After the installation of mac system, then i made a copy of the drive (cloning it through disk utility) then when i boot it via USB it wont run, i dont understand why the cloning process doesnt copy the bootloader files

Oke here are the steps i made to make bootloader
1. Boot the system with Mac OS Installation DVD
2. When the menu comes out, press F8, then type “-s” then press Enter
3. First you have to recognise the target drive and partition of where our new Mac systemn clone has placed,  (in my case, its install on the second HD on 3rd partitions, so it would be /dev/disk1s3) type fdisk /dev/diskxsx to make sure, dont make a mistake since i have ruin my drive twice

4. Go folder /usr/standalone/i386 -> type “cd /usr/standalone/i386″
5. Type “dd if=boot1h of=/dev/disk1s3 bs=512 count=1″ the press enter
6. Then “./startupfiletool -v /dev/disk1s3 boot.pcefi”
7. The we should mark it active, “fdisk -e /dev/disk1″ press enter then enter the following…
fdisk 1>flag 3
fdisk 1>update
fdisk 1>write
fdisk 1>exit

8. Boot the system with our new Mac Cloned

Tutorial: Setting Up Samba 3.x

admin – full access to workstation

teacher – almost full access to workstation – minus certain control panel functions

student – lockdown city – no network browsing, no software installation, no control panel

Workstations are joined to the Samba domain and function the same way they would in a Windows server based domain.

I will detail the steps to get a Samba lab up and running plus some caveats you may encounter.

Install Samba

This step is very distribution specific. Make sure you that the version you install is at least version 3.x and not 2.x.

#yum install samba -y

Create Your Base Users And Groups

#groupadd admins
#groupadd teachers
#groupadd students

#useradd -m -s /bin/false -c “Samba Admin” -G admins administrator

#useradd -m -s /bin/false -c “Samba Generic Teacher” -G teachers teacher

#useradd -m -s /bin/false -c “Samba Generic Student” -G students student

#smbpasswd -a administrator
#smbpasswd -a teacher
#smbpasswd -a student

Setup A Basic Config

a. Determine your NETBIOS server name and domain name In my example I use FS1 as the server name and ‘IDOM’ as the domain name. Make sure that neither contains spaces and avoiding any punctuation marks is preferable.

b. Create your share directories and permissions

#mkdir /home/samba
#mkdir /home/samba/netlogon
#mkdir /home/samba/teachers
#mkdir /home/samba/software

#chgrp teachers /home/samba/teachers
#chgrp admins /home/samba/software
#chmod 775 /home/samba/teachers
#chmod 775 /home/samba/software

c. Example config

[global]
netbios name = FS1
workgroup = IDOM
passdb backend = smbpasswd
os level = 33
preferred master = yes
domain master = yes
local master = yes
security = user
domain logons = yes
#logon path = \\%N\profiles\%u
logon path =
#logon drive = H:
#logon home = \\homeserver\%u\winprofile
logon script = logon.bat
add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u
# username map = /etc/samba/smbusers
admin users = @admins
printer admin = @admins
printing = cups
load printers = yes
printcap name = /etc/printcap
# print command = lp -c -d%p -oraw; rm %s
print command = lpr -l %s
# prevent mp3 files from being stored on the server
veto files = /*.mp3/*.divx/*.eml/

[homes]
comment = Home Directories
valid users = %S
browseable = No
read only = No
create mask = 0640
directory mask = 0750

[netlogon]
path = /home/samba/netlogon
read only = yes
write list = @admins
read list = @admins, @teachers, @students

[profiles]
path = /var/lib/samba/profiles
read only = no
create mask = 0600
directory mask = 0700

[printers]
comment = All Printers
path = /var/tmp
create mask = 0666
printable = Yes
guest ok = Yes
browseable = No

[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @admins, root
force group = admins
create mask = 0664
directory mask = 0775

[teachers]
comment = Shared area for teachers
path = /home/samba/teachers
valid users = @teachers
read list = @teachers
write list = @teachers
force group = teachers
read only = No
create mask = 0774
directory mask = 0775

[software]
comment = storage area for software and drivers
path = /home/samba/software
valid users = @teachers, @admins
admin users = @admins
read list = @teachers, @admins
write list = @admins
force group = admins
read only = No
create mask = 0774
directory mask = 0775
Mapping Groups

