik] > /interface pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R ether-public ether 0 0 1500
1 R ether-local ether 0 0 1500
Untuk klien, akan menggunakan blok IP 192.168.0.0/24, dan IP Address 192.168.0.1 difungsikan sebagai gateway dan dipasang pada router, interface ether-local. Klien dapat menggunakan IP Address 192.168.0-2 hingga 192.168.0.254 dengan subnet mask 255.255.255.0.
[admin@MikroTik] > /ip ad pr
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 202.0.0.1/24 202.0.0.0 202.0.0.255 ether-public
1 192.168.0.1/24 192.168.0.0 192.168.0.255 ether-local
Jangan lupa melakukan konfigurasi DNS server pada router, dan mengaktifkan fitur "allow remote request".
Karena klien menggunakan IP private, maka kita harus melakukan fungsi src-nat seperti contoh berikut.
[admin@MikroTik] > /ip fi nat pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=ether-public
action=masquerade
Jika Anda menggunakan web-proxy transparan, Anda perlu menambahkan rule nat redirect, seperti terlihat pada contoh di bawah ini (rule tambahan yang tercetak tebal).
[admin@MikroTik] > /ip fi nat pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=ether-public
action=masquerade
1 chain=dstnat in-interface=ether-local protocol=tcp
dst-port=80 action=redirect to-ports=8080
Jangan lupa mengaktifkan fitur web-proxy, dan men-set port layanan web-proxynya, dan disesuaikan dengan port redirect pada contoh di atas.
CEK: Pastikan semua konfigurasi telah berfungsi baik. Lakukanlah ping (baik dari router maupun dari klien) ke luar network Anda secara bergantian.
Pengaturan IP Address List
Mulai Mikrotik RouterOS versi 2.9, dikenal dengan fitur yang disebut IP Address List. Fitur ini adalah pengelompokan IP Address tertentu dan setiap IP Address tersebut bisa kita namai. Kelompok ini bisa digunakan sebagai parameter dalam mangle, firewall filter, nat, ataupun queue.
Mikrotik Indonesia telah menyediakan daftar IP Address yang diadvertise di OpenIXP dan IIX, yang bisa didownload dengan bebas di URL: http://www.mikrotik.co.id/getfile.php?nf=nice.rsc
File nice.rsc ini dibuat secara otomatis di server Mikrotik Indonesia setiap pagi sekitar pk 05.30, dan merupakan data yang telah di optimasi untuk menghilangkan duplikat entry dan tumpang tindih subnet. Saat ini jumlah baris pada script tersebut berkisar 430 baris.
Contoh isi file nice.rsc :
# Script created by: Valens Riyadi @ www.mikrotik.co.id
# Generated at 26 April 2007 05:30:02 WIB ... 431 lines
/ip firewall address-list
add list=nice address="1.2.3.4"
rem [find list=nice]
add list=nice address="125.162.0.0/16"
add list=nice address="125.163.0.0/16"
add list=nice address="152.118.0.0/16"
add list=nice address="125.160.0.0/16"
add list=nice address="125.161.0.0/16"
add list=nice address="125.164.0.0/16"
.
.
dst...
Simpanlah file tersebut ke komputer Anda dengan nama nice.rsc, lalu lakukan FTP ke router Mikrotik, dan uploadlah file tersebut di router. Contoh di bawah ini adalah proses upload menggunakan MS-DOS prompt.
C:\>dir nice.*
Volume in drive C has no label.
Volume Serial Number is 5418-6EEF
Directory of C:\
04/26/2007 06:42p 17,523 nice.rsc
1 File(s) 17,523 bytes
0 Dir(s) 47,038,779,392 bytes free
C:\>ftp 192.168.0.1
Connected to 192.168.0.1.
220 R&D FTP server (MikroTik 2.9.39) ready
User (192.168.0.1:(none)): admin
331 Password required for admin
Password: ********
230 User admin logged in
ftp> ascii
200 Type set to A
ftp> put nice.rsc
200 PORT command successful
150 Opening ASCII mode data connection for '/nice.rsc'
226 ASCII transfer complete
ftp: 17523 bytes sent in 0.00Seconds 17523000.00Kbytes/sec.
ftp> bye
221 Closing
C:\>
Setelah file diupload, import-lah file tersebut.
[admin@MikroTik] > import nice.rsc
Opening script file nice.rsc
Script file loaded and executed successfully
Pastikan bahwa proses import telah berlangsung dengan sukses, dengan mengecek Address-List pada Menu IP - Firewall
Proses upload ini dapat juga dilakukan secara otomatis jika Anda memiliki pengetahuan scripting. Misalnya Anda membuat shell script pada Linux untuk melakukan download secara otomatis dan mengupload file secara otomatis setiap pk 06.00 pagi. Kemudian Anda tinggal membuat scheduler pada router untuk melakukan import file.
Pengaturan Mangle
Langkah selanjutnya adalah membuat mangle. Kita perlu membuat 1 buah connection mark dan 2 buah packet mark, masing-masing untuk trafik internasional dan lokal.
[admin@MikroTik] > /ip firewall mangle pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting in-interface=ether-local
dst-address-list=nice
action=mark-connection new-connection-mark=conn-iix
passthrough=yes
1 chain=prerouting connection-mark=conn-iix
action=mark-packet new-packet-mark=packet-iix
passthrough=no
2 chain=prerouting action=mark-packet
new-packet-mark=packet-intl passthrough=no
Untuk rule #0, pastikanlah bahwa Anda memilih interface yang mengarah ke client. Untuk chain, kita menggunakan prerouting, dan untuk kedua packet-mark, kita menggunakan passthrough=no.
Jika Anda menggunakan web-proxy internal dan melakukan redirecting trafic, maka Anda membuat 2 buah rule tambahan seperti contoh di bawah ini (rule tambahan yang tercetak tebal).
[admin@MikroTik] > /ip firewall mangle pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting in-interface=ether-local
dst-address-list=nice
action=mark-connection new-connection-mark=conn-iix
passthrough=yes
1 chain=prerouting connection-mark=conn-iix
action=mark-packet new-packet-mark=packet-iix
passthrough=no
2 chain=output connection-mark=conn-iix
action=mark-packet new-packet-mark=packet-iix
passthrough=no
3 chain=prerouting action=mark-packet
new-packet-mark=packet-intl passthrough=no
4 chain=output action=mark-packet
new-packet-mark=packet-intl passthrough=no
Pengaturan Simple Queue
Untuk setiap client, kita harus membuat 2 buah rule simple queue. Pada contoh berikut ini, kita akan melakukan limitasi untuk IP client 192.168.0.2/32, dan kita akan memberikan limitasi iix (up/down) sebesar 64k/256k, dan untuk internasional sebesar (up/down) 32k/128k.
[admin@MikroTik]> /queue simple pr
Flags: X - disabled, I - invalid, D - dynamic
0 name="client02-iix" target-addresses=192.168.0.2/32
dst-address=0.0.0.0/0 interface=all parent=none
packet-marks=packet-iix direction=both priority=8
queue=default-small/default-small limit-at=0/0
max-limit=64000/256000 total-queue=default-small
1 name="client02-intl" target-addresses=192.168.0.2/32
dst-address=0.0.0.0/0 interface=all parent=none
packet-marks=packet-intl direction=both priority=8
queue=default-small/default-small limit-at=0/0
max-limit=32000/128000 total-queue=default-small
Pengecekan Akhir
Setelah selesai, lakukanlah pengecekan dengan melakukan akses ke situs lokal maupun ke situs internasional, dan perhatikanlah counter baik pada firewall mangle maupun pada simple queue.
Anda juga dapat mengembangkan queue type menggunakan pcq sehingga trafik pada setiap client dapat tersebar secara merata.
Queue dengan SRC-NAT dan WEB-PROXY
Pada penggunaan queue (bandwidth limiter), penentuan CHAIN pada MENGLE sangat menentukan jalannya sebuah rule. Jika kita memasang SRC-NAT dan WEB-PROXY pada mesin yang sama, sering kali agak sulit untuk membuat rule QUEUE yang sempurna. Penjelasan detail mengenai pemilihan CHAIN, dapat dilihat pada manual Mikrotik di sini.
Percobaan yang dilakukan menggunakan sebuah PC dengan Mikrotik RouterOS versi 2.9.28. Pada mesin tersebut, digunakan 2 buah interface, satu untuk gateway yang dinamai PUBLIC dan satu lagi untuk jaringan lokal yang dinamai LAN.
[admin@instaler] > in pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R public ether 0 0 1500
1 R lan wlan 0 0 1500
Dan berikut ini adalah IP Address yang digunakan. Subnet 192.168.0.0/24 adalah subnet gateway untuk mesin ini.
[admin@instaler] > ip ad pr
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 192.168.0.217/24 192.168.0.0 192.168.0.255 public
1 172.21.1.1/24 172.21.1.0 172.21.1.255 lan
Fitur web-proxy dengan transparan juga diaktifkan.
[admin@instaler] > ip web-proxy pr
enabled: yes
src-address: 0.0.0.0
port: 3128
hostname: "proxy"
transparent-proxy: yes
parent-proxy: 0.0.0.0:0
cache-administrator: "webmaster"
max-object-size: 4096KiB
cache-drive: system
max-cache-size: none
max-ram-cache-size: unlimited
status: running
reserved-for-cache: 0KiB
reserved-for-ram-cache: 154624KiB
Fungsi MASQUERADE diaktifkan, juga satu buah rule REDIRECTING untuk membelokkan traffic HTTP menuju ke WEB-PROXY
[admin@instaler] ip firewall nat> pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=public
src-address=172.21.1.0/24 action=masquerade
1 chain=dstnat in-interface=lan src-address=172.21.1.0/24
protocol=tcp dst-port=80 action=redirect to-ports=3128
Berikut ini adalah langkah terpenting dalam proses ini, yaitu pembuatan MANGLE. Kita akan membutuhkan 2 buah PACKET-MARK. Satu untuk paket data upstream, yang pada contoh ini kita sebut test-up. Dan satu lagi untuk paket data downstream, yang pada contoh ini kita sebut test-down.
