Panduan NOC: IP Blacklist di Jaringan Kampus

# Step 1: Buat address-list untuk mail server yang BOLEH pakai port 25
/ip firewall address-list
add address=10.0.1.10 list=smtp-server-allowed comment="Mail Server Utama Kampus"
add address=10.0.1.11 list=smtp-server-allowed comment="Mail Server Fakultas Teknik"
add address=10.0.1.12 list=smtp-server-allowed comment="Mail Server Rektorat"
add address=10.0.2.0/28 list=smtp-server-allowed comment="Subnet Laboratorium Jaringan"

# Step 2: Izinkan mail server internal kirim via port 25 (whitelist dulu)
/ip firewall filter
add chain=forward action=accept protocol=tcp dst-port=25 \
    src-address-list=smtp-server-allowed \
    comment="ALLOW: Mail server internal → port 25 outbound" \
    place-before=0

# Step 3: Log upaya koneksi port 25 dari non-whitelist (untuk investigasi)
add chain=forward action=log protocol=tcp dst-port=25 \
    out-interface=ether-uplink \
    log-prefix="SMTP_BLOCKED" \
    comment="LOG: Catat upaya port 25 dari client"

# Step 4: Blokir semua koneksi port 25 outbound dari user lain
add chain=forward action=drop protocol=tcp dst-port=25 \
    out-interface=ether-uplink \
    comment="DROP: Semua client → port 25 outbound"

# Dari komputer yang ada di jaringan kampus (bukan mail server):
# Harusnya GAGAL/timeout jika blokir sudah aktif
telnet gmail-smtp-in.l.google.com 25
# Expected: "Connection timed out" atau "Connection refused"

# Test port 587 harus BERHASIL (tidak diblokir)
telnet smtp.gmail.com 587
# Expected: "220 smtp.gmail.com ESMTP..."

# Dari MikroTik terminal — cek log blokiran
/log print where message~"SMTP_BLOCKED"

# === Identitas Server ===
myhostname = mail.kampus.ac.id
mydomain = kampus.ac.id
myorigin = $mydomain

# === Jaringan yang Diizinkan untuk Relay ===
# Hanya terima koneksi dari jaringan internal kampus
mynetworks = 
    127.0.0.0/8
    10.0.0.0/8
    172.16.0.0/12
    192.168.0.0/16

# === Wajibkan Autentikasi SASL ===
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname

# === Kontrol Relay — Hanya Terima dari Jaringan Kampus atau User Terautentikasi ===
smtpd_recipient_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    reject_unauth_destination
    reject_unknown_recipient_domain

# === Rate Limiting Anti-Abuse ===
# Maks 100 pesan per koneksi per klien
smtpd_client_message_rate_limit = 100
# Maks 30 koneksi bersamaan per IP
smtpd_client_connection_rate_limit = 30
# Maks 200 penerima per klien per menit
smtpd_client_recipient_rate_limit = 200
# Maks ukuran pesan 25MB
message_size_limit = 26214400

# === Keamanan TLS ===
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.kampus.ac.id/fullchain.pem
smtpd_tls_key_file  = /etc/letsencrypt/live/mail.kampus.ac.id/privkey.pem
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtp_tls_security_level = may

# === Integrasi DKIM (OpenDKIM) ===
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

# === Queue Settings ===
maximal_queue_lifetime = 1d
bounce_queue_lifetime = 1d

; === SPF Record — Di DNS kampus.ac.id ===
; Hanya relay server yang boleh kirim email @kampus.ac.id
kampus.ac.id.        IN  TXT  "v=spf1 mx ip4:103.X.X.10 -all"

; === PTR Record (Reverse DNS) — Minta ke ISP/APNIC ===
; Forward: mail.kampus.ac.id → 103.X.X.10
mail.kampus.ac.id.   IN  A    103.X.X.10
; Reverse: 103.X.X.10 → mail.kampus.ac.id (dikonfigurasi ISP)
10.X.X.103.in-addr.arpa. IN PTR mail.kampus.ac.id.