You need to map your unix groups to the domain groups using the ‘net’ command. The ‘net’ command is relatively new to Samba. To view a list of the commands available type ‘net view’ at the console.

net groupmap modify ntgroup=”Domain Admins” unixgroup=admins

net groupmap modify ntgroup=”Domain Users” unixgroup=users

net groupmap add ntgroup=”Teachers” unixgroup=teachers

net groupmap add ntgroup=”Students” unixgroup=students

The Login Script

Setup a login script named ‘logon.bat’ in the /home/samba/netlogon directory. This script MUST be in DOS format meaning that it must have a CRLF at the end of each line as opposed to the Linux LF only way. It is easiest to do the logon script in Notepad and put it in a share on the server, then use the ‘mv’ command to move it to the /home/samba/netlogon dir.

Oddly enough, Microsoft doesn’t include an ‘if member of group’ in the login script processor so you need to download a DOS ‘ifmember.exe’ executable and place it in the netlogon share manually in order to perform mappings based on group membership. You can download it from here . This login script also syncs the workstation time to the server time.

TITLE Domain Login script

net time \\FS1 /set /y

net use h: /home

net use g: \\FS1\apps

:a

%logonserver%\netlogon\ifmember “teachers”

if not errorlevel 1 goto quit

net use f: \\fs1\teachers

goto quit

:quit

Workstation Policies

Policies allow an administrator to ‘lock down’ a workstation. For instance, with policies the adminstrator and teachers can have access on the workstations to change control panel settings and add new programs while students can be denied access to the control panel, display settings, command prompt, etc.

Use ‘poledit.exe’ to create an ‘ntconfig.pol’ permissions file and place it in the \\server\netlogon share. This file will contain the permissions for the ‘Domain Admins’, ‘Teachers’, and ‘Students’ groups. Poledit.exe is available from the NT Resource Kit ( from http://www.microsoft.com ) but in order to support XP workstations, custom control files (called ADM files) need to be downloaded and loaded into the Poledit utility. The custom ADM files can be downloaded from – http://www.snipes.org/admfiles.zip .

Importing Workstations

In order to import the Windows 2000/XP workstations into your new Samba domain, you MUST run add the following registry entries into the workstation. The easiest way is to save the following text as a file called ‘samba.reg’ and then double-click to run it from the workstation.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]

“requiresignorseal”=dword:00000000

After rebooting, right-click on the ‘My Computer’ icon and choose properties. On the resulting screen change the computer from Workgroup to Domain and enter an administrator username and password (ie. a user that is in the ‘Domain Admins’ group). You will be thanked for joining and you will be told to reboot.

Finishing Thoughts

Setting up Samba can be a very interesting adventure but well worth the effort. Once the basics are understood, a new lab can be setup in just a couple of hours and should require very little maintenance. There are many online references for Samba. I suggest going to your closest Samba mirror via http://www.samba.org and looking at the documentation section for further info.

Permission precedence

Samba comes with different types of permissions for share. Try to remember few things about UNIX and Samba permissions.

(a) Linux system permissions take precedence over Samba permissions. For example if a directory does not have Linux write permission, setting samba writeable = Yes (see below) will not allow to write to shared directory / share.

(b) The filesystem permission cannot be take priority over Samba permission. For example if filesystem mounted as readonly setting writeable = Yes will not allow to write to any shared directory or share via samba server.

In short (thanks to Craig [see below in comment section]) :

Limits set by kernel-level access control such as file permissions, file system mount options, ACLs, and SELinux policies cannot be overridden by Samba. Both the kernel and Samba must permit the user to perform an action on a file before that action can occur.

How do I set permissions to Samba shares?

Samba Basic permissions are as follows (configuration file is smb.conf [/etc/samba/smb.conf]):

* read only: This parameter controls whether an user has the ability to create or modify files within a share. This is default.

* guest ok: Uf this parameter is set to yes, the users will have access to the share without

having to enter a password. This can pose security risk.

* writeable: Specifies users should have write access to the share.

You can create the share called helpfiles with read only permission

[helpfiles]
path = /usr/share/docs
read only = Yes

You can create the share called salesdoc with write permission

[salesdoc]
path = /home/shared/sales
writeable = Yes

You can also create a list of users to give write access to the share with write list option. For example allow rocky and tony to write to the share called sales:

[salesdoc]
path = /home/shared/sales
write list = rocky tony

You can use following options

* read list: This option accepts a list of usernames or a group as its value. Users will be given read-only access to the share.