Untuk paket data upstream, proses pembuatan manglenya cukup sederhana. Kita bisa langsung melakukannya dengan 1 buah rule, cukup dengan menggunakan parameter SRC-ADDRESS dan IN-INTERFACE. Di sini kita menggunakan chain prerouting. Paket data untuk upstream ini kita namai test-up.
Namun, untuk paket data downstream, kita membutuhkan beberapa buah rule. Karena kita menggunakan translasi IP/masquerade, kita membutuhkan Connection Mark. Pada contoh ini, kita namai test-conn.
Kemudian, kita harus membuat juga 2 buah rule. Rule yang pertama, untuk paket data downstream non HTTP yang langsung dari internet (tidak melewati proxy). Kita menggunakan chain forward, karena data mengalir melalui router.
Rule yang kedua, untuk paket data yang berasal dari WEB-PROXY. Kita menggunakan chain output, karena arus data berasal dari aplikasi internal di dalam router ke mesin di luar router.
Paket data untuk downstream pada kedua rule ini kita namai test-down.
Jangan lupa, parameter passthrough hanya diaktifkan untuk connection mark saja.
[admin@instaler] > ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; UP TRAFFIC
chain=prerouting in-interface=lan
src-address=172.21.1.0/24 action=mark-packet
new-packet-mark=test-up passthrough=no
1 ;;; CONN-MARK
chain=forward src-address=172.21.1.0/24
action=mark-connection
new-connection-mark=test-conn passthrough=yes
2 ;;; DOWN-DIRECT CONNECTION
chain=forward in-interface=public
connection-mark=test-conn action=mark-packet
new-packet-mark=test-down passthrough=no
3 ;;; DOWN-VIA PROXY
chain=output out-interface=lan
dst-address=172.21.1.0/24 action=mark-packet
new-packet-mark=test-down passthrough=no
Untuk tahap terakhir, tinggal mengkonfigurasi queue. Di sini kita menggunakan queue tree. Satu buah rule untuk data dowstream, dan satu lagi untuk upstream. Yang penting di sini, adalah pemilihan parent. Untuk downstream, kita menggunakan parent lan, sesuai dengan interface yang mengarah ke jaringan lokal, dan untuk upstream, kita menggunakan parent global-in.
[admin@instaler] > queue tree pr
Flags: X - disabled, I - invalid
0 name="downstream" parent=lan packet-mark=test-down
limit-at=32000 queue=default priority=8
max-limit=32000 burst-limit=0
burst-threshold=0 burst-time=0s
1 name="upstream" parent=global-in
packet-mark=test-up limit-at=32000
queue=default priority=8
max-limit=32000 burst-limit=0
burst-threshold=0 burst-time=0s
Variasi lainnya, untuk bandwidth management, dimungkinkan juga kita menggunakan tipe queue PCQ, yang bisa secara otomatis membagi trafik per client.
© Copyright 1999-2003, MikroTik
HotSpot Gateway
Installation
The MikroTik HotSpot is included in the HotSpot package. This also requires DHCP package. Please download the hotspot-2.6.x.npk and dhcp-2.6.x.npk packages from MikroTik's web site, upload them using ftp BINARY mode to router and reboot.
Use the /system package print command to see the list of installed packages.
Software License
The Hotspot limits active user count to 4 for Demo Software License and Software Licenses without additional features enabled (i.e. Basic Software License without additional packages purchased). For unlimited number of users, any additional (wireless, synchronous) license is required. Thus, if you plan to use wireless hotspot, the license is already there.
Hardware Resource Usage
There is no significant resource usage.
How MikroTik HotSpot Gateway Works
MikroTik HotSpot Gateway should have at least two network interfaces:
HotSpot interface which is used to connect HotSpot clients;
LAN/WAN interface which is used to access network resources. For example, DNS and RADIUS server(s) should be accessible.
The diagram below shows sample HotSpot setup.
The HotSpot interface should have two IP addresses assigned to it: one as gateway for the temporary address pool prior to authentication, and second as gateway for the permanent address pool used for authenticated clients. Note, that you have to provide routing for these address pools, unless you plan to use masquerading (source NAT).
The arp feature should be set to 'reply-only' on HotSpot interface to prevent network access using static IP addresses. The DHCP server will add static ARP entries for each DHCP client.
Physical network connection has to be established between the HotSpot user's computer and the gateway. It can be wireless (the wireless card should register to AP), or wired (the NIC card should be connected to HUB).
The Initial Contact
MikroTik HotSpot Gateway's DHCP server assigns IP addresses from the temporary address pool with a very short lease time (approx. 14s), so the address can be changed after authentication.
If user tries to access network resources using web browser, the destination NAT rule redirects all TCP connection requests to HotSpot servlet (port 8080 by default). This brings up the HotSpot Welcome/Login page.
It may be useful to have port 80 for HotSpot servlet because the users might want to see status and log out. If this is impossible, you may redirect requests to a virtual IP address to the servlet.
Note that you may want to have DNS traffic enabled (or redirected to the router's DNS cache) so that the client could be logged in connecting any valid web-page (using it's DNS name). Enabling ICMP ping might be useful as well, since it shows network connectivity. Other traffic should be dropped.
The Servlet
If user is not logged in, login page will be shown (where username and password has to be entered), but if user is logged in, status page will be shown (status: username, IP address, session time, bytes and packets transferred, ...). There are 6 HTML pages that can be easily modified by creating HTML template pages and uploading them to the hotspot folder on MikroTik router. These pages are described in detailes later on.
Authentication
After client computer receives temporary IP address from HotSpot DHCP server, going to any HTTP address with web browser will be redirected to HotSpot authentication page prompting for username and password. Password together with HotSpot generated challenge string is hashed using MD5 algorithm (which in this case is implemented using JavaScript) and is executed on client's computer by web browser. After that, the hash result together with username is sent over Ethernet network to HotSpot servlet. So, password is never sent in plain text over ip network.
HotSpot can authenticate users using local user database or some RADIUS server. Which option is used is determined by /ip hotspot radius-client enabled parameter. If radius client is enabled, RADIUS authentication is used, otherwise local user authentication is done. If authentication is done locally, profile corresponding to that user is used, otherwise (in case of RADIUS) default profile is used to set default values for parameters, which are not set in RADIUS access-accept message.
If authentication by http cookie is enabled, then after each successful login cookie is sent to web browser and the same cookie is added to active HTTP cookie list. Next time when user will try to log in, web browser will send http cookie. This cookie will be compared to the one on HotSpot and only if there is the same source MAC address and the same randomly generated ID, user is automatically logged in. New cookie with different random ID is sent to web browser. Old cookie is removed from local HotSpot active cookie list. New one with new expire time is added.
Address Assignment
When user is successfully authenticated, HotSpot assigns another IP address for client (static or from some IP pool). On next clients DHCP request, the new IP address will be given by DHCP server to this client. How much time this IP address change required, depends on DHCP lease time for non authenticated users. HotSpot login-delay parameter should be set accordingly to this DHCP server lease time. If lease time is 14s, then real login-delay will be about 1..10 seconds. So, it is quite safe to set login-delay to 12s in this case.
While IP address is changed, user sees after-login (alogin.html) page. This page will automatically forward user to original destination address (or status page, if there was no original dst address) after login-delay time will pass.
Logging Out
User can log out using status page. There is a link to http://virtual_HotSpot_ip/logout Going to this page will logout user. After that logout page (logout.html) will be shown to user.
MikroTik HotSpot Gateway Setup
MikroTik HotSpot Gateway setup is under /ip hotspot submenu:
[admin@MikroTik] ip hotspot>
HotSpot management
active HotSpot active user list
user HotSpot local user list
profile HotSpot user profile management
server HotSpot DHCP profile management
radius-client RADIUS client configuration
cookie HotSpot active HTTP cookie list
print Print current configuration and status
get Get value of configuration property
set Change hotspot configuration
export Export hotspot settings
[admin@MikroTik] ip hotspot> print
hotspot-address: 0.0.0.0
status-autorefresh: 1m
auth-mac: no
auth-mac-password: no
auth-http-cookie: no
http-cookie-lifetime: 1d
These are general parameters for HotSpot:
auth-http-cookie - defines whether HTTP authentication by cookie is enabled
auth-mac - defines whether authentication by ethernet MAC address is enabled
auth-mac-password - uses MAC address as password if MAC authorization is enabled
hotspot-address - IP address for HotSpot www access
http-cookie-lifetime - validity time of HTTP cookies
status-autorefresh - WWW status page autorefresh time
HotSpot RADIUS Client Setup
Here is RADIUS client configuration. If it is disabled, users are authorized locally:
[admin@MikroTik] ip hotspot radius-client> print
enabled: no
accounting: yes
primary-server: 10.0.0.96
secondary-server: 0.0.0.0
shared-secret: "secret"
authentication-port: 1812
accounting-port: 1813
interim-update: 5m
[admin@MikroTik] ip hotspot radius-client>
All parameters are the same as for ppp (/ppp radius-client):
accounting - enable or disable RADIUS accounting
accounting-port - IP port on RADIUS server for accounting
authentication-port - IP port on RADIUS server for authentication
enabled - defines whether RADIUS client is enabled
interim-update - Interim-Update time interval
primary-server - IP address of primary RADIUS server
secondary-server - IP address of secondary RADIUS server
shared-secret - shared secret of RADIUS server
RADIUS Parameters
Authentication data sent to server (Access-Request)
NAS-Identifier router identity
NAS-Port-Type for HotSpot is Ethernet
Calling-Station-Id client MAC address (with CAPITAL letters)
Called-Station-Id Hotspot server name (from version 2.6.9)
NAS-Port-Id Hotspot server name
User-Name client login name
CHAP-Password,
CHAP-Challenge encrypted password and challenge
Data received from server (Access-Accept)
Framed-IP-Address IP address given to client. If address is 255.255.255.254,
IP pool is used from hotspot settings. If
Framed-IP-Address is specified, Framed-Pool is ignored.
