Media Pembelajaran Keamanan Jaringan

🎓 Selamat Datang

UKK TKJ 2025/2026 - SMK XYZ

Platform pembelajaran interaktif untuk membangun sistem monitoring jaringan dan server real-time dengan fokus pada keamanan dan performa.

🔧

Topologi

3 VLAN

🖥️

Perangkat

5 Device

📚

Materi

9 Modul

📝

Quiz

10 Soal

📋

Overview

Deskripsi proyek & masalah

Mulai →

🌐

Topologi

Diagram jaringan interaktif

Lihat →

🔀

VLAN Config

Konfigurasi MikroTik & Switch

Pelajari →

🌍

DNS Server

BIND9 & Zone Files

Setup →

🌐

Apache2 Web

VirtualHost & Web Server

Setup →

📊

Monitoring

SNMP, Apache & Cacti

Setup →

🔒

Hardening

Firewall & Keamanan

Amankan →

📝

Quiz

10 Soal Evaluasi

Mulai →

🎯 Deskripsi Proyek

SMK XYZ ingin membangun laboratorium jaringan yang aman dengan pemisahan akses antara Guru/Admin, Siswa, dan Server.

⚠️ Masalah yang Dihadapi:

• Belum ada segmentasi VLAN
• Belum ada sistem monitoring
• Tidak ada kebijakan keamanan dan pencatatan aset TI
• Terjadi insiden keamanan seperti brute force dan server lambat

✅ Tugas Anda:

Membangun sistem keamanan dan monitoring real-time sebagai Junior Cyber Security.

🖥️ Server Info

IP Address: 192.168.200.201

Domain: ujang-ciksel.sch

Monitor: monitor.ujang-ciksel.sch

OS: Debian 12

🔧 Perangkat

Router: MikroTik RB 951

Switch: Ruijie Managed

Server: Debian 12

🔀 Skema VLAN

👨‍🏫

VLAN 10

Guru/Admin

Network: 192.168.100.0/24

Gateway: 192.168.100.1

Port Switch: Port 2

👨‍🎓

VLAN 20

Siswa

Network: 192.168.150.0/24

Gateway: 192.168.150.1

Port Switch: Port 3-4

🖥️

VLAN 30

Server

Network: 192.168.200.0/24

Gateway: 192.168.200.1

Port Switch: Port 5

🌐 Topologi Jaringan

👆 Klik pada komponen topologi untuk melihat detail

🔀 Konfigurasi VLAN

📌 Step 1: Buat VLAN Interface

Login ke MikroTik via Winbox atau SSH, lalu buat interface VLAN

/interface vlan
add interface=ether2 name=vlan10 vlan-id=10
add interface=ether2 name=vlan20 vlan-id=20
add interface=ether2 name=vlan30 vlan-id=30

📌 Step 2: Konfigurasi IP Address

Tambahkan IP Address untuk setiap VLAN sebagai gateway

/ip address
add address=192.168.100.1/24 interface=vlan10 comment="Gateway VLAN 10 - Guru"
add address=192.168.150.1/24 interface=vlan20 comment="Gateway VLAN 20 - Siswa"
add address=192.168.200.1/24 interface=vlan30 comment="Gateway VLAN 30 - Server"

📌 Step 3: Konfigurasi DHCP Server

Setup DHCP untuk VLAN 10 dan VLAN 20

# DHCP Pool VLAN 10
/ip pool add name=pool-vlan10 ranges=192.168.100.10-192.168.100.254
/ip dhcp-server add name=dhcp-vlan10 interface=vlan10 address-pool=pool-vlan10
/ip dhcp-server network add address=192.168.100.0/24 gateway=192.168.100.1 dns-server=192.168.200.201

# DHCP Pool VLAN 20
/ip pool add name=pool-vlan20 ranges=192.168.150.10-192.168.150.254
/ip dhcp-server add name=dhcp-vlan20 interface=vlan20 address-pool=pool-vlan20
/ip dhcp-server network add address=192.168.150.0/24 gateway=192.168.150.1 dns-server=192.168.200.201

📌 Step 4: Konfigurasi NAT

Setup NAT Masquerade untuk akses internet

/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade comment="NAT untuk Internet"

