S5500 上联BR2005路由器访问外网

问题：

客户端vlan2(192.168.2.0/24)和vlan3(192.168.3.0/24)无法通过路由器访问互联网，路由跟踪到了网关就下不去了。

vlan2 网关：192.168.2.100， vlan3 网关：192.168.3.100, 默认vlan1网关：192.168.31.200。

两个VLAN客户端可以相互ping通，客户端也能ping通各自网关。

不知道是不是要在路由器上设置路由？具体怎么设置，请各位大拿指点，谢谢。

网络拓扑：

网络环境描述：

客户端有两个网段，通过DHCP从交换机S5500获取IP，S5500上联BR2005路由器，通过路由器访问外网。

S5500通过端口23连接路由器，端口23使用的是默认vlan1, vlan1 IP:192.168.31.200/24

交换机上设置了静态路由，下一跳是路由器IP：192.168.31.1，从交换机上可以访问互联网，但是客户端2个网段都无法访问互联网。

交换机配置如下：

 # version 5.20, Release 2221P15 # sysname H3C # clock timezone CST add 08:00:00 # dhcp relay server-group 1 ip 192.168.31.1 # irf mac-address persistent timer irf auto-update enable undo irf link-delay # domain default enable system # ipv6 # ip ttl-expires enable ip unreachables enable # password-recovery enable # vlan 1 # vlan 2 to 3 # domain system access-limit disable state active idle-cut disable self-service-url disable # dhcp server ip-pool vlan2 network 192.168.2.0 mask 255.255.255.0 network ip range 192.168.2.11 192.168.2.100 gateway-list 192.168.2.100 dns-list 202.101.172.35 # dhcp server ip-pool vlan3 network 192.168.3.0 mask 255.255.255.0 network ip range 192.168.3.11 192.168.3.200 gateway-list 192.168.3.100 dns-list 202.101.172.35 # user-group system group-attribute allow-guest # local-user admin password cipher $c$3$eMop8zbuiYOT0B2cOI15GByE+kh+j2hDCGm5vg== authorization-attribute level 3 service-type telnet service-type web # interface NULL0 # interface Vlan-interface1 ip address 192.168.31.200 255.255.255.0 dns server 202.101.172.35 # interface Vlan-interface2 ip address 192.168.2.100 255.255.255.0 dns server 202.101.172.35 # interface Vlan-interface3 ip address 192.168.3.100 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode bridge port access vlan 2 # interface GigabitEthernet1/0/2 port link-mode bridge port access vlan 2 # interface GigabitEthernet1/0/3 port link-mode bridge port access vlan 2 # interface GigabitEthernet1/0/4 port link-mode bridge port access vlan 2 # interface GigabitEthernet1/0/5 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/6 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/7 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/8 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/9 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/10 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/11 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/12 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/13 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/14 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/15 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/16 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/17 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/18 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/19 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/20 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/21 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/22 port link-mode bridge port access vlan 3 # interface GigabitEthernet1/0/23 port link-mode bridge # interface GigabitEthernet1/0/24 port link-mode bridge port link-type trunk port trunk permit vlan all # interface GigabitEthernet1/0/25 port link-mode bridge shutdown # interface GigabitEthernet1/0/26 port link-mode bridge shutdown # interface GigabitEthernet1/0/27 port link-mode bridge shutdown # interface GigabitEthernet1/0/28 port link-mode bridge shutdown # interface Ten-GigabitEthernet1/1/1 port link-mode bridge # interface Ten-GigabitEthernet1/1/2 port link-mode bridge # dhcp-snooping # ip route-static 0.0.0.0 0.0.0.0 192.168.31.1 # snmp-agent snmp-agent local-engineid 800063A2035CDD705B6C73 snmp-agent sys-info version v3 # dhcp server forbidden-ip 192.168.2.100 dhcp server forbidden-ip 192.168.3.100 # dhcp enable # ssh server enable # ip https enable # load xml-configuration # load tr069-configuration # user-interface aux 0 authentication-mode password set authentication password cipher $c$3$KUQd6SfIgoAJvr+Xt2hAATv06DHTkNJVO5bSOw== user-interface vty 0 4 user privilege level 3 set authentication password cipher $c$3$8s+nd++U3n2C6zq66t7/mpVk94XksZhFDCGjNQ== user-interface vty 5 15 # return