Framed-Pool IP pool name (on the router) from which to get IP address
for the client
Idle-Timeout idle-timeout parameter
Session-Timeout session-timeout parameter
Framed-Route routes to add on the server. Format is specified in
RFC2865 (Ch. 5.22), can be specified as many times as needed.
Filter-Id firewall filter chain name. It is used to make dynamic
firewall rule that will jump to specified chain, if a
packet if come to or from the client. Firewall chain name
can have suffix .in or .out, that will install rule only
for incoming or outgoing traffic. Multiple filter-id can
be provided, but only last ones for incoming and outgoing is used.
Acct-Interim-Interval interim-update for RADIUS client (used only if RADIUS
client does not have local interim-update setting).
Ascend-Data-Rate tx/rx data rate limitation (for PPPoE). If multiple
attributes are provided, first limits tx data rate,
second - rx data rate. 0 if unlimited.
Mikrotik-Recv-Limit total recv limit in bytes for the client
Mikrotik-Xmit-Limit total transmit limit in bytes for the client
Framed-IP-Netmask client network netmask
Ascend-Client-Gatway client gateway
Note that the received attributes override the default ones (set in the default profile), but if an attribute is not received from RADIUS server, the default one is to be used.
Accounting information sent to server(Accounting-Request)
Acct-Status-Type Satrt, Stop, or Interim-Update
Acct-Session-Id accounting session ID
NAS-Identifier same as in request
User-Name same as in request
NAS-Port-Type same as in request
NAS-Port-Id same as in request
Calling-Station-Id same as in request (from version 2.6.9)
Called-Station-Id same as in request (from version 2.6.9)
Framed-IP-Address IP address given to the user
RADIUS attributes additionally included in Stop and Interim-Update Accounting-Request packets:
Acct-Session-Time connection uptime in seconds
Acct-Input-Octects bytes received from the client
Acct-Input-Packets packets received from the client
Acct-Output-Octets bytes sent to the client
Acct-Output-Packets packets sent to the client
Stop Accounting-Request packets can additionally have:
Acct-Terminate-Cause session termination cause (described in RFC2866 Ch. 5.10)
HotSpot Profiles
The HotSpot profiles are similar to PPP profiles:
[admin@MikroTik] ip hotspot profile> print
Flags: * - default
0 * name="default" session-timeout=0s idle-timeout=0s only-one=no
tx-bit-rate=0 incoming-filter="" outgoing-filter=""
[admin@MikroTik] ip hotspot profile>
Most of these parameters are exactly the same as for /ppp profile:
name - profile name
session-timeout - session timeout for client
idle-timeout - idle timeout for client
only-one - only one simultaneous login per user (yes, no)
tx-bit-rate - transmit bitrate. '0' means no limitation
incoming-filter - firewall chain name for incoming packets
outgoing-filter - firewall chain name for outgoing packets
Default profile will be used in case of RADIUS authentication as well. RADIUS server argument for limiting the data rate (transmited to the client) is Ascend-Data-Rate (vendor id: 529, attribute id:197).
Note that filter rules 'jumping' to the specifies firewall chain are added automatically to the hotspot firewall chain. This means that you should create hotspot chain and pass some (or all) the packets to it in order filtering to function.
HotSpot Server Settings
There can be added one server for each DHCP server. Which server profile to apply will depend on DHCP server which gave DHCP lease to that client. Actually it means that if user will log in from different interfaces, then different server profiles will be used. It allows assigning different IP addresses on different ethernet interfaces.
[admin@MikroTik] ip hotspot server> print
0 name="dhcp1" dhcp-server=hotspot_dhcp lease-time=1m login-delay=14s
address-pool=hotspot netmask=0.0.0.0 gateway=0.0.0.0
[admin@MikroTik] ip hotspot server>
Description of parameters:
address-pool - IP pool name, from which HotSpot client will get IP address if it is not given some static already
gateway - default gateway
lease-time - DHCP lease time for logged in user
login-delay - Time required to log in user
name - DHCP profile name, is sent as NAS-Port-Id by RADIUS client
netmask - network mask
dhcp-server - DHCP server with which to use this profile
HotSpot User Database
The local user database is manages in /ip hotspot user submenu:
[admin@MikroTik] ip hotspot user> print
Flags: X - disabled
# NAME PASSWORD ADDRESS PROFILE UPTIME
0 ax ex 10.0.0.3 default 29m40s
[admin@MikroTik] ip hotspot user> print detail
Flags: X - disabled
0 name="ax" password="ex" address=10.0.0.3 profile=default routes=""
limit-uptime=0s limit-bytes-in=0 limit-bytes-out=0 uptime=29m40s
bytes-in=187476 packets-in=683 bytes-out=327623 packets-out=671
[admin@MikroTik] ip hotspot user>
Parameter description:
name - user name
password - user password
address - static IP address. If not 0.0.0.0, client will get always the same IP address. It implies, that only one simultaneous login for that user is allowed
profile - user profile
routes - user routes. Usage and meaning is exactly the same as for ppp
limit-bytes-in - maximum amount of bytes user can receive
limit-bytes-out - maximum amount of bytes user can transmit
limit-uptime - total uptime limit for user (pre-paid time)
If auth-mac parameter is enabled, clients' MAC addresses (written with CAPITAL letters) can be used as usernames. If auth-mac-password is set to no, there should be no password for that users. Else, the username and the password should be equal. When client is connecting, it's MAC address is checked first. If there is a user with that MAC address, the client is authorized as this user. If there is no match, client is asked for username and password.
The RADIUS attributes for limit-bytes-in and limit-bytes-out are Mikrotik-Recv-Limit (14988, 1) and Mikrotik-Xmit-Limit (14988, 2). These limits are total limits for each user (not for each session as at /ip hotspot active). So, if user has already downloaded something, then session limit will be total limit - (minus) already downloaded. For example, if download limit for user is 100MB and user has already downloaded 30MB, then session download limit after login at /ip hotspot active will be 100MB - 30MB = 70MB.
If user will reach his limits (bytes-in >= limit-bytes-in or bytes-out >= limit-bytes-out), he will not be able to log on anymore.
All these limits (limit-uptime, limit-bytes-in, limit-bytes-out) can be used for pre-paid solutions. Probably 'quota' is a good name for such limits.
Along with these parameters, some statistics are available for each user:
[admin@MikroTik] ip hotspot user> print stats
Flags: X - disabled
# NAME UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 29m40s 187476 327623 683 671
[admin@MikroTik] ip hotspot user>
Statistics include:
uptime - total time user has been logged in
bytes-in - total bytes received from user
bytes-out - total bytes sent to user
packets-in - total packets received from user
packets-out - total packets sent to user
Note that these stats are updated each time user logs out and RADIUS accounting is disabled (or RADIUS is disabled). It means, that if user is currently logged in, then these stats will not show current total values. Use /ip hotspot active print stats to produce statistics on current user sessions.
The active user list shows the list of currently logged in users. Nothing can be changed here, except user can be removed with the remove command.
[admin@MikroTik] ip hotspot active> print
# USER ADDRESS UPTIME SESSION-TIMEOUT IDLE-TIMEOUT
0 ex 10.0.0.204 6m10s
[admin@MikroTik] ip hotspot active>
Description of the printout:
user - name of user logged in
address - IP address of logged in user
uptime - current session time (logged in time) for this IP address
session-timeout - how much time it is left for IP address until it will be automatically logged out
idle-timeout - how much idle time it is left for IP address until it will be automatically logged out
Statistics about logged in user are available too:
[admin@MikroTik] ip hotspot active> print stats
# USER UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 12m53s 1237091 1222130 4062 4241
[admin@MikroTik] ip hotspot active>
HotSpot Cookies
HotSpot Cookies can be managed within ip hotspot cookie submenu:
[admin@MikroTik] ip hotspot cookie>
HotSpot active HTTP cookie list
find Find active HTTP cookie
print Show active HTTP cookie list
remove Remove active HTTP cookie
get Get active HTTP cookie properties
[admin@MikroTik] ip hotspot cookie> print
# USER MAC-ADDRESS EXPIRES-IN
0 ex 00:30:4F:13:BF:EF 2d23h56m56s
[admin@MikroTik] ip hotspot cookie>
Cookies can be listed and removed. They can not be changed or added manually.