* valid users: You can make a share available to specific users. Usernames or group names can be passed on as its value.

* invalid users: Users or groups listed will be denied access to this share.

Samba mask permission

It is also possible to specify samba default file creation permission using mask.

* create mask: This option is set using an octal value when setting permissions for files.

* directory mask: Directories must have the execute bit for proper access. Default parameter is 0755.

[salesdoc]
path = /home/shared/sales
write list = rocky sys
create mask = 0775

ini ni salah solusinya yang jitu FreeCommander

FreeCommander is an easy-to-use alternative to the standard windows file manager. The program helps you with daily work in Windows. Here you can find all the necessary functions to manage your data stock. You can take FreeCommander anywhere – just copy the installation directory on a CD or USB-Stick – and you can even work with this program on a foreign computer.

Main features in FreeCommander:

• Dual-panel technology - horizontal and vertical
• Tabbed interface
• Optional tree view for each panel
• Built in file viewer to view files in hex, binary, text or image format
• File viewer inside archives too
• Built in archive handling: ZIP (read, write), CAB (read, write), RAR (read)
• Nested archive handling
• Built in FTP client
• Easy access to system folders, control panel, desktop and start menu
• Copy, move, delete, rename files and folders
• Multi rename tool
• Wipe files
• Create and verify MD5 checksums
• File splitting
• File properties and context menu
• Calculation of folder size
• Folder comparison / synchronization
• Modification of file date and attributes
• Folder / program favorites
• File searching (inside archive too)
• File filters for display
• User defined columns for detailed view
• DOS command line

download utility ini supaya bisa membaca file linux ext3 di windows

Ext2IFS

http://www.fs-driver.org/download/Ext2IFS_1_11.exe

Advantages of Ext2 IFS

• Read and write access to files residing in Linux ext2/3 file system from within Windows.
• Read and write access to floppies with ext2 file system.
• Seamless integration and use of ext2/3 file system in Windows to the extent that all applications have access to it.

Disadvantages of Ext2 IFS

• This program has a drawback in that it mounts only Ext2/Ext3 partitions. So if you have installed Linux on any other file system such as reiserfs, JFS or XFS then you are out of luck.
• Does not have support for Linux logical volumes. So if you use LVM in Linux, this software will be useless even if the underlying file system is ext2 or ext3.
• Current version of Ext2 IFS does not maintain access rights. So mounting an ext2 partition in Windows will give full access to the files on it to all the users.

If by any chance you do not like any of the methods explained here, you can transfer files between Windows and Linux using a floppy or a USB key too .

Alat2 yang dibutuhkan
IMSniff
htt*://www.intellectualheav en.com/Projects/Tools/SniffIM/0.7/SniffIM.zip
download dan extract ke salah satu folder (misalnya: c:\IMSniff)

Technitium Mac Address Changer
htt*://www.download.com/Technitium-MAC-Address-Changer/3000-2085-10554920.html?part=d l-Technitiu&subj=dl&ta g=button
download dan install

Sebelum memulai, ada baiknya merename Interface LAN SkyStar2, masuk ke Control Panel – Network Connection, pilih salah satu Local Area Connection X, lihat propertynya, kalo ada yang connect using TechniSat DVB-PC TV Star PCI, berarti interface tersebut SS2, gantilah nama Local Area Connection X menjadi SS2

oke sekarang arahkan ke satu satelit yg mau dijadikan target,misalnya PALAPA, trus ambil salah satu file hasil grabbing (pake skynet ato filegrabber di transponder 3840H28000), misalnya 60c02fc200_000000c5. jpg, nah ambil aja 60c02fc200 sb mac address, pokoknya Mac Address itu bilangan Hexadesimal 10 digit unik

trus buka program Technitium Mac Address Changer, pilih interface SS2, trus klik Change MAC, masukkan 0060c02fc200 (tambahan 00 didepan utk melengkapi jumlah standar 12 digit Mac Address)