Step 1: Buat VLAN di Switch Ruijie

Login ke Switch Ruijie via console atau web, lalu buat VLAN

Ruijie> enable
Ruijie# configure terminal
Ruijie(config)# vlan 10
Ruijie(config-vlan)# name GURU
Ruijie(config-vlan)# exit
Ruijie(config)# vlan 20
Ruijie(config-vlan)# name SISWA
Ruijie(config-vlan)# exit
Ruijie(config)# vlan 30
Ruijie(config-vlan)# name SERVER
Ruijie(config-vlan)# exit

📌 Step 2: Konfigurasi Port Trunk

Konfigurasi port ke Router sebagai Trunk

Ruijie(config)# interface gigabitEthernet 0/1
Ruijie(config-if)# switchport mode trunk
Ruijie(config-if)# switchport trunk allowed vlan 10,20,30
Ruijie(config-if)# exit

📌 Step 3: Konfigurasi Port Access

Assign port ke masing-masing VLAN

# Port 2 untuk VLAN 10 (Guru)
Ruijie(config)# interface gigabitEthernet 0/2
Ruijie(config-if)# switchport mode access
Ruijie(config-if)# switchport access vlan 10
Ruijie(config-if)# exit

# Port 3-4 untuk VLAN 20 (Siswa)
Ruijie(config)# interface range gigabitEthernet 0/3-4
Ruijie(config-if-range)# switchport mode access
Ruijie(config-if-range)# switchport access vlan 20
Ruijie(config-if-range)# exit

# Port 5 untuk VLAN 30 (Server)
Ruijie(config)# interface gigabitEthernet 0/5
Ruijie(config-if)# switchport mode access
Ruijie(config-if)# switchport access vlan 30
Ruijie(config-if)# exit

📌 Step 4: Simpan Konfigurasi

Ruijie(config)# end
Ruijie# write memory
Building configuration...
[OK]

🌍 Konfigurasi DNS Server BIND9

💡

Remote SSH ke Server Debian 12

Buka PowerShell di Windows 11, kemudian jalankan:

ssh root@192.168.200.201

📌 Step 1: Install BIND9

apt update
apt install bind9 bind9utils bind9-doc -y

📌 Step 2: Konfigurasi named.conf.local

Edit file: /etc/bind/named.conf.local

nano /etc/bind/named.conf.local

Isi dengan konfigurasi berikut:

// Forward Zone
zone "ujang-ciksel.sch" {
    type master;
    file "/etc/bind/db.ujang-ciksel";
};

// Reverse Zone
zone "200.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/db.192";
};

📌 Step 3: Buat File Zone Forward (db.ujang-ciksel)

nano /etc/bind/db.ujang-ciksel

Isi dengan konfigurasi berikut:

;
; BIND data file for ujang-ciksel.sch
;
$TTL    604800
@       IN      SOA     ujang-ciksel.sch. root.ujang-ciksel.sch. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns.ujang-ciksel.sch.
@       IN      A       192.168.200.201
ns      IN      A       192.168.200.201
www     IN      A       192.168.200.201
monitor IN      A       192.168.200.201

📌 Step 4: Buat File Zone Reverse (db.192)

nano /etc/bind/db.192

Isi dengan konfigurasi berikut:

;
; BIND reverse data file for 192.168.200.x
;
$TTL    604800
@       IN      SOA     ujang-ciksel.sch. root.ujang-ciksel.sch. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns.ujang-ciksel.sch.
201     IN      PTR     ujang-ciksel.sch.
201     IN      PTR     www.ujang-ciksel.sch.
201     IN      PTR     monitor.ujang-ciksel.sch.

