H3C M9000，配置域间安全策略，公网ssh还是无法远程登陆untrust接口IP地址

我现在遇到的问题是PC机穿过一个网络后登陆防火墙的untrust接口地址，且PC机和防火墙的untrust接口地址不在一个网段内。如何配置域间安全策略？让PC A机可以ssh远程登陆防火墙untrust接口地址10.10.10.1/24，拓扑图简单如下图所示：   

我已经放通了untrust到local，local到untrust的策略，但还是不能ssh登陆，我做的策略如下，请判断一下有什么地方不对呢：

[H3C] interface Ten-GigabitEthernet2/5/0/1 

[H3C-Ten-GigabitEthernet2/5/0/1] port link-mode route 

[H3C-Ten-GigabitEthernet2/5/0/1] ip address 10.10.10.1 255.255.255.0

[H3C] security-zone name Untrust 

[H3C-security-zone-Untrust] import interface Ten-GigabitEthernet2/5/0/1 

[H3C-security-zone-Untrust] quit

[H3C] acl number 3998 

[H3C-acl-adv-3998] rule 1 permit ip 

[H3C-acl-adv-3998] quit

[H3C] zone-pair security source Local destination Untrust

[H3C-zone-pair-security-Local-Untrust] packet-filter 3998

[H3C-zone-pair-security-Local-Untrust] quit

[H3C] acl number 3999

[H3C-acl-adv-3999] rule 0 permit ip destination 10.10.10.1 0 source any

[H3C-acl-adv-3999] quit

[H3C] zone-pair security source Untrust destination local

[H3C-zone-pair-security-Untrust-Local] packet-filter 3999

[H3C-zone-pair-security-Untrust-Local] quit