Oke terus, buka program Server4PC, di bagian satelite setting pilih add satellite, kasih nama PALAPA (LOF 5150, Switch 0, Diseq none)
Trus klik Transponder Management, klik add masukkan FR3840 SR28000, klik Tune untuk mulai tuning, klik OK trus Close
Trus klik ke bagian Data Services, klik add masukkan nama PALAPA, klik OK, pastikan terpilih Mac Source -> Broadband Receiver, di bagian PID list hilangkan conteng hexadecimal, trus insert 512, 513, 514, 515, 516, klik OK

Nah pada waktu udah disetting dengan benar, maka akan muncul aktifitas di interface SS2

sekarang saat nya buka IMSniff yg udah diextract tadi, klik menu start sniff, lalu pilih interface SS2, lalu silahkan menikmati hasilnya

coba ganti MAC Address untuk bereksperimen

Link Bagus lainnya http://wiki.mikrotik.com/wiki/Hotspot_server_setup

Login: (admin is the default)
Password: (none by default)

From any menu you can type:
“?” to show a list of possible commands
“print” will display any configuration from that menu if there is any.
“..” will navigate to a previous menu
“/” will navigate to the root menu
to change from “ip address>” to “ip route>” type “..” then “route”

Set the IP addresses.
ip address> add address=x.x.x.x netmask=x.x.x.x interface=ether1
(to set up the second interface use ether2 for the interface)

Add the default route or gateway.
ip route> add gateway=x.x.x.x

For additional routes:
ip route> add dst-address=x.x.x.x netmask=x.x.x.x gateway=x.x.x.x
(dst-address=”this is the subnet address”)
(netmask=”this is the mask of the dst-address”)
(gateway=”this is the next router to the dst-address”)

Enable the interfaces.
interface> print (this will display the interfaces you have an X will show if it is diasbled or not)
interface> set 0 disable=no (this will enable interface 0, repeet for any interface needed)

Change port speed and duplex of the ethernet ports if needed.
interface ethernet> set ether1 “press TAB for options for ether1″

Configure the DHCP POOL.
ip dhcp-server>setup
dhcp server interface:ether2
dhcp server address space:x.x.x.x/x (this is the subnet for dhcp)
Gateway for DHCP network:x.x.x.x (this is normaly the ip of the mikrotik dhcp server interface)
addresses to give out:x.x.x.x-x.x.x.x (these are the ip’s of handed out with DHCP)
DNS Servers:69.5.139.3,69.5.136.253 (our DNS servers)
Lease time:3d (default of 3 days)

Configure the Hotspot service.
ip hotspot>setup (DO NOT run setup on a router more than once it WILL screw things up)
hotspot interface:ether2
interface already configured:yes
use ssl:no
use transparent web proxy:no
use local DNS cache:no
dns Name:x.x.x.x (please enter the ip of ether2)
another port for service:8081 (this is the port winbox connects on)
name of local hotspot user:admin (admin is the default)
password for the user: (please enter one or provide anyone with a clue free access)

ip hotspot> set auth-http-cookie=yes (tell to hotspot to use cookies)
ip hotspot> set http-cookie-lifetime=3d (how long before the login cookie expires)
ip hotspot> set auth-mac=yes (alows mac address authentication)
ip hotspot> set auth-mac-password=yes (uses mac address for password with the mac login)
ip hotspot> set login-mac-universal=yes
(this allows computers to be logged in without a web browser you must set up universal for this to work)

Configure Walled-garden to allow non-authenticated users access to some of our servers.
ip hotspot walled-garden> add dst-host=faye.ics-llc.net
ip hotspot walled-garden> add dst-host=www.ics-llc.net
ip hotspot walled-garden> add dst-host=secure.ics-llc.net

Setting up universal.
ip hotspot universal> add address-pool=dhcp_pool1 addresses-per-mac=1 arp=no-arp interface=ether2 use-dhcp=yes
(address-pool=’the name of the DHCP pool’)(addesses-per-mac=’number of ips allowed per mac address’)
(arp=’weather or not to respond to ALL arp requests’)(interface=’should be the same as hotspot interface)

Configure the Hotspot service to use radius.
ip hotspot aaa> set use-radius=yes

Configure the firewall to allow an ssl login on our server.
ip firewall mangle> add dst-address=69.5.139.13/32 action=accept mark-flow=hs-auth

Configure DNS Servers.
ip dns> set primary-dns=69.5.139.3 secondary-dns=69.5.136.253

Adding the Radius Server
Radius> add service=login,hotspot, address=x.x.x.x secret=xxxxxxxxx
(service=’login-if you want to use the database for authentication to the console, hotspot for internet users’)
(address=’the ip of your radius server’)
(secret=’this is the radius server passphase’)

!!!!!Remember to allow the Mikrotik access to the Radius Server!!!!!