; === DMARC Record ===
_dmarc.kampus.ac.id. IN  TXT  "v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=quarantine; adkim=s; aspf=s"

; === MX Record ===
kampus.ac.id.        IN  MX   10 mail.kampus.ac.id.

# Install OpenDKIM
apt install opendkim opendkim-tools -y

# Generate keypair DKIM (2048-bit)
mkdir -p /etc/opendkim/keys/kampus.ac.id
cd /etc/opendkim/keys/kampus.ac.id
opendkim-genkey -s mail2026 -d kampus.ac.id --bits=2048

# Tampilkan TXT record yang perlu ditambah ke DNS
cat /etc/opendkim/keys/kampus.ac.id/mail2026.txt
# Output: mail2026._domainkey.kampus.ac.id → "v=DKIM1; k=rsa; p=MIIBIjAN..."

# Set permission
chown opendkim:opendkim /etc/opendkim/keys/kampus.ac.id/mail2026.private
chmod 600 /etc/opendkim/keys/kampus.ac.id/mail2026.private

# Test konfigurasi
opendkim-testkey -d kampus.ac.id -s mail2026 -vvv

#!/bin/bash
# /usr/local/bin/check-blacklist-kampus.sh
# Cron: 0 6 * * * root /usr/local/bin/check-blacklist-kampus.sh

# Daftar semua IP publik kampus
declare -a PUBLIC_IPS=(
    "103.X.X.1"
    "103.X.X.2"
    "103.X.X.3"
    "103.X.X.10"  # Mail relay server
)

NOTIFY_EMAIL="[email protected]"
REPORT=""
ALERT=0

check_dnsbl() {
    local IP="$1"
    local DNSBL="$2"
    # Balik urutan oktet IP untuk query DNSBL
    local REVERSED=$(echo $IP | awk -F. '{print $4"."$3"."$2"."$1}')
    local RESULT=$(dig +short +time=5 +tries=1 "${REVERSED}.${DNSBL}" 2>/dev/null)
    echo "$RESULT"
}

for IP in "${PUBLIC_IPS[@]}"; do
    STATUS=""
    # Cek di DNSBL utama
    for DNSBL in "zen.spamhaus.org" "b.barracudacentral.org" "dnsbl.sorbs.net"; do
        RESULT=$(check_dnsbl "$IP" "$DNSBL")
        if [ ! -z "$RESULT" ] && [ "$RESULT" != "" ]; then
            STATUS+="  ⚠️  ${DNSBL}: LISTED (${RESULT})\n"
            ALERT=1
        fi
    done

    if [ ! -z "$STATUS" ]; then
        REPORT+="IP: ${IP}\n${STATUS}\n"
    fi
done

# Kirim alert jika ada yang listed
if [ $ALERT -eq 1 ]; then
    echo -e "ALERT BLACKLIST KAMPUS\n\n${REPORT}\nCek: https://cekipsaya.com/blacklist-check/" \
    | mail -s "[CRITICAL] IP Kampus Masuk Blacklist - $(date +%Y-%m-%d)" "$NOTIFY_EMAIL"
fi

# Deteksi perangkat yang mencoba koneksi SMTP massal
# Tandai IP yang melakukan > 10 koneksi ke port 25 dalam 1 menit

/ip firewall filter
# Buat connection tracker untuk upaya SMTP dari single IP
add chain=forward protocol=tcp dst-port=25 \
    connection-limit=10,32 \
    action=add-src-to-address-list \
    address-list=smtp-abuser \
    address-list-timeout=1h \
    comment="DETECT: SMTP abuser — lebih dari 10 koneksi"

# Log dan drop perangkat yang sudah ditandai
add chain=forward protocol=tcp dst-port=25 \
    src-address-list=smtp-abuser \
    action=log \
    log-prefix="SMTP_ABUSER"

add chain=forward protocol=tcp dst-port=25 \
    src-address-list=smtp-abuser \
    action=drop \
    comment="DROP: Known SMTP abuser"

# Log semua koneksi NAT yang melewati router
# CATATAN: Di jaringan besar, ini bisa menghasilkan log sangat besar.
# Filter hanya port kritis jika perlu menghemat storage.