HotSpot Step-by-Step User Guide
Planning the Configuration
First of all, make sure you have MikroTik RouterOS 2.6.2 or higher with hotspot and dhcp packages installed. Let us consider following example HotSpot setup:
There will be 2 hotspot IP address ranges used for clients on prism1 interface. You are free to choose the address ranges, just make sure you use masquerading for not routed ones. In our example, we are using
temporary addresses which must be masqueraded:
network: 192.168.0.0/24
gateway: 192.168.0.1
pool: 192.168.0.2-192.168.0.254
real addresses which require routing:
network: 10.5.50.0/24
gateway: 10.5.50.1
pool: 10.5.50.2-10.5.50.254
Temporary addresses are given out by DHCP server (configured within /ip dhcp-server), but real addresses are given out by hotspot dhcp configuration.
For hotspot client accounting, hotspot will add dynamic firewall rules in firewall hotspot chain. This chain has to be created manually. And all network packets (to/from hotspot clients) have to pass this chain.
Setup Example
Follow the steps below:
Your ether1 interface is configured with IP address 10.5.6.5/24 and the default route points to gateway 10.5.6.1
Your prism1 interface is configured for AP mode and can register IEEE 802.11b wireless clients. See the Prism Interface Manual for more details.
ARP should be set to 'reply-only' on prism interface, so no dynamic entries are added to the ARP table. DHCP server will add entries only for clients which have obtained DHCP leases.
/interface prism set prism1 arp=reply-only
Add two IP addresses to prism1 interface:
/ip address add address=192.168.0.1/24 interface=prism1
/ip address add address=10.5.50.1/24 interface=prism1
add 2 IP pools:
/ip pool add name=temp ranges=192.168.0.2-192.168.0.254
/ip pool add name=hspot ranges=10.5.50.2-10.5.50.254
add masquerading rule for temporary IP pool, which is not routed:
/ip firewall src-nat add src-address=192.168.0.0/24 action=masquerade
Make sure you have routing for authenticated address space. Try to ping 10.5.50.1 from your internet gateway 10.5.6.1, for example. See the Basic Setup Guide on how to set up routing.
Add dhcp server (for temporary IP addresses):
/ip dhcp-server add name="hs_temp" interface=prism1 lease-time=14s \
address-pool=temp netmask=255.255.255.0 gateway=192.168.0.1 \
dns-server=159.148.60.2,159.148.108.1 domain="mt.lv" add-arp=yes disabled=no
Add hotspot server setup (for logged in IP addresses):
/ip hotspot server add name=hs_dhcp dhcp-server=hs_temp address-pool=hspot \
netmask=255.255.255.0 gateway=10.5.50.1
Add local hotspot user:
/ip hotspot user add name=ax password=ex
Setup hotspot service to run on port 80 (www service has to be assigned another port, e.g., 8081):
/ip service set www port=8081
/ip service set hotspot port=80
Note! Changing www service to other port than 80 requires thet you specify the new port when connecting to MikroTik router using WinBox, e.g., use 10.5.50.1:8081 in this case.
redirect all TCP requests from temporary IP addresses to hotspot service:
/ip firewall dst-nat add src-address=192.168.0.0/24 protocol=tcp action=redirect \
to-dst-port=80 comment="redirect unauthorized hotspot clients to hotspot service"
Allow DNS requests and ICMP ping from temporary addresses and reject everything else:
/ip firewall rule forward add src-address=192.168.0.0/24 protocol=icmp
/ip firewall rule forward add src-address=192.168.0.0/24 protocol=udp\
dst-port=53
/ip firewall rule forward add src-address=192.168.0.0/24 action=reject\
comment="reject access for unauthorized hotspot clients"
Add hotspot chain:
/ip firewall add name=hotspot
Pass all through going traffic to hotspot chain:
/ip firewall rule forward add action=jump jump-target=hotspot
If client has obtained temporary address, its lease is shown as:
[admin@HotSpot_GW] > ip dhcp-server lease print
Flags: X - disabled, D - dynamic, H - hotspot
# ADDRESS MAC-ADDRESS EXPIRES-A... SERVER STATUS
0 D 192.168.0.254 00:40:96:13:B3:47 8s hs_temp bound
[admin@HotSpot_GW] >
After successful authentication its DHCP address is changed, and it is listed under active hotspot users:
[admin@HotSpot_GW] > ip dhcp-server lease print
Flags: X - disabled, D - dynamic, H - hotspot
# ADDRESS MAC-ADDRESS EXPIRES-A... SERVER STATUS
0 DH 10.5.50.2 00:40:96:13:B3:47 56s hs_temp bound
[admin@HotSpot_GW] > ip hotspot active print
# USER ADDRESS UPTIME SESSION-TIMEOUT IDLE-TIMEOUT
0 ax 10.5.50.2 2m25s
[admin@HotSpot_GW] > /ip hotspot active print stats
# USER UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 13m26s 145268 264282 475 494
[admin@HotSpot_GW] >
User statistics show accumulated values prior to current session.
[admin@HotSpot_GW] > ip hotspot user print stats
Flags: X - disabled
# NAME UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 6m29s 9896 31156 80 77
[admin@HotSpot_GW] >
User statistics values are updated after current session is closed. Values can be reset to '0' using the reset command.
Optional Settings
You may want to use same address space both for your LAN and HotSpot networks. Please consult the IP Address and ARP Manual for proxy-arp feature.
You may want to translate the destination address of all TCP port 25 connections (SMTP) from HotSpot users to your mail sever for mail relaying. Thus, users can retain their mail client setup and use your mail server for outgoing mail without reconfiguring their mail clients. If 10.5.6.100 is your mail server accepting connections from network 10.5.50.0/24, then the required destination NAT rule would be:
/ip firewall dst-nat add src-address=10.5.50.0/24 dst-port=25 protocol=tcp\
to-dst-address=10.5.6.100 action=nat\
comment="Translate SMTP TCP 25 port to our mail server"
Another option is to allow access certain pages without authentication. This is useful, for example, to give access to some general information about HotSpot service provider or billing options. Include firewall rules into the forward chain allowing access to certain IP addresses prior the rule that rejects all other traffic from temporary addresses. Also, add rules excluding destination NAT for these addresses. For example:
1) in dst-nat: don't redirect requests going to your web server (x.x.x.x:80) (this rule has to be before "redirect to hotspot service" rule!)
/ip firewall dst-nat add dst-address=x.x.x.x/32 dst-port=80 protocol=tcp\
action=accept
2) in forward chain: accept requests going to your web server (this rule has to be before "reject access for unauthorized hotspot clients" rule!)
/ip firewall rule forward add dst-address=x.x.x.x/32 dst-port=80 protocol=tcp\
action=accept
For HotSpot clients to use transparent web-proxy on the same router, following configuration can be used:
1) make sure, web-proxy package is installed;
2) it is assumed, that HotSpot is set up and successfully running. Hotspot clients are connected on interface named 'prism1'.
3) set up web-proxy to run on port 3128 using transparent mode:
/ip web-proxy set enabled=yes address=0.0.0.0:3128 transparent-proxy=yes
4) set up HotSpot to use one of router's local IP addresses (10.5.50.1):
/ip hotspot set hotspot-address=10.5.50.1
5) redirect all requests from hotspot interface to port 80 (except to 10.5.50.1), to web-proxy:
/ip firewall dst-nat add in-interface=prism1 dst-address=!10.5.50.1/32 dst-port=80\
protocol=tcp action=redirect to-dst-port=3128 comment="transparent proxy"
Now, everything should be working. Only traffic of redirected requests to web-proxy will not be accounted. It's because this traffic will not pass through the forward chain.
6) to enable accounting for user traffic to/from transparent web-proxy, additional firewall rules should be added:
/ip firewall rule input add in-interface=prism1 dst-port=3128\
protocol=tcp action=jump jump-target=hotspot\
comment="account traffic from hotspot client to transparent web-proxy"
/ip firewall rule output add src-port=3128 protocol=tcp\
out-interface=prism1 action=jump jump-target=hotspot\
comment="account traffic from transparent web-proxy back to hotspot client"
You may want to prevent multiple logins using the same username/password. Set the argument value of 'only-one' to 'yes' in hotspot profile, for example:
/ip hotspot profile set default only-one=yes
If you have dns-cache package installed, setup local DNS cache and specify HotSpot gateway's address as primary DNS server for DHCP clients, for example:
/ip dns-cache set dns-server=159.148.60.2 enabled=yes
/ip dhcp-server set hs_temp dns-server=10.5.50.1,159.148.108.1
Customizing the Servlet
There are many possibilities to customize what the authorization servlet pages look like:
The pages are easily modifiable. They are stored on the router's FTP server in hotspot directory.
Changing the variables client is sending to the HotSpot gateway it is possible to reduce keyword count to one (username or password; the client's MAC address may be used as the other value) or even to zero (License Agreement; some predefined values general for all users or client's MAC address may be used as username and password)
Registration may occur on a different server. Client's MAC address may be passed to it, so that this information need not be written in manually. After the registration, the server may change RADIUS database enabling client to log in.
Servlet Page Description
There are 6 HTML pages to interact with hotspot client:
login.html - login page
status.html - status page for logged in user
logout.html - after_logged_out page
error.html - various error messages
redirect.html - redirecting web browser to another url
alogin.html - page, which is shown after successful login while client gets new IP address from DHCP server (for 10 seconds or so)
Variable Description
All of the pages use variables to show user specific values. For each variable there is an example included in brackets.