Changeing the Admin Login password
User> set admin password=xxxxxxxxx

Setting up WatchDog reboot
system watchdog> set reboot-on-failure=yes watch-address=x.x.x.x watchdog-timer=yes ping-start-after-boot=5m

1. Menetapkan IP Address
Misalkan kita punya 2 Interface (Kartu Jaringan), eth0 dan eth1, jadikan eth0 sebagai jalur ke internet (ip addressnya biasanya diberkan oleh ISP) dan eth2 sebagai jalur ke jaringan lokal (sebagai contoh masukkan range IP 192.168.0.1/24). edit file ifcfg-ethx untuk membuatnya permanent

masuk ke dalam folder etc/sysconfig/network-script/
#vi /etc/sysconfig/network-script/ifcfg-eth0

rubahlah settingan menjadi seperti ini (tekan “i” untuk mengedit dan simpan dengan “esc : x”)
DEVICE=eth0
BOOTPROTO=static
IPADDR=192.168.182.92
NETMASK=255.255.255.192
GATEWAY=192.168.182.1
ONBOOT=yes
TYPE=Ethernet

Merubah eth2 sebagai interface jaringan lokal
#vi /etc/sysconfig/network-script/ifcfg-eth1
pastikan settingan seperti ini
DEVICE=eth1
BOOTPROTO=static
IPADDR=192.168.0.92
NETMASK=255.255.255.0
ONBOOT=yes
TYPE=Ethernet

2. Menetapkan DNS
#vi /etc/resolf.conf
masukkan DNS (biasanya diberikan oleg ISP)
nameserver 203.99.123.8
nameserver 203.99.123.122

3. Membuat rule iptables untuk NAT koneksi internet
buat satu file untuk script
#vi /ipt –> tekan i terus ketiklah baris ini
IPT=”/sbin/iptables”
INT=”eth0″
LAN=”eth1″
$IPT -F
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F -t mangle
$IPT -F -t nat
$IPT -X
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
$echo 1 > /proc/sys/net/ipv4/ip_forward
$IPT -t nat -A POSTROUTING -o $INT -j MASQUERADE
$IPT -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
simpanlah file itu tekan “esc : x”
rubah file itu menjadi executable #chmod /ipt +x
jalankan file itu #./ipt

5. Membuat LinuxBox kita sebagai DHCP Server
#vi /etc/dhcpd.conf
pastikan isinya spt ini

ddns-update-style interim;
ignore client-updates;

subnet 192.168.0.0 netmask 255.255.255.0 {

# — default gateway option router itu sbg gateway
option routers 192.168.0.1;
option subnet-mask 255.255.255.0;

option nis-domain “latihan.net”;
option domain-name “latihan.net”;
option domain-name-servers 192.168.20.2;

option time-offset -18000; # Eastern Standard Time
# option ntp-servers 192.168.1.1;
# option netbios-name-servers 192.168.1.1;
# — Selects point-to-point node (default is hybrid). Don’t change this unless
# — you understand Netbios very well
# option netbios-node-type 2;

range dynamic-bootp 192.168.0.10 192.168.0.254;
default-lease-time 21600;
max-lease-time 43200;

# we want the nameserver to appear at a fixed address
# host ns {
# next-server marvin.redhat.com;
# hardware ethernet 12:34:56:78:AB:CD;
# fixed-address 207.175.42.254;
# }
}

simpan lah file itu “esc : x”

6. Mendisable SELinux (entahlah pokoke ini di disable ajeh.. ^_^’)
#vi /etc/selinux/config
Rubah baris SELINUX = enforcing menjadi
SELINUX = disabled

7. langkah terakhir ketik “setup” di prompt
masuk ke menu service, terus aktfkan DHCP supaya bisa jalan setiap kali booting

sekarang LINUX GATEWAY ANDA UDAH OKE… ^_^’

Boot komputer melalui DVD Fedora
Install Partisi secara default
Masukkan Packet secara Manual

continued…

Berikutnya siapkan software untuk memudahkan menyeting dengan software Bantu seperti winbox, putty dll.