/ip firewall nat
# Log koneksi ke port email (25, 587, 465)
add chain=srcnat action=log protocol=tcp dst-port=25,587,465 \
    log-prefix="NAT_EMAIL" \
    comment="Log NAT connections ke port email"

# Log koneksi port tinggi yang sering dipakai botnet C&C
add chain=srcnat action=log protocol=tcp dst-port=6667,6668,6669 \
    log-prefix="NAT_IRC_BOTNET" \
    comment="Log koneksi IRC (sering dipakai botnet C&C)"

# Aktifkan masquerade dengan logging
add chain=srcnat action=masquerade out-interface=ether-uplink \
    log=no log-prefix="NAT_MASQ"

# Simpan log ke remote syslog server (rekomendasi)
/system logging
add topics=firewall action=remote
/system logging action
set remote remote=10.0.1.50 remote-port=514 \
    comment="Syslog server NOC kampus"

#!/bin/bash
# Script forensik: cari siapa yang pakai IP publik X pada waktu Y
# Usage: ./find-user.sh 103.X.X.2 "2026-04-19 14:32" 25

PUBLIC_IP="$1"       # IP publik yang dilaporkan
TIMESTAMP="$2"       # Waktu insiden (format: "YYYY-MM-DD HH:MM")
PORT="$3"            # Port tujuan (opsional)
SYSLOG="/var/log/mikrotik-nat.log"

echo "=== Investigasi NAT Mapping ==="
echo "IP Publik : $PUBLIC_IP"
echo "Waktu     : $TIMESTAMP"
echo "Port      : ${PORT:-semua}"
echo ""

# Cari di log syslog
grep "NAT_EMAIL\|NAT_MASQ" "$SYSLOG" | \
grep "$TIMESTAMP" | \
grep "src-ip=$PUBLIC_IP\|to-src=$PUBLIC_IP" | \
awk '{print "Private IP:", $8, "| Port:", $10, "| Time:", $1, $2}'

# Urutan rules yang BENAR untuk kampus full GWS (tanpa mail server internal)
# Diverifikasi melalui pengujian nyata di jaringan kampus aktif

/ip firewall filter

# Rule 1: LOG dulu sebelum DROP — agar forensik bisa berjalan
add chain=forward action=log protocol=tcp dst-port=25 \
  out-interface=sfp28-1 \
  log=yes \
  log-prefix="SMTP_BLOCKED" \
  comment="LOG: Port 25 outbound attempt"

# Rule 2: DROP outbound — harus langsung setelah LOG (pasangan wajib)
add chain=forward action=drop protocol=tcp dst-port=25 \
  out-interface=sfp28-1 \
  comment="DROP: Outbound port 25 kampus full GWS"

# Rule 3: DROP inbound — cegah server luar scan port 25 ke client kampus
add chain=forward action=drop protocol=tcp dst-port=25 \
  in-interface=sfp28-1 \
  comment="DROP: Inbound port 25 ke kampus"

# Rule 4 (sudah ada): fasttrack — harus di BAWAH semua rules port 25
# chain=forward action=fasttrack-connection hw-offload=yes connection-state=established,related

# PENTING: Aktifkan logging firewall topics agar log masuk ke /log print
/system logging add topics=firewall action=memory

# Test 1: Port 25 harus GAGAL (TcpTestSucceeded: False)
Test-NetConnection -ComputerName gmail-smtp-in.l.google.com -Port 25
# Expected output:
# WARNING: TCP connect to (142.251.12.27 : 25) failed
# TcpTestSucceeded : False   <-- INI YANG DIHARAPKAN

# Test 2: Port 443 harus BERHASIL (internet normal)
Test-NetConnection -ComputerName google.com -Port 443
# Expected output:
# TcpTestSucceeded : True    <-- Normal traffic tidak terganggu

# Jika port 25 masih True, cek rules MikroTik:
# /ip firewall filter print where dst-port=25
# Pastikan rules tidak disabled (tidak ada flag X di depan)