Common variables (available in all pages):
hostname - IP address for hotspot www access ("10.5.50.1")
link_logout - link to logout page ("http://10.5.50.1/logout")
link_login - link to login page ("http://10.5.50.1/login?dst=http://www.mt.lv/")
link_status - link to status page ("http://10.5.50.1/status")
link_orig - link to original destination page ("http://www.mt.lv/")
Page specific variables:
redirect.html:
link_redirect - page to which redirect has to be done (for example, "http://www.mt.lv/")
login.html:
mac - MAC address ("01:02:03:04:05:06")
error - error message, if previous login failed ("invalid username or password")
input_user - name and value of username input field ("name=user value=john")
input_password - name of password input field ("name=password")
input_popup - name and value of popup input field ("name=popup checked")
form_input - name of input form and JavaScript for password encoding ("name=login onSubmit=...")
main - MD5 encryption JavaScript and form for encrypted password
Note that it is required login page to use use main variable. And it is strongly suggested to place it BEFORE form_input input form. Otherwise situation can happen, that user already has entered his username/password, but MD5 encryption JavaScript is not yet loaded. It may result in password being sent over ethernet in plain text. And of course, that login will fail in this case, too.
alogin.html:
link_redirect - page to which redirect has to be done (for example, "http://www.mt.lv/")
login_time - time in seconds after which redirect has to be done ("9")
popup - true if alogin.html should pop-up status page in new window, false - otherwise
status.html, logout.html: information on logged in user
username - name ("john")
ip - IP address ("192.168.0.222")
mac - MAC address ("01:02:03:04:05:06")
uptime - logged in time ("10h2m33s")
session-timeout - session timeout left for user ("5h" or "---" if none)
session-valid-till - date and time when session will expire ("Sep/21/2002 16:12:33" or "---" if there is no session-timeout)
idle-timeout - idle timeout ("20m" or "---" if none)
bytes-in - number of bytes received from client ("15423")
bytes-out - number of bytes sent to client ("11352")
packets-in - number of packets received from client ("251")
packets-out - number of packets sent to client ("211")
status.html:
refresh_time - time in seconds after which to automatically refresh status page
refresh_time_str - more friendly representation of refresh_time
error.html:
error - error message ("DHCP lease not found")
To insert variable in some place in HTML file, variable name surrounded by % symbols is used. For example, to show link to login page, following construction can be used:
login
It can be used in any hotspot HTML file.
Note, that to insert % symbol as a text (not as a part of variable construction), "%%" has to be used (if there is only one % symbol on a page or string between it and next % symbol is not a valid variable name, % may be used with the same result).
Examples
With basic HTML language knowledge and the information below it should be easy to implement the ideas described above
To provide predefined value as username, change:
to this line:
(where hsuser is the username you are providing)
To provide predefined value as password, change:
to this line:
(where hspass is the password you are providing)
To send client's MAC address to a registration server in form of:
https://www.server.serv/register.html?mac=XX:XX:XX:XX:XX:XX
change the Login button link to:
https://www.server.serv/register.html?mac=%mac%
(you should correct the link to point to your server)
© Copyright 1999-2003, MikroTik
The MikroTik HotSpot is included in the HotSpot package. This also requires DHCP package. Please download the hotspot-2.6.x.npk and dhcp-2.6.x.npk packages from MikroTik's web site, upload them using ftp BINARY mode to router and reboot.
Use the /system package print command to see the list of installed packages.
Software License
The Hotspot limits active user count to 4 for Demo Software License and Software Licenses without additional features enabled (i.e. Basic Software License without additional packages purchased). For unlimited number of users, any additional (wireless, synchronous) license is required. Thus, if you plan to use wireless hotspot, the license is already there.
Hardware Resource Usage
There is no significant resource usage.
How MikroTik HotSpot Gateway Works
MikroTik HotSpot Gateway should have at least two network interfaces:
HotSpot interface which is used to connect HotSpot clients;
LAN/WAN interface which is used to access network resources. For example, DNS and RADIUS server(s) should be accessible.
The diagram below shows sample HotSpot setup.
The HotSpot interface should have two IP addresses assigned to it: one as gateway for the temporary address pool prior to authentication, and second as gateway for the permanent address pool used for authenticated clients. Note, that you have to provide routing for these address pools, unless you plan to use masquerading (source NAT).
The arp feature should be set to 'reply-only' on HotSpot interface to prevent network access using static IP addresses. The DHCP server will add static ARP entries for each DHCP client.
Physical network connection has to be established between the HotSpot user's computer and the gateway. It can be wireless (the wireless card should register to AP), or wired (the NIC card should be connected to HUB).
The Initial Contact
MikroTik HotSpot Gateway's DHCP server assigns IP addresses from the temporary address pool with a very short lease time (approx. 14s), so the address can be changed after authentication.
If user tries to access network resources using web browser, the destination NAT rule redirects all TCP connection requests to HotSpot servlet (port 8080 by default). This brings up the HotSpot Welcome/Login page.
It may be useful to have port 80 for HotSpot servlet because the users might want to see status and log out. If this is impossible, you may redirect requests to a virtual IP address to the servlet.
Note that you may want to have DNS traffic enabled (or redirected to the router's DNS cache) so that the client could be logged in connecting any valid web-page (using it's DNS name). Enabling ICMP ping might be useful as well, since it shows network connectivity. Other traffic should be dropped.
The Servlet
If user is not logged in, login page will be shown (where username and password has to be entered), but if user is logged in, status page will be shown (status: username, IP address, session time, bytes and packets transferred, ...). There are 6 HTML pages that can be easily modified by creating HTML template pages and uploading them to the hotspot folder on MikroTik router. These pages are described in detailes later on.
Authentication
After client computer receives temporary IP address from HotSpot DHCP server, going to any HTTP address with web browser will be redirected to HotSpot authentication page prompting for username and password. Password together with HotSpot generated challenge string is hashed using MD5 algorithm (which in this case is implemented using JavaScript) and is executed on client's computer by web browser. After that, the hash result together with username is sent over Ethernet network to HotSpot servlet. So, password is never sent in plain text over ip network.
HotSpot can authenticate users using local user database or some RADIUS server. Which option is used is determined by /ip hotspot radius-client enabled parameter. If radius client is enabled, RADIUS authentication is used, otherwise local user authentication is done. If authentication is done locally, profile corresponding to that user is used, otherwise (in case of RADIUS) default profile is used to set default values for parameters, which are not set in RADIUS access-accept message.
If authentication by http cookie is enabled, then after each successful login cookie is sent to web browser and the same cookie is added to active HTTP cookie list. Next time when user will try to log in, web browser will send http cookie. This cookie will be compared to the one on HotSpot and only if there is the same source MAC address and the same randomly generated ID, user is automatically logged in. New cookie with different random ID is sent to web browser. Old cookie is removed from local HotSpot active cookie list. New one with new expire time is added.
Address Assignment
When user is successfully authenticated, HotSpot assigns another IP address for client (static or from some IP pool). On next clients DHCP request, the new IP address will be given by DHCP server to this client. How much time this IP address change required, depends on DHCP lease time for non authenticated users. HotSpot login-delay parameter should be set accordingly to this DHCP server lease time. If lease time is 14s, then real login-delay will be about 1..10 seconds. So, it is quite safe to set login-delay to 12s in this case.
While IP address is changed, user sees after-login (alogin.html) page. This page will automatically forward user to original destination address (or status page, if there was no original dst address) after login-delay time will pass.
Logging Out
User can log out using status page. There is a link to http://virtual_HotSpot_ip/logout Going to this page will logout user. After that logout page (logout.html) will be shown to user.
MikroTik HotSpot Gateway Setup
MikroTik HotSpot Gateway setup is under /ip hotspot submenu:
[admin@MikroTik] ip hotspot>
HotSpot management
active HotSpot active user list
user HotSpot local user list
profile HotSpot user profile management
server HotSpot DHCP profile management
radius-client RADIUS client configuration
cookie HotSpot active HTTP cookie list
print Print current configuration and status
get Get value of configuration property
set Change hotspot configuration
export Export hotspot settings
[admin@MikroTik] ip hotspot> print
hotspot-address: 0.0.0.0
status-autorefresh: 1m
auth-mac: no
auth-mac-password: no
auth-http-cookie: no
http-cookie-lifetime: 1d
These are general parameters for HotSpot:
auth-http-cookie - defines whether HTTP authentication by cookie is enabled
auth-mac - defines whether authentication by ethernet MAC address is enabled
auth-mac-password - uses MAC address as password if MAC authorization is enabled
hotspot-address - IP address for HotSpot www access
http-cookie-lifetime - validity time of HTTP cookies
status-autorefresh - WWW status page autorefresh time
HotSpot RADIUS Client Setup
Here is RADIUS client configuration. If it is disabled, users are authorized locally:
[admin@MikroTik] ip hotspot radius-client> print
enabled: no
accounting: yes
primary-server: 10.0.0.96
secondary-server: 0.0.0.0
shared-secret: "secret"
authentication-port: 1812
accounting-port: 1813
interim-update: 5m
[admin@MikroTik] ip hotspot radius-client>
All parameters are the same as for ppp (/ppp radius-client):
accounting - enable or disable RADIUS accounting
accounting-port - IP port on RADIUS server for accounting
authentication-port - IP port on RADIUS server for authentication
enabled - defines whether RADIUS client is enabled
interim-update - Interim-Update time interval
primary-server - IP address of primary RADIUS server
secondary-server - IP address of secondary RADIUS server
shared-secret - shared secret of RADIUS server
RADIUS Parameters
Authentication data sent to server (Access-Request)
NAS-Identifier router identity
NAS-Port-Type for HotSpot is Ethernet
Calling-Station-Id client MAC address (with CAPITAL letters)
Called-Station-Id Hotspot server name (from version 2.6.9)
NAS-Port-Id Hotspot server name
User-Name client login name
CHAP-Password,
CHAP-Challenge encrypted password and challenge
Data received from server (Access-Accept)
Framed-IP-Address IP address given to client. If address is 255.255.255.254,
IP pool is used from hotspot settings. If
Framed-IP-Address is specified, Framed-Pool is ignored.
