SECURITY
LEVEL: ADVANCED
2 min read
Lab 50 Menit
87 views
Panduan Mitigasi Serangan DDoS & BGP Blackholing pada Router Enterprise Menggunakan Firewall RAW, Mangle, dan Flowspec
Modul Saat Ini
Verifikasi & Troubleshooting
Checklist hasil yang benar dan penanganan gangguan yang paling sering terjadi.
NET2i Infrastructure & Security Guard Team
•
25 Aug 2026
Executive Summary
Tutorial mendalam penanganan dan mitigasi serangan DDoS (UDP Amplification, SYN Flood, & ICMP Flood) pada router Edge perusahaan. Membahas penggunaan Firewall RAW, Fasttrack bypass, BGP Remotely Triggered Blackhole (RTBH), dan BGP Flowspec.
Tested & Verified On
MikroTik RouterOS v7.14+ & Cisco IOS-XE / BGP Flowspec
Prerequisites
Pemahaman BGP Peering, RouterOS Mangle & RAW Firewall, serta protokol TCP/UDP
Checklist Verifikasi
- [ ] Check CPU Usage on Edge Router under 30% with RAW Drop
- [ ] Test RAW Drop Counter Increasing: '/ip firewall raw print stats'
- [ ] Verify BGP RTBH Community Announce: '/routing bgp advertisements print'
- [ ] Verify Upstream ISP Dropping Traffic to Victim IP
- [ ] Verify Normal Web Traffic to Other Server IPs Remains Unaffected
Troubleshooting Paling Sering Muncul
- CPU Router 100% saat Terkena Flood: Alihkan Drop Rule dari Firewall Filter ke Firewall RAW.
- BGP RTBH Community Tidak Direspons ISP: Verifikasi BGP Community Tag yang disepakati dengan Upstream (e.g. AS7713:666).
- False Positive Block: Menggunakan Address-List White-List untuk IP Server Kritis.
Checklist Verifikasi Hasil Lab
- [ ] Check CPU Usage on Edge Router under 30% with RAW Drop
- [ ] Test RAW Drop Counter Increasing: '/ip firewall raw print stats'
- [ ] Verify BGP RTBH Community Announce: '/routing bgp advertisements print'
- [ ] Verify Upstream ISP Dropping Traffic to Victim IP
- [ ] Verify Normal Web Traffic to Other Server IPs Remains Unaffected
Masukan & Komentar Pembaca (0)
Diskusi Komunitas
Belum ada masukan pembaca. Jadilah yang pertama memberikan masukan atau pertanyaan.