📌 Step 5: Verifikasi dan Restart BIND9

# Cek konfigurasi
named-checkconf
named-checkzone ujang-ciksel.sch /etc/bind/db.ujang-ciksel
named-checkzone 200.168.192.in-addr.arpa /etc/bind/db.192

# Restart service
systemctl restart bind9
systemctl enable bind9
systemctl status bind9

✅ Test DNS

# Test dari server
nslookup ujang-ciksel.sch 192.168.200.201
nslookup monitor.ujang-ciksel.sch 192.168.200.201
nslookup 192.168.200.201 192.168.200.201

🌐 Konfigurasi Apache2 Web Server

💡

Remote SSH ke Server Debian 12

Buka PowerShell di Windows 11, kemudian jalankan:

ssh root@192.168.200.201

📌 Step 1: Install BIND9

apt update
apt install bind9 bind9utils bind9-doc -y

📌 Step 2: Konfigurasi named.conf.local

Edit file: /etc/bind/named.conf.local

nano /etc/bind/named.conf.local

Isi dengan konfigurasi berikut:

// Forward Zone
zone "ujang-ciksel.sch" {
    type master;
    file "/etc/bind/db.ujang-ciksel";
};

// Reverse Zone
zone "200.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/db.192";
};

📌 Step 3: Buat File Zone Forward (db.ujang-ciksel)

nano /etc/bind/db.ujang-ciksel

Isi dengan konfigurasi berikut:

;
; BIND data file for ujang-ciksel.sch
;
$TTL    604800
@       IN      SOA     ujang-ciksel.sch. root.ujang-ciksel.sch. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns.ujang-ciksel.sch.
@       IN      A       192.168.200.201
ns      IN      A       192.168.200.201
www     IN      A       192.168.200.201
monitor IN      A       192.168.200.201

📌 Step 4: Buat File Zone Reverse (db.192)

nano /etc/bind/db.192

Isi dengan konfigurasi berikut:

;
; BIND reverse data file for 192.168.200.x
;
$TTL    604800
@       IN      SOA     ujang-ciksel.sch. root.ujang-ciksel.sch. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns.ujang-ciksel.sch.
201     IN      PTR     ujang-ciksel.sch.
201     IN      PTR     www.ujang-ciksel.sch.
201     IN      PTR     monitor.ujang-ciksel.sch.

📌 Step 5: Verifikasi dan Restart BIND9

# Cek konfigurasi
named-checkconf
named-checkzone ujang-ciksel.sch /etc/bind/db.ujang-ciksel
named-checkzone 200.168.192.in-addr.arpa /etc/bind/db.192

# Restart service
systemctl restart bind9
systemctl enable bind9
systemctl status bind9

✅ Test DNS

# Test dari server
nslookup ujang-ciksel.sch 192.168.200.201
nslookup monitor.ujang-ciksel.sch 192.168.200.201
nslookup 192.168.200.201 192.168.200.201

📊 Konfigurasi Monitoring (SNMP & Cacti)

⚠️ PENTING: Install SNMP SEBELUM Cacti!

SNMP harus dikonfigurasi di server dan router agar Cacti dapat mengambil data monitoring.

📌 Step 1: Install SNMP di Debian 12

apt update
apt install snmp snmpd -y

📌 Step 2: Backup Konfigurasi SNMP

cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.backup

📌 Step 3: Edit Konfigurasi SNMPD

nano /etc/snmp/snmpd.conf

Cari dan ubah baris berikut:

# Ubah agentAddress agar listen di semua interface
agentAddress udp:161,udp6:[::1]:161

# Tambahkan atau ubah baris rocommunity
rocommunity public 192.168.200.0/24
rocommunity public localhost

# Konfigurasi system info
sysLocation    "SMK XYZ Server Room"
sysContact     admin@ujang-ciksel.sch
sysName        server-ujang

📌 Step 4: Restart SNMPD

systemctl restart snmpd
systemctl enable snmpd
systemctl status snmpd

📌 Step 5: Test SNMP

# Test SNMP localhost
snmpwalk -v2c -c public localhost system

# Test SNMP dengan IP
snmpwalk -v2c -c public 192.168.200.201 system

📌 Step 6: Aktifkan SNMP di MikroTik

Login ke MikroTik dan jalankan:

/snmp set enabled=yes
/snmp community set 0 name=public addresses=192.168.200.0/24
/snmp set contact="admin@ujang-ciksel.sch" location="SMK XYZ"

📌 Step 1: Install Apache2

apt install apache2 -y
systemctl enable apache2
systemctl start apache2

📌 Step 2: Buat VirtualHost untuk ujang-ciksel.sch

nano /etc/apache2/sites-available/000-default.conf

Ubah isi file menjadi:

<VirtualHost *:80>
    ServerAdmin admin@ujang-ciksel.sch
    ServerName ujang-ciksel.sch
    ServerAlias www.ujang-ciksel.sch
    DocumentRoot /var/www/html
    
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin admin@ujang-ciksel.sch
    ServerName monitor.ujang-ciksel.sch
    DocumentRoot /usr/share/cacti/site
    
    <Directory /usr/share/cacti/site>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    
    ErrorLog ${APACHE_LOG_DIR}/cacti-error.log
    CustomLog ${APACHE_LOG_DIR}/cacti-access.log combined
</VirtualHost>

📌 Step 3: Buat Halaman Web Utama

nano /var/www/html/index.html

Isi dengan halaman sederhana:

<!DOCTYPE html>
<html>
<head>
    <title>Webserver Debian 12 - ujang-ciksel.sch</title>
    <style>
        body { font-family: Arial, sans-serif; text-align: center; margin-top: 50px; }
        h1 { color: #2c3e50; }
        .info { background: #ecf0f1; padding: 20px; margin: 20px auto; max-width: 600px; border-radius: 10px; }
    </style>
</head>
<body>
    <h1>🖥️ Selamat Datang di Webserver Debian 12</h1>
    <div class="info">
        <h2>ujang-ciksel.sch</h2>
        <p>Server IP: 192.168.200.201</p>
        <p>SMK XYZ - UKK TKJ 2025/2026</p>
        <p><a href="http://monitor.ujang-ciksel.sch">📊 Monitoring Cacti</a></p>
    </div>
</body>
</html>

📌 Step 4: Restart Apache2

systemctl restart apache2
systemctl status apache2

ℹ️ Prerequisite

Pastikan SNMP dan Apache2 sudah terinstall dan berjalan sebelum install Cacti.

📌 Step 1: Install MariaDB

apt install mariadb-server mariadb-client -y
systemctl enable mariadb
systemctl start mariadb

# Amankan MariaDB
mysql_secure_installation

📌 Step 2: Install PHP dan Dependencies

apt install php php-mysql php-snmp php-xml php-mbstring php-json php-gd php-gmp php-ldap php-intl -y

📌 Step 3: Install RRDtool dan Cacti

apt install rrdtool cacti -y

Saat instalasi, pilih:

• Web server: apache2
• Configure database: Yes
• Password database: (masukkan password)

📌 Step 4: Konfigurasi Timezone PHP

nano /etc/php/8.2/apache2/php.ini

# Cari dan ubah baris:
date.timezone = Asia/Jakarta

📌 Step 5: Restart Services

systemctl restart apache2
systemctl restart mariadb

✅ Akses Cacti

Buka browser dan akses:

http://monitor.ujang-ciksel.sch

atau

http://192.168.200.201/cacti

Default login:

Username: admin

Password: admin (ubah saat pertama login)

📌 Step 6: Tambah Device di Cacti

Setelah login ke Cacti:

1. Klik Create → New Device
2. Tambahkan Server Debian:
- • Description: Server Debian 12
- • Hostname: 192.168.200.201
- • SNMP Version: Version 2
- • SNMP Community: public
3. Tambahkan Router MikroTik:
- • Description: MikroTik RB 951
- • Hostname: 192.168.200.1
- • SNMP Version: Version 2
- • SNMP Community: public
4. Buat Graph untuk CPU dan Memory

🔒 Hardening & Keamanan Sistem

🛡️ Firewall MikroTik

# Block VLAN 20 ke VLAN 10

/ip firewall filter
add chain=forward src-address=192.168.150.0/24 \
    dst-address=192.168.100.0/24 action=drop \
    comment="Block Siswa ke Guru"

# SSH hanya dari VLAN 10 & 30

add chain=input protocol=tcp dst-port=22 \
    src-address=192.168.100.0/24 action=accept
add chain=input protocol=tcp dst-port=22 \
    src-address=192.168.200.0/24 action=accept
add chain=input protocol=tcp dst-port=22 action=drop