Framed-Pool IP pool name (on the router) from which to get IP address
for the client
Idle-Timeout idle-timeout parameter
Session-Timeout session-timeout parameter
Framed-Route routes to add on the server. Format is specified in
RFC2865 (Ch. 5.22), can be specified as many times as needed.
Filter-Id firewall filter chain name. It is used to make dynamic
firewall rule that will jump to specified chain, if a
packet if come to or from the client. Firewall chain name
can have suffix .in or .out, that will install rule only
for incoming or outgoing traffic. Multiple filter-id can
be provided, but only last ones for incoming and outgoing is used.
Acct-Interim-Interval interim-update for RADIUS client (used only if RADIUS
client does not have local interim-update setting).
Ascend-Data-Rate tx/rx data rate limitation (for PPPoE). If multiple
attributes are provided, first limits tx data rate,
second - rx data rate. 0 if unlimited.
Mikrotik-Recv-Limit total recv limit in bytes for the client
Mikrotik-Xmit-Limit total transmit limit in bytes for the client
Framed-IP-Netmask client network netmask
Ascend-Client-Gatway client gateway
Note that the received attributes override the default ones (set in the default profile), but if an attribute is not received from RADIUS server, the default one is to be used.
Accounting information sent to server(Accounting-Request)
Acct-Status-Type Satrt, Stop, or Interim-Update
Acct-Session-Id accounting session ID
NAS-Identifier same as in request
User-Name same as in request
NAS-Port-Type same as in request
NAS-Port-Id same as in request
Calling-Station-Id same as in request (from version 2.6.9)
Called-Station-Id same as in request (from version 2.6.9)
Framed-IP-Address IP address given to the user
RADIUS attributes additionally included in Stop and Interim-Update Accounting-Request packets:
Acct-Session-Time connection uptime in seconds
Acct-Input-Octects bytes received from the client
Acct-Input-Packets packets received from the client
Acct-Output-Octets bytes sent to the client
Acct-Output-Packets packets sent to the client
Stop Accounting-Request packets can additionally have:
Acct-Terminate-Cause session termination cause (described in RFC2866 Ch. 5.10)
HotSpot Profiles
The HotSpot profiles are similar to PPP profiles:
[admin@MikroTik] ip hotspot profile> print
Flags: * - default
0 * name="default" session-timeout=0s idle-timeout=0s only-one=no
tx-bit-rate=0 incoming-filter="" outgoing-filter=""
[admin@MikroTik] ip hotspot profile>
Most of these parameters are exactly the same as for /ppp profile:
name - profile name
session-timeout - session timeout for client
idle-timeout - idle timeout for client
only-one - only one simultaneous login per user (yes, no)
tx-bit-rate - transmit bitrate. '0' means no limitation
incoming-filter - firewall chain name for incoming packets
outgoing-filter - firewall chain name for outgoing packets
Default profile will be used in case of RADIUS authentication as well. RADIUS server argument for limiting the data rate (transmited to the client) is Ascend-Data-Rate (vendor id: 529, attribute id:197).
Note that filter rules 'jumping' to the specifies firewall chain are added automatically to the hotspot firewall chain. This means that you should create hotspot chain and pass some (or all) the packets to it in order filtering to function.
HotSpot Server Settings
There can be added one server for each DHCP server. Which server profile to apply will depend on DHCP server which gave DHCP lease to that client. Actually it means that if user will log in from different interfaces, then different server profiles will be used. It allows assigning different IP addresses on different ethernet interfaces.
[admin@MikroTik] ip hotspot server> print
0 name="dhcp1" dhcp-server=hotspot_dhcp lease-time=1m login-delay=14s
address-pool=hotspot netmask=0.0.0.0 gateway=0.0.0.0
[admin@MikroTik] ip hotspot server>
Description of parameters:
address-pool - IP pool name, from which HotSpot client will get IP address if it is not given some static already
gateway - default gateway
lease-time - DHCP lease time for logged in user
login-delay - Time required to log in user
name - DHCP profile name, is sent as NAS-Port-Id by RADIUS client
netmask - network mask
dhcp-server - DHCP server with which to use this profile
HotSpot User Database
The local user database is manages in /ip hotspot user submenu:
[admin@MikroTik] ip hotspot user> print
Flags: X - disabled
# NAME PASSWORD ADDRESS PROFILE UPTIME
0 ax ex 10.0.0.3 default 29m40s
[admin@MikroTik] ip hotspot user> print detail
Flags: X - disabled
0 name="ax" password="ex" address=10.0.0.3 profile=default routes=""
limit-uptime=0s limit-bytes-in=0 limit-bytes-out=0 uptime=29m40s
bytes-in=187476 packets-in=683 bytes-out=327623 packets-out=671
[admin@MikroTik] ip hotspot user>
Parameter description:
name - user name
password - user password
address - static IP address. If not 0.0.0.0, client will get always the same IP address. It implies, that only one simultaneous login for that user is allowed
profile - user profile
routes - user routes. Usage and meaning is exactly the same as for ppp
limit-bytes-in - maximum amount of bytes user can receive
limit-bytes-out - maximum amount of bytes user can transmit
limit-uptime - total uptime limit for user (pre-paid time)
If auth-mac parameter is enabled, clients' MAC addresses (written with CAPITAL letters) can be used as usernames. If auth-mac-password is set to no, there should be no password for that users. Else, the username and the password should be equal. When client is connecting, it's MAC address is checked first. If there is a user with that MAC address, the client is authorized as this user. If there is no match, client is asked for username and password.
The RADIUS attributes for limit-bytes-in and limit-bytes-out are Mikrotik-Recv-Limit (14988, 1) and Mikrotik-Xmit-Limit (14988, 2). These limits are total limits for each user (not for each session as at /ip hotspot active). So, if user has already downloaded something, then session limit will be total limit - (minus) already downloaded. For example, if download limit for user is 100MB and user has already downloaded 30MB, then session download limit after login at /ip hotspot active will be 100MB - 30MB = 70MB.
If user will reach his limits (bytes-in >= limit-bytes-in or bytes-out >= limit-bytes-out), he will not be able to log on anymore.
All these limits (limit-uptime, limit-bytes-in, limit-bytes-out) can be used for pre-paid solutions. Probably 'quota' is a good name for such limits.
Along with these parameters, some statistics are available for each user:
[admin@MikroTik] ip hotspot user> print stats
Flags: X - disabled
# NAME UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 29m40s 187476 327623 683 671
[admin@MikroTik] ip hotspot user>
Statistics include:
uptime - total time user has been logged in
bytes-in - total bytes received from user
bytes-out - total bytes sent to user
packets-in - total packets received from user
packets-out - total packets sent to user
Note that these stats are updated each time user logs out and RADIUS accounting is disabled (or RADIUS is disabled). It means, that if user is currently logged in, then these stats will not show current total values. Use /ip hotspot active print stats to produce statistics on current user sessions.
The active user list shows the list of currently logged in users. Nothing can be changed here, except user can be removed with the remove command.
[admin@MikroTik] ip hotspot active> print
# USER ADDRESS UPTIME SESSION-TIMEOUT IDLE-TIMEOUT
0 ex 10.0.0.204 6m10s
[admin@MikroTik] ip hotspot active>
Description of the printout:
user - name of user logged in
address - IP address of logged in user
uptime - current session time (logged in time) for this IP address
session-timeout - how much time it is left for IP address until it will be automatically logged out
idle-timeout - how much idle time it is left for IP address until it will be automatically logged out
Statistics about logged in user are available too:
[admin@MikroTik] ip hotspot active> print stats
# USER UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 12m53s 1237091 1222130 4062 4241
[admin@MikroTik] ip hotspot active>
HotSpot Cookies
HotSpot Cookies can be managed within ip hotspot cookie submenu:
[admin@MikroTik] ip hotspot cookie>
HotSpot active HTTP cookie list
find Find active HTTP cookie
print Show active HTTP cookie list
remove Remove active HTTP cookie
get Get active HTTP cookie properties
[admin@MikroTik] ip hotspot cookie> print
# USER MAC-ADDRESS EXPIRES-IN
0 ex 00:30:4F:13:BF:EF 2d23h56m56s
[admin@MikroTik] ip hotspot cookie>
Cookies can be listed and removed. They can not be changed or added manually.
HotSpot Step-by-Step User Guide
Planning the Configuration
First of all, make sure you have MikroTik RouterOS 2.6.2 or higher with hotspot and dhcp packages installed. Let us consider following example HotSpot setup:
There will be 2 hotspot IP address ranges used for clients on prism1 interface. You are free to choose the address ranges, just make sure you use masquerading for not routed ones. In our example, we are using
temporary addresses which must be masqueraded:
network: 192.168.0.0/24
gateway: 192.168.0.1
pool: 192.168.0.2-192.168.0.254
real addresses which require routing:
network: 10.5.50.0/24
gateway: 10.5.50.1
pool: 10.5.50.2-10.5.50.254
Temporary addresses are given out by DHCP server (configured within /ip dhcp-server), but real addresses are given out by hotspot dhcp configuration.
For hotspot client accounting, hotspot will add dynamic firewall rules in firewall hotspot chain. This chain has to be created manually. And all network packets (to/from hotspot clients) have to pass this chain.
Setup Example
Follow the steps below:
Your ether1 interface is configured with IP address 10.5.6.5/24 and the default route points to gateway 10.5.6.1
Your prism1 interface is configured for AP mode and can register IEEE 802.11b wireless clients. See the Prism Interface Manual for more details.