1. Install semua paket Mikrotik atau boleh pilih seperlunya.

2. sesudah masuk ke prompt langkah pertama ubah dulu passwordnya

 
/password
old password:
new password: ******
retype new password: ******

3. untuk memudahkan sebaiknya  rubah nama interface LAN card untuk memudahkan pengaturan, misalnya ether1 diganti dengan LAN, ether2 diganti engan internet, dll.

/interface set ether1 name=Telkom
/interface set ether2 name=Diginet
/interface set ether3 name=Local

tapi karena ini dicomot langsung AKA kopi paste maka lanjut aja tanpa perubahan di interface ^_^’

Diasumsikan Mikrotik PC mempunyai 2 ethernet card, 1 untuk ISP 1 lagi untuk jaringan lokal

IP didapat dari provider/ISP 100.10.15.2/30 dengan gateway 10.100.15.1

IP range yang digunakan untuk jaringan lokal 192.168.0.1/24 (untuk jumlah client sesuka anda, max 254 client)

Sekarang Tambahkan IP address pada masing-masing interface (contoh: untuk IP dari ISP pada ether1 yaitu 100.10.15.2/30, Untuk IP LAN pada ether2 yaitu 192.168.0.1/24

<< ip lan tersebut akan menjadi gateway masing-masing client dalam setting networknya)

/ip address
ip address add address=100.10.15.2/30 interface=ether1 disabled=no
ip address add address=192.168.0.1/24 interface=ether2 disabled=no

Tambahkan gateway provider dalam ip route

/ip route
add gateway=100.10.15.1

Membuat NAT dalam ip firewall nat

/ip firewall nat
add chain=srcnat action=masquerade disabled=no

Masukan IP DNS yang diberikan oleh ISP (misalkan:100.10.20.1 dan 100.10.20.2)

/ip dns
set primary-dns=100.10.20.1 secondary-dns=100.10.20.2 allow-remote-requests=yes

Sebelum ada setting network pada komputer client anda, test dulu apakah mikrotik anda terhubung ke internet(ex: menggunakan “ping yahoo.com” pada terminal console)

Sekedar share settingan, siapa tahu dengan adanya masukan-masukan dari rekan-rekan sekalian dapat lebih memaksimalkan setting mikrotik saya;

Settingan ini adaah hasil dari membaca tutor ‘delaypoll rasa mikrotik’ post dari bro ‘niplux’… thank’s banget mas atas tutornya;

Seperti tutor yang saya sebut diatas, pertama kita buat list filter di “/ip firewall filter” yang akan menangkap setiap request yang berisi contens file-file yang biasa di download; seperti .exe .rar .zip dan website-website yang biasa ngabisin bandwith; seperti youtube, megarotic dll..
Dan setelah di tangkap, maka ip address si website yang didownload tersebut akan kita masukkan kedalam list tersendiri; yang didalam contoh ini saya bikin list “yes_no”.

berikut adalah hasil dari perintah yang dibikin (maaf saya tampikan hasil jadinya saja, karena saya bikin di winbox…)

chain=forward protocol=tcp dst-port=80 content=.exe src-address-list=x_z_1_download action=add-dst-to-address-list address-list=yes_no address-list-timeout=1d

Disini setiap website yang diakses oleh list address “x_z_1_download” akan dimasukkan dalam list “yes_no” selama satu hari; (perkiraan download paling lama)

kemudian bikin satu mangle untuk menangkap client yang melakukan download;

chain=postrouting out-interface=ether1 connection-mark=http_conn src-address-list=yes_no dst-address-list=_best action=mark-packet new-packet-mark=http_clients_down passthrough=no

Setiap aksi dari list address “_best” yang bertujuan ke list address “yes_no” pada port ’80′ akan dimark packet dengan nama “http_clients_down”;

filtering dan marking packet udah selesai; sekarang kita bikin “queue tree”-nya untuk membatasi bandwith download ini :
bikin dulu “queue type” pcq dengan nama “_d_best_down” dan rate-nya diset 64000 (8 KB/s);

name=”_d_best_down” kind=pcq pcq-rate=64000 pcq-limit=50 pcq-classifier=dst-address pcq-total-limit=2000

