Karena alasan keamanan atau keisengan untuk menyembunyikan IP Mikrotik dan IP router dari hasil traceroute.
contoh traceroute ke yahoo.com

$ traceroute mail.yahoo.com
traceroute to mail.yahoo.com (106.10.193.20), 30 hops max, 60 byte packets
 1  eh.ini.mikrotik.lho (10.10.10.1)  0.324 ms  0.310 ms  0.304 ms
 2  192.168.1.1 (192.168.1.1)  1.825 ms  1.829 ms  1.825 ms
 3  1.subnet125-161-208.speedy.telkom.net.id (125.161.208.1)  6.539 ms  6.711 ms  6.767 ms
 4  121.subnet125-160-11.speedy.telkom.net.id (125.160.11.121)  6.634 ms  22.015 ms  7.890 ms
 5  61.94.171.69 (61.94.171.69)  8.101 ms  8.121 ms  7.817 ms
 6  180.240.193.42 (180.240.193.42)  28.789 ms  37.383 ms 180.240.193.46 (180.240.193.46)  33.028 ms
 7  180.240.193.41 (180.240.193.41)  21.969 ms  21.033 ms 180.240.193.45 (180.240.193.45)  24.619 ms
 8  180.240.204.5 (180.240.204.5)  25.118 ms  28.300 ms  24.375 ms
 9  180.240.204.6 (180.240.204.6)  30.185 ms  30.009 ms 180.240.204.22 (180.240.204.22)  23.637 ms
10  pat1.sgy.yahoo.com (103.16.102.37)  21.265 ms  24.800 ms  24.718 ms
11  ae-5.msr2.sg3.yahoo.com (203.84.209.89)  39.394 ms  32.464 ms  32.273 ms
12  ae-3.clr2-a-gdc.sg3.yahoo.com (106.10.128.9)  31.749 ms  30.745 ms ae-3.clr1-a-gdc.sg3.yahoo.com (106.10.128.7)  31.742 ms
13  et-17-1.fab2-1-gdc.sg3.yahoo.com (106.10.128.15)  28.638 ms et-18-25.fab2-1-gdc.sg3.yahoo.com (106.10.128.23)  28.222 ms et-18-25.fab4-1-gdc.sg3.yahoo.com (106.10.128.27)  30.916 ms
14  po-12.bas1-1-cld.sg3.yahoo.com (106.10.128.105)  43.451 ms po-9.bas2-1-cld.sg3.yahoo.com (106.10.128.107)  35.019 ms po-10.bas1-1-cld.sg3.yahoo.com (106.10.128.101)  49.408 ms
15  ats1.member.vip.sg3.yahoo.com (106.10.193.20)  33.763 ms  34.542 ms  34.558 ms

untuk menyembunyikan hop 1 (IP Mikrotik) dan hop 2 (IP router), di Mikrotik jalankan perintah

/ip firewall nat add action=change-ttl chain=prerouting new-ttl=increment:2 disabled=no

bila yang ingin disembunyikan hanya hop 1 (IP Mikrotik) ubah new-ttl=increment:2 menjadi new-ttl=increment:1.

Sekarang jalankan kembali traceroute

$ traceroute mail.yahoo.com
traceroute to mail.yahoo.com (106.10.193.20), 30 hops max, 60 byte packets
 1  121.subnet125-160-11.speedy.telkom.net.id (125.160.11.121)  5.310 ms  5.281 ms  5.519 ms
 2  61.94.171.69 (61.94.171.69)  5.375 ms  5.199 ms  5.436 ms
 3  180.240.193.42 (180.240.193.42)  33.158 ms 180.240.193.46 (180.240.193.46)  26.542 ms  26.458 ms
 4  180.240.193.45 (180.240.193.45)  26.487 ms  26.532 ms 180.240.193.41 (180.240.193.41)  24.605 ms
 5  180.240.204.5 (180.240.204.5)  24.506 ms  22.225 ms  28.406 ms
 6  180.240.204.22 (180.240.204.22)  28.147 ms  25.157 ms 180.240.204.6 (180.240.204.6)  24.197 ms
 7  pat1.sgy.yahoo.com (103.16.102.37)  25.899 ms  23.227 ms *
 8  * ae-5.msr2.sg3.yahoo.com (203.84.209.89)  22.350 ms  25.303 ms
 9  ae-3.clr2-a-gdc.sg3.yahoo.com (106.10.128.9)  32.317 ms ae-3.clr1-a-gdc.sg3.yahoo.com (106.10.128.7)  30.504 ms  30.657 ms
10  et-17-1.fab1-1-gdc.sg3.yahoo.com (106.10.128.13)  26.651 ms et-18-25.fab1-1-gdc.sg3.yahoo.com (106.10.128.21)  22.912 ms et-17-1.fab1-1-gdc.sg3.yahoo.com (106.10.128.13)  25.311 ms
11  po-10.bas2-1-cld.sg3.yahoo.com (106.10.128.109)  26.420 ms po-11.bas2-1-cld.sg3.yahoo.com (106.10.128.111)  45.999 ms po-9.bas1-1-cld.sg3.yahoo.com (106.10.128.99)  23.596 ms
12  ats1.member.vip.sg3.yahoo.com (106.10.193.20)  31.511 ms  29.304 ms  33.723 ms

Kalo dari Windows menggunakan tracert
traceroute ke yahoo.com

Restore

Bila anda ingin mengembalikan seperti semula, di Mikrotik jalankan

/ip firewall mangle print

contoh hasil perintah diatas

Flags: X - disabled, I - invalid, D - dynamic 
 0 XI  ; GPP
      chain=forward action=mark-packet new-packet-mark=IDM-LIMIT-packet passthrough=no protocol=tcp  layer7-protocol=Facebook log=no log-prefix="" 
 1 XI  chain=prerouting action=mark-packet new-packet-mark=upload passthrough=yes in-interface=ether1-internet log=no log-prefix="" 
 2 XI  chain=postrouting action=mark-packet new-packet-mark=download passthrough=yes out-interface=ether1-internet log=no log-prefix="" 
 3    chain=forward action=mark-connection new-connection-mark=local_conn passthrough=yes src-address-list=local log=no log-prefix="" 
 4    chain=forward action=accept log=no log-prefix="" 
 5 XI  chain=prerouting action=accept layer7-protocol=Talikom log=yes log-prefix="my.telkom.co.id" 
 6    chain=prerouting action=change-ttl new-ttl=increment:2 passthrough=yes log=no log-prefix=""

disana kelihatan rule yang baru kita tambah berada di no 6, hapus dengan cara

/ip firewall mangle remove numbers=6

Leave a comment

Your email address will not be published. Required fields are marked *