ARP should be set to 'reply-only' on prism interface, so no dynamic entries are added to the ARP table. DHCP server will add entries only for clients which have obtained DHCP leases.
/interface prism set prism1 arp=reply-only
Add two IP addresses to prism1 interface:
/ip address add address=192.168.0.1/24 interface=prism1
/ip address add address=10.5.50.1/24 interface=prism1
add 2 IP pools:
/ip pool add name=temp ranges=192.168.0.2-192.168.0.254
/ip pool add name=hspot ranges=10.5.50.2-10.5.50.254
add masquerading rule for temporary IP pool, which is not routed:
/ip firewall src-nat add src-address=192.168.0.0/24 action=masquerade
Make sure you have routing for authenticated address space. Try to ping 10.5.50.1 from your internet gateway 10.5.6.1, for example. See the Basic Setup Guide on how to set up routing.
Add dhcp server (for temporary IP addresses):
/ip dhcp-server add name="hs_temp" interface=prism1 lease-time=14s \
address-pool=temp netmask=255.255.255.0 gateway=192.168.0.1 \
dns-server=159.148.60.2,159.148.108.1 domain="mt.lv" add-arp=yes disabled=no
Add hotspot server setup (for logged in IP addresses):
/ip hotspot server add name=hs_dhcp dhcp-server=hs_temp address-pool=hspot \
netmask=255.255.255.0 gateway=10.5.50.1
Add local hotspot user:
/ip hotspot user add name=ax password=ex
Setup hotspot service to run on port 80 (www service has to be assigned another port, e.g., 8081):
/ip service set www port=8081
/ip service set hotspot port=80
Note! Changing www service to other port than 80 requires thet you specify the new port when connecting to MikroTik router using WinBox, e.g., use 10.5.50.1:8081 in this case.
redirect all TCP requests from temporary IP addresses to hotspot service:
/ip firewall dst-nat add src-address=192.168.0.0/24 protocol=tcp action=redirect \
to-dst-port=80 comment="redirect unauthorized hotspot clients to hotspot service"
Allow DNS requests and ICMP ping from temporary addresses and reject everything else:
/ip firewall rule forward add src-address=192.168.0.0/24 protocol=icmp
/ip firewall rule forward add src-address=192.168.0.0/24 protocol=udp\
dst-port=53
/ip firewall rule forward add src-address=192.168.0.0/24 action=reject\
comment="reject access for unauthorized hotspot clients"
Add hotspot chain:
/ip firewall add name=hotspot
Pass all through going traffic to hotspot chain:
/ip firewall rule forward add action=jump jump-target=hotspot
If client has obtained temporary address, its lease is shown as:
[admin@HotSpot_GW] > ip dhcp-server lease print
Flags: X - disabled, D - dynamic, H - hotspot
# ADDRESS MAC-ADDRESS EXPIRES-A... SERVER STATUS
0 D 192.168.0.254 00:40:96:13:B3:47 8s hs_temp bound
[admin@HotSpot_GW] >
After successful authentication its DHCP address is changed, and it is listed under active hotspot users:
[admin@HotSpot_GW] > ip dhcp-server lease print
Flags: X - disabled, D - dynamic, H - hotspot
# ADDRESS MAC-ADDRESS EXPIRES-A... SERVER STATUS
0 DH 10.5.50.2 00:40:96:13:B3:47 56s hs_temp bound
[admin@HotSpot_GW] > ip hotspot active print
# USER ADDRESS UPTIME SESSION-TIMEOUT IDLE-TIMEOUT
0 ax 10.5.50.2 2m25s
[admin@HotSpot_GW] > /ip hotspot active print stats
# USER UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 13m26s 145268 264282 475 494
[admin@HotSpot_GW] >
User statistics show accumulated values prior to current session.
[admin@HotSpot_GW] > ip hotspot user print stats
Flags: X - disabled
# NAME UPTIME BYTES-IN BYTES-OUT PACKETS-IN PACKETS-OUT
0 ax 6m29s 9896 31156 80 77
[admin@HotSpot_GW] >
User statistics values are updated after current session is closed. Values can be reset to '0' using the reset command.
Optional Settings
You may want to use same address space both for your LAN and HotSpot networks. Please consult the IP Address and ARP Manual for proxy-arp feature.
You may want to translate the destination address of all TCP port 25 connections (SMTP) from HotSpot users to your mail sever for mail relaying. Thus, users can retain their mail client setup and use your mail server for outgoing mail without reconfiguring their mail clients. If 10.5.6.100 is your mail server accepting connections from network 10.5.50.0/24, then the required destination NAT rule would be:
/ip firewall dst-nat add src-address=10.5.50.0/24 dst-port=25 protocol=tcp\
to-dst-address=10.5.6.100 action=nat\
comment="Translate SMTP TCP 25 port to our mail server"
Another option is to allow access certain pages without authentication. This is useful, for example, to give access to some general information about HotSpot service provider or billing options. Include firewall rules into the forward chain allowing access to certain IP addresses prior the rule that rejects all other traffic from temporary addresses. Also, add rules excluding destination NAT for these addresses. For example:
1) in dst-nat: don't redirect requests going to your web server (x.x.x.x:80) (this rule has to be before "redirect to hotspot service" rule!)
/ip firewall dst-nat add dst-address=x.x.x.x/32 dst-port=80 protocol=tcp\
action=accept
2) in forward chain: accept requests going to your web server (this rule has to be before "reject access for unauthorized hotspot clients" rule!)
/ip firewall rule forward add dst-address=x.x.x.x/32 dst-port=80 protocol=tcp\
action=accept
For HotSpot clients to use transparent web-proxy on the same router, following configuration can be used:
1) make sure, web-proxy package is installed;
2) it is assumed, that HotSpot is set up and successfully running. Hotspot clients are connected on interface named 'prism1'.
3) set up web-proxy to run on port 3128 using transparent mode:
/ip web-proxy set enabled=yes address=0.0.0.0:3128 transparent-proxy=yes
4) set up HotSpot to use one of router's local IP addresses (10.5.50.1):
/ip hotspot set hotspot-address=10.5.50.1
5) redirect all requests from hotspot interface to port 80 (except to 10.5.50.1), to web-proxy:
/ip firewall dst-nat add in-interface=prism1 dst-address=!10.5.50.1/32 dst-port=80\
protocol=tcp action=redirect to-dst-port=3128 comment="transparent proxy"
Now, everything should be working. Only traffic of redirected requests to web-proxy will not be accounted. It's because this traffic will not pass through the forward chain.
6) to enable accounting for user traffic to/from transparent web-proxy, additional firewall rules should be added:
/ip firewall rule input add in-interface=prism1 dst-port=3128\
protocol=tcp action=jump jump-target=hotspot\
comment="account traffic from hotspot client to transparent web-proxy"
/ip firewall rule output add src-port=3128 protocol=tcp\
out-interface=prism1 action=jump jump-target=hotspot\
comment="account traffic from transparent web-proxy back to hotspot client"
You may want to prevent multiple logins using the same username/password. Set the argument value of 'only-one' to 'yes' in hotspot profile, for example:
/ip hotspot profile set default only-one=yes
If you have dns-cache package installed, setup local DNS cache and specify HotSpot gateway's address as primary DNS server for DHCP clients, for example:
/ip dns-cache set dns-server=159.148.60.2 enabled=yes
/ip dhcp-server set hs_temp dns-server=10.5.50.1,159.148.108.1
Customizing the Servlet
There are many possibilities to customize what the authorization servlet pages look like:
The pages are easily modifiable. They are stored on the router's FTP server in hotspot directory.
Changing the variables client is sending to the HotSpot gateway it is possible to reduce keyword count to one (username or password; the client's MAC address may be used as the other value) or even to zero (License Agreement; some predefined values general for all users or client's MAC address may be used as username and password)
Registration may occur on a different server. Client's MAC address may be passed to it, so that this information need not be written in manually. After the registration, the server may change RADIUS database enabling client to log in.
Servlet Page Description
There are 6 HTML pages to interact with hotspot client:
login.html - login page
status.html - status page for logged in user
logout.html - after_logged_out page
error.html - various error messages
redirect.html - redirecting web browser to another url
alogin.html - page, which is shown after successful login while client gets new IP address from DHCP server (for 10 seconds or so)
Variable Description
All of the pages use variables to show user specific values. For each variable there is an example included in brackets.
Common variables (available in all pages):
hostname - IP address for hotspot www access ("10.5.50.1")
link_logout - link to logout page ("http://10.5.50.1/logout")
link_login - link to login page ("http://10.5.50.1/login?dst=http://www.mt.lv/")
link_status - link to status page ("http://10.5.50.1/status")
link_orig - link to original destination page ("http://www.mt.lv/")
Page specific variables:
redirect.html:
link_redirect - page to which redirect has to be done (for example, "http://www.mt.lv/")
login.html:
mac - MAC address ("01:02:03:04:05:06")
error - error message, if previous login failed ("invalid username or password")
input_user - name and value of username input field ("name=user value=john")
input_password - name of password input field ("name=password")
input_popup - name and value of popup input field ("name=popup checked")
form_input - name of input form and JavaScript for password encoding ("name=login onSubmit=...")
main - MD5 encryption JavaScript and form for encrypted password
Note that it is required login page to use use main variable. And it is strongly suggested to place it BEFORE form_input input form. Otherwise situation can happen, that user already has entered his username/password, but MD5 encryption JavaScript is not yet loaded. It may result in password being sent over ethernet in plain text. And of course, that login will fail in this case, too.
alogin.html:
link_redirect - page to which redirect has to be done (for example, "http://www.mt.lv/")
login_time - time in seconds after which redirect has to be done ("9")
popup - true if alogin.html should pop-up status page in new window, false - otherwise
status.html, logout.html: information on logged in user
username - name ("john")
ip - IP address ("192.168.0.222")
mac - MAC address ("01:02:03:04:05:06")
uptime - logged in time ("10h2m33s")
session-timeout - session timeout left for user ("5h" or "---" if none)
session-valid-till - date and time when session will expire ("Sep/21/2002 16:12:33" or "---" if there is no session-timeout)
idle-timeout - idle timeout ("20m" or "---" if none)
bytes-in - number of bytes received from client ("15423")
bytes-out - number of bytes sent to client ("11352")
packets-in - number of packets received from client ("251")
packets-out - number of packets sent to client ("211")
status.html:
refresh_time - time in seconds after which to automatically refresh status page
refresh_time_str - more friendly representation of refresh_time
error.html:
error - error message ("DHCP lease not found")
To insert variable in some place in HTML file, variable name surrounded by % symbols is used. For example, to show link to login page, following construction can be used:
login
It can be used in any hotspot HTML file.
