防火墙不允许从外部访问HTTP和https

我设置了安全策略是这样的，大家帮我看看对不对，也是社区里的朋友告诉我的，就是我自己不确定是不是这样，嘿嘿。

最后一条规则，从外部来的数据，不允许http和https通过。

# version 7.1.064, Release 9524P39

 # sysname H3C

 # context Admin id 1 

# irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1 

# 

 dhcp enable 

#

 password-recovery enable

# 

vlan 1 

# 

object-group ip address 内网 

 security-zone Trust 

 0 network subnet 192.168.10.0 255.255.255.0 

# 

dhcp server ip-pool 内网 

 gateway-list 192.168.10.1 

 network 192.168.10.0 mask 255.255.255.0 

 dns-list 114.114.114.114

 #

 controller Cellular1/0/0

 # 

interface NULL0 

#

 interface GigabitEthernet1/0/0 

 port link-mode route 

 ip address 192.168.0.1 255.255.255.0 

# 

interface GigabitEthernet1/0/1 

 port link-mode route 

# 

interface GigabitEthernet1/0/2 

 port link-mode route 

 ip address 192.168.2.1 255.255.255.0

 #

 interface GigabitEthernet1/0/3 

 port link-mode route

 # 

interface GigabitEthernet1/0/4 

 port link-mode route 

# 

interface GigabitEthernet1/0/5 

 port link-mode route 

# 

interface GigabitEthernet1/0/6 

 port link-mode route 

 ip address dhcp-alloc nat outbound 

# 

interface GigabitEthernet1/0/7

 port link-mode route

 ip address 192.168.10.1 255.255.255.0

gateway 192.168.10.1

 #

 security-zone name Local

 # 

security-zone name Trust

 import interface GigabitEthernet1/0/7

 # 

security-zone name DMZ 

# 

security-zone name Untrust 

 import interface GigabitEthernet1/0/6 

# 

security-zone name Management

 import interface GigabitEthernet1/0/0

import interface GigabitEthernet1/0/2

#

 scheduler logfile size 16

 #

 line class aux

 user-role network-operator

 # 

line class console 

 authentication-mode scheme 

 user-role network-admin 

#

 line class usb 

 user-role network-admin 

# l

ine class vty 

 user-role network-operator 

#

 line aux 0

 user-role network-admin

 # 

line con 0 

 user-role network-admin

 #

 line vty 0 63 

 authentication-mode scheme 

 user-role network-admin 

# 

 ip route-static 0.0.0.0 0 192.168.1.1

 #

 info-center source FILTER logfile deny

 # 

 ssh server enable 

# 

domain system

 #

 domain default enable system 

# 

role name level-0 

 description Predefined level-0 role 

# 

role name level-1 

 description Predefined level-1 role

 # 

role name level-2

 description Predefined level-2 role

 # 

role name level-3 

 description Predefined level-3 role

 # 

role name level-4 

 description Predefined level-4 role 

# 

role name level-5 

 description Predefined level-5 role

 # 

role name level-6 

 description Predefined level-6 role

 #

 role name level-7 

 description Predefined level-7 role

 #

 role name level-8

 description Predefined level-8 role 

# 

role name level-9

 description Predefined level-9 role

 # 

role name level-10 

 description Predefined level-10 role 

#

 role name level-11

 description Predefined level-11 role 

#

 role name level-12 

 description Predefined level-12 role 

# 

role name level-13 

 description Predefined level-13 role

 #

 role name level-14

 description Predefined level-14 role 

# 

user-group system 

#

 local-user admin class manage 

 password hash $h$6$7L/fFXXXqxDrHn8o$DWbu4G9oCJXHDgGiRIUb1oTxOQu88ecY35Y7qy6BssYGhEz1mgZt7pKFv+OZQ2qMGYEdlYm2xdG9xRrSktaKGA== 

 service-type ssh terminal https 

 authorization-attribute user-role level-3

 authorization-attribute user-role network-admin 

 authorization-attribute user-role network-operator

 #

 session synchronization enable 

 session synchronization http 

#

 ipsec logging negotiation enable 

#

 ike logging negotiation enable 

#

 ip https enable 

# 

 loadbalance isp file flash:/lbispinfo_v1.5.tp 

#

 security-policy ip 

 rule 0 name 出

 action pass 

 source-zone Trust

 destination-zone Untrust 

 source-ip 内网 

 rule 1 name 互通 

 action pass 

 source-zone Local 

 source-zone Trust

 destination-zone Trust 

 destination-zone Local 

 rule 2 name 出1

 action pass 

 source-zone Local 

 destination-zone Untrust

 rule 3 name 入 

 source-zone Untrust

 destination-zone Trust

 service http 

 service https

 #

 return