Dengan rate ini, sebesar-besarnya client download; mereka hanya akan mendapatkan max 8 KB/s; meskipun dia menggunakan IDM atau apapun namanya.
Selanjutnya bikin queue tree;

name=”In_best_down” parent=2_In_best packet-mark=http_clients_down limit-at=0 queue=_d_best_down priority=8 max-limit=320000 burst-limit=0 burst-threshold=0 burst-time=0s

Diberi nama “In_best_down” dengan parent “2_In_best” yang menangani packet mark yang sudah kita buat diatas; yakni “http_clients_down” dengan priority paling bontot=8; rate 0 dan max 320kbps; (perkiraan dalam waktu bersamaan yang download 5 user).
mengenai priority; untuk browsing biasa diberi priority yang lebih tinggi, semisal “2″ atau “3″, sehingga jika ada user yang sedang download, pada saat juga melakukan browsing, maka download istirahat sejenak, nunggu browsing-nya selesai and setelah itu download lanjut lagi…
Selesai….
Tapi ada permasalahan sedikit; dimana apabila website yang sudah ditangkap dan dimasukan ke dalam list “yes_no” itu ternyata adalah website penting seperti “yahoo”, “google” dll.. maka dia akan tetap kelimit selama satu hari.. wah……
Untuk mengatasi ini, kita membuat scripts yang khsusus melakukan checking pada website-website penting tersebut; dimana jika ditemukan website itu tertangkap, maka secara otomatis akan dihapus dari list “yes_no” agar tidak terlimit. Jadi khsusus untuk website peting ini aja download bebas melalui jalur browsing biasa.. gpp-lah… kan jarang-jarang juga client download attachment dari email.
pertama bikin dulu fiternya untuk nangkap website penting tersebut:

chain=forward protocol=tcp dst-port=80 content=yahoo.co src-address-list=x_z_1_download
action=add-dst-to-address-list address-list=penting address-list-timeout=1d

Setiap aksi dari list address “x_z_1_download” yang berisi contents “yahoo.co” akan dimasukkan kedalam list “penting”. (bukan “yes_no”) karena ini akan kita gunakan sebagai dasar`untuk melakukan pengecekan pada script kita;
dan selanjutnya bikin scripts :

:foreach i in=[/ip firewall address-list find list=penting dynamic=yes] do={/ip firewall address-list remove [find address=[/ip firewall address-list get $i address]]}

Semua ip yang terdapat dalam list “penting” akan dihapus, termasuk yang berada di list “yes_no” dll…
bikin scheduler:

cek_penting penting jan/01/1970 22:29:00 5s 4417

Aksi dilakukan setiap 5 detik.

Selanjutnya bagaimana dengan yang sudah selesai download?
karena kita set waktu penangkapan selama 1 hari, maka ada kemungkinan di pendownload sudah selesai; dan ada baiknya website yang ada di list “yes_no” dan sudah tidak aktif lagi melakukan koneksi dihapus saja; ini untuk menjaga agar jika ada user yang hanya sekedar browsing pada website tersebut tidak terhalang oleh priority “8″ tadi, biar normal lagilah istilahnya;
Jadi secara periodik kita harus mengecek status koneksi khusus untuk list “yes_no” saja. apakah masih ada koneksi aktif apa tidak; jika masih ada dibiarkan, jika sudah tidak ada dihapus…!!!
Bikin scripts lagi:

:foreach i in=[/ip firewall address-list find list=yes_no dynamic=yes]do={:if([:len [/ip fire conn find dst-address=([/ip firewall address-list get $i address]. “:80″)]]=0) do={/ip fire address-list remove $i}}

Melakukan cek koneksi yang ada pada port 80, jika ternyata si ip dalam list masih aktif koneksinya: dibiarkan, jika udah gak ada aktifitas lagi: dihapus…
Bikin scheduler-nya :

cek_remove remove jan/01/1970 22:29:00 11s 1661

Untuk peletakan aturan dalam mangle-nya, harus pas, dimana aturan untuk download ini diletakkan diatas aturan untuk browsing biasa;

kalo ada yang janggal atau kurang pas mohon dikoreksi, yach biar makin seplah kinerja mikrotik saya…
thank’s..