Note, that to insert % symbol as a text (not as a part of variable construction), "%%" has to be used (if there is only one % symbol on a page or string between it and next % symbol is not a valid variable name, % may be used with the same result).
Examples
With basic HTML language knowledge and the information below it should be easy to implement the ideas described above
To provide predefined value as username, change:
to this line:
(where hsuser is the username you are providing)
To provide predefined value as password, change:
to this line:
(where hspass is the password you are providing)
To send client's MAC address to a registration server in form of:
https://www.server.serv/register.html?mac=XX:XX:XX:XX:XX:XX
change the Login button link to:
https://www.server.serv/register.html?mac=%mac%
(you should correct the link to point to your server)
© Copyright 1999-2003, MikroTik
Mendulang Dollar dengan Google Adsense
Google Adsense, program affiliasi untuk bisnis internet yang sangat popular di dunia online saat ini. Semua orang bisa berpartisipasi menjadi pengiklan bagi google dengan syarat mudah dan cepat, cukup dengan menempatkan iklan-iklan google di situs mereka. Dengan metode komisi pay per click (PPC), menghasilkan uang dari google metodenya jauh lebih sederhana dan sangat liquid, beda dengan affiilasi lainnya, yang mengharuskan kita menjual sesuatu baru mendapatkan komisi. Google Adsense telah membawa revolusi baru dalam bisnis internet, pogram ini telah menghasilkan jutawan online tanpa harus mencari investor-investor besar seperti yang biasa dilakukan perusahaan-perusahaan dot com dari Silicon valley.
Apa itu Google Adwords dan Google Adsense ?
Sebelum mengenal lebih juga tentang Google Adsense, sedikit terlebih dahulu akan diulas Google Adwords yang merupakan cikal bakal kelahiran Google Adsense. Google Adwords adalah program periklanan yang ditawarkan google kepada para pemilik situs yang ingin mempromosikan situsnya, dengan cara menampilkan link situs pengiklan di hasil pencarian untuk kata kunci (keyword) tertentu.
Contoh : jika kita melakukan pencarian di google dengan kata kunci welding misalnya, maka selain hasil pencarian, di bagian seperempat di sebelah kanan akan muncul Sponsored Link / Pesan Sponsor.
Tentu saja, para pemasang iklan akan dikenakan sejumlah biaya tergantung dari kepopuleran kata kunci yang dipilihnya.
Namun Google menyadari, meskipun dia sekarang ini menjadi search engine nomor satu di dunia, tidak semua pengguna internet di dunia yang memakai google sebagai mesin pencari, sehingga iklan di google adwords, belum mampu menjangkau seluruh pengguna internet, oleh karena itu mereka menawarkan kepada pemilik situs untuk memasang iklan google adwords di situs mereka dengan pola bagi hasil yang disebut Google Adsense . Jika ada seseorang yang mengunjung situs peserta adsense dan mengklik iklan yang ada di situs tersebut, maka pemilik situs akan mendapat komisi dari google, metode pembayaran komisi seperti ini biasa disebut dengan nama pay per click (PPC).
Berapa banyak komisi yang Diterima?
Komisi yang didapatkan tergantung iklan yang ditempatkan di situs kita. Google sendiri akan menempatkan iklan sesuai dengan isi/content situs . Harga Pay per click sendiri ditentukan oleh seberapa mahal kata kunci tersebut dihargai oleh pemasang iklan Adwords, misalnya kata kunci welding mungkin cuma dihargai 0.5 dolar per klik, tetapi kata kunci insurance misalnya bisa dihargai hingga 30 dolar per klik. Kata-kata kunci yang bernilai tinggi inilah yang disebut dengan High Paying Keyword (HPK). Situs-situs dengan topik spesifik untuk kata kunci (keyword) tertentu disebut situs niche. (contoh situs niche http://www.welding-engineering.com/ dengan topic welding).
Bayangkan jika kita bisa membuat situs yang dikunjungi 1000 orang per hari , dan asumsikan ada 10% yang mengklik iklan dengan komisi 1 dolar per klik, maka dalam sehari situs itu sudah menghasilkan 100 dolar/hari atau 3000 dolar per bulan. Lumayan kan, jauh lebih tinggi dari gaji fresh graduate. Seandainya punya 10 situs serupa, hitung aja sendiri penghasilannya. Di Indonesia sendiri, sudah ada beberapa orang yang meraih komisi diatas 10.000 dolar per bulan, yang dapat ribuan dolar sudah banyak, apalagi yang cuma ratusan.
Di Amerika sendiri, banyak yang sudah mendapat ratusan ribu bahkan jutaan dolar, seperti situs plentyoffish.com ( perjodohan) atau digg.com ( berita) atau ezinearticles.com, hebatnya rata-rata situs mereka bukan lahir dari perusahaan-perusahaan besar silicon valley ( seperti yahoo, google, etc), tapi dari rumahan, ya dari rumah dengan modal PC yang terkoneksi ke internet.
Bagaimana cara ikutan Program Google Adsense?
Dari keterangan yang saya sebutkan di atas, tentu saja untuk ikut program ini, yang harus kita punya adalah situs untuk meletakkan iklan, kalau berdagang, situs ibarat toko, dan iklan adalah barang dagangannya. Setelah punya situs dengan topik/niche tertentu (e.g. education, consultant, farm, etc), kita bisa apply di google.com/adsense , lakukan registrasi, kemudian google akan mereview situs kita, jika memenuhi syarat dan diterima, google akan memberikan kode-kode html yang bisa kita masukkan di situs kita. Jadi deh… simple kan…?
Eiits… tunggu dulu, bagaimana kalau yang gak ngerti bikin situs… ? .. jangan khawatir, untuk pemula buat aja blog (kalau ini pasti sudah banyak yang ngerti), blog juga bisa dipasangi adsense. Bagi pemula berikut langkah-langkah membuat blog adsense (prosesnya gak lebih dari sejam):
- Tentukan topik blog yang akan dibuat ( misal. self development. music, education. etc).
- Buat blog di blogger.com, kenapa harus blogger, karena blogger masih punya google, jadi lebih gampang untuk di approve, jka sudah expert bisa pakai yang lain.
- Cari artikel tentang topik yang sudah dipilih, ( cari aja google, banyak, bisa diedit, atau langsung copy paste tapi tentu dengan mencantumkan sumbernya), posting artikel di blog 10-15 posting, kemudian baru melamar untuk ikutan program adsense via situs google.com/adsense
- Setelah lamaran diterima, kita dikasih account yang isinya macam2, diantaranya report jumlah klik dan komisi yang kita peroleh, disitu juga kode2 html yang tinggal yang tinggal di copy paste ke situs kita. Untuk di blogger caranya gampang banget, tinggal tambahin page element, kemudian klik add html/javascript, copy-kan adsense kode disitu. Jadi deh.
Remark: untuk waktu approval dari google, tergantung situs, bisa langsung approve, atau sehari malah kadang lebih.
Ada beberapa macam type iklan di google, namun yang umum dipakai adalah adsense for content dan adsense for search .
Ibarat jualan, toko sudah jadi, isi toko sudah ada, sekarang apa?… yah tinggal cari pembeli, ini tahap yang agak berat dan butuh waktu. Percuma kita punya toko tanpa ada yang beli. Yang disebut pembeli yaitu pengunjung situs kita, atau di dunia online umum disebut sebagai traffic. Semakin banyak traffic situs kita, berarti semakin tinggi kemungkinan iklan di klik dan semakin banyak komisi yang kita terima.
Nah untuk hal ini, bagaimana cara meningkatkan traffic ke situs kita secara general ada banyak cara untuk mendapatkan traffic, salah satu contohnya adalah mendapatkan traffic gratis dengan search engine. Contoh kembali lagi ke awal, jika kita mengetikkan kata kunci welding di google, ada lebih dari 30 juta hasil pencarian (gambar 1). Mana yang paling mungkin dibuka para pengunjung? ya halaman terdepan dong. Jika situs kita muncul di halaman pertama akan sangat bagus, halaman kedua atau ketiga masih OK-lah, tapi bagaimana jika di halaman 20?… siapa yang mau liat ..
Tentu semua adsenser ingin situs niche-nya akan muncul di halaman awal di hasil pencarian di google, bagaimana agar situs kita muncul di halaman awal?.. caranya adalah dengan Search Engine Optimization (SEO).
Author: adehendra Published: 21st April
Langganan:
Postingan (Atom)