# Enable Logging

/system logging
add topics=firewall action=memory

🐧 Hardening Debian 12

# Install UFW Firewall

apt install ufw -y
ufw default deny incoming
ufw default allow outgoing
ufw allow from 192.168.100.0/24 to any port 22
ufw allow from 192.168.200.0/24 to any port 22
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 53/tcp
ufw allow 53/udp
ufw enable

# Disable DNS Recursion untuk VLAN 20

# Edit /etc/bind/named.conf.options
options {
    recursion yes;
    allow-recursion { 
        192.168.100.0/24; 
        192.168.200.0/24; 
        localhost; 
    };
};

📋 Kebijakan Keamanan Informasi

🔑 Password Policy

• Minimum 8 karakter
• Kombinasi huruf besar, kecil, angka, simbol
• Ganti password setiap 90 hari
• Tidak boleh menggunakan password sebelumnya

🌐 Kebijakan Internet

• VLAN Siswa: Akses terbatas jam sekolah
• Blokir situs berbahaya dan sosmed
• Bandwidth limit untuk streaming
• Logging aktivitas browsing

💾 Backup Policy

• Backup konfigurasi router harian
• Backup database mingguan
• Simpan di lokasi terpisah
• Test restore bulanan

🚨 Incident Response

• Isolasi perangkat terinfeksi
• Dokumentasi insiden
• Analisis root cause
• Laporan ke manajemen

📝 Quiz Pemahaman

Progress: 0/10

🎓 Selamat Datang

Overview

Topologi

VLAN Config

DNS Server

Apache2 Web

Monitoring

Hardening

Quiz

🎯 Deskripsi Proyek

⚠️ Masalah yang Dihadapi:

✅ Tugas Anda:

🖥️ Server Info

🔧 Perangkat

🔀 Skema VLAN

VLAN 10

VLAN 20

VLAN 30

🌐 Topologi Jaringan

🔀 Konfigurasi VLAN

📌 Step 1: Buat VLAN Interface

📌 Step 2: Konfigurasi IP Address

📌 Step 3: Konfigurasi DHCP Server

📌 Step 4: Konfigurasi NAT

Step 1: Buat VLAN di Switch Ruijie

📌 Step 2: Konfigurasi Port Trunk

📌 Step 3: Konfigurasi Port Access

📌 Step 4: Simpan Konfigurasi

🌍 Konfigurasi DNS Server BIND9

📌 Step 1: Install BIND9

📌 Step 2: Konfigurasi named.conf.local

📌 Step 3: Buat File Zone Forward (db.ujang-ciksel)

📌 Step 4: Buat File Zone Reverse (db.192)

📌 Step 5: Verifikasi dan Restart BIND9

✅ Test DNS

🌐 Konfigurasi Apache2 Web Server

📌 Step 1: Install BIND9

📌 Step 2: Konfigurasi named.conf.local

📌 Step 3: Buat File Zone Forward (db.ujang-ciksel)

📌 Step 4: Buat File Zone Reverse (db.192)

📌 Step 5: Verifikasi dan Restart BIND9

✅ Test DNS

📊 Konfigurasi Monitoring (SNMP & Cacti)

📌 Step 1: Install SNMP di Debian 12

📌 Step 2: Backup Konfigurasi SNMP

📌 Step 3: Edit Konfigurasi SNMPD

📌 Step 4: Restart SNMPD

📌 Step 5: Test SNMP

📌 Step 6: Aktifkan SNMP di MikroTik

📌 Step 1: Install Apache2

📌 Step 2: Buat VirtualHost untuk ujang-ciksel.sch

📌 Step 3: Buat Halaman Web Utama

📌 Step 4: Restart Apache2

📌 Step 1: Install MariaDB

📌 Step 2: Install PHP dan Dependencies

📌 Step 3: Install RRDtool dan Cacti

📌 Step 4: Konfigurasi Timezone PHP

📌 Step 5: Restart Services

✅ Akses Cacti

📌 Step 6: Tambah Device di Cacti

🔒 Hardening & Keamanan Sistem

🛡️ Firewall MikroTik

🐧 Hardening Debian 12

📋 Kebijakan Keamanan Informasi

🔑 Password Policy

🌐 Kebijakan Internet

💾 Backup Policy

🚨 Incident Response

📝 Quiz Pemahaman

Quiz Selesai!