V7防火墙的问题求解

1. 防火墙可以正常ping 公网IP 但是ping不通公网网关（防火墙G3口）

2. 本地PC问题一样（防火墙G3口）

3 .外网L2TP vpn用户无法拨号（防火墙G3口）之前可以

4. 从外面ping不通公网IP（防火墙G3口）

公网IP配在本地PC上上网都正常

配置如下

#
 version 7.1.064, Release 9323P16
#
 sysname F1030
#
context Admin id 1
#
 telnet server enable
#
 irf mac-address persistent timer
 irf auto-update enable
 undo irf link-delay
 irf member 1 priority 1
#
 security-zone intra-zone default permit
#
 security-policy disable
#
 ip pool aaa 192.168.100.2 192.168.100.254
 ip pool aaa gateway 192.168.100.1
#
 dhcp enable
#
 dns server 218.104.111.122
 dns server 10.0.0.145
#
 password-recovery enable
#
vlan 1
#
vlan 10
#
vlan 16
#
object-group ip address 16
 security-zone Trust
 0 network subnet 192.168.16.0 255.255.252.0
#
object-group service 1701
 0 service udp destination eq 1701
#
dhcp server ip-pool 16
 gateway-list 192.168.16.101
 network 192.168.16.0 mask 255.255.252.0
 address range 192.168.18.10 192.168.19.250
 dns-list 218.104.111.122
 expired day 0 hour 8
#
interface Virtual-Template1
 ppp authentication-mode chap domain system
 remote address pool aaa
 ip address 192.168.100.1 255.255.255.0
#
interface NULL0
#
interface Vlan-interface16
 description 16涓-19涓氬姟缃?
 ip address 192.168.16.101 255.255.252.0
 dhcp server apply ip-pool 16
#
interface GigabitEthernet1/0/0
 port link-mode route
 ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-mode route
 shutdown
 ip address 61.184.91.210 255.255.255.248
 nat outbound
#
interface GigabitEthernet1/0/2
 port link-mode route
 ip address 10.248.0.181 255.255.252.0
 nat outbound
#
interface GigabitEthernet1/0/3
 port link-mode route
 ip address 113.23.35.100 255.255.255.240
 nat outbound
 nat server protocol tcp global 113.23.35.100 81 inside 192.168.201.2 81
#
interface GigabitEthernet1/0/5
 port link-mode route
 ip address 192.168.10.2 255.255.255.0
#
interface GigabitEthernet1/0/10
 port link-mode route
#
interface GigabitEthernet1/0/11
 port link-mode route
#
interface GigabitEthernet1/0/12
 port link-mode route
#
interface GigabitEthernet1/0/13
 port link-mode route
#
interface GigabitEthernet1/0/14
 port link-mode route
#
interface GigabitEthernet1/0/15
 port link-mode route
#
interface GigabitEthernet1/0/16
 port link-mode route
#
interface GigabitEthernet1/0/17
 port link-mode route
#
interface GigabitEthernet1/0/18
 port link-mode route
#
interface GigabitEthernet1/0/19
 port link-mode route
#
interface GigabitEthernet1/0/20
 port link-mode route
#
interface GigabitEthernet1/0/21
 port link-mode route
#
interface GigabitEthernet1/0/22
 port link-mode route
#
interface GigabitEthernet1/0/23
 port link-mode route
#
interface GigabitEthernet1/0/4
 port link-mode bridge
 port link-type trunk
 port trunk permit vlan all
#
interface GigabitEthernet1/0/6
 port link-mode bridge
 port access vlan 16
#
interface GigabitEthernet1/0/7
 port link-mode bridge
 port access vlan 16
#
interface GigabitEthernet1/0/8
 port link-mode bridge
 port access vlan 16
#
interface GigabitEthernet1/0/9
 port link-mode bridge
 port access vlan 16
#
object-policy ip 1701
 rule 0 pass service 1701
#
object-policy ip pass
 rule 0 pass
#
security-zone name Local
#
security-zone name Trust
 import interface GigabitEthernet1/0/5
 import interface Vlan-interface16
 import interface GigabitEthernet1/0/4 vlan 1 to 4094
 import interface GigabitEthernet1/0/6 vlan 1 to 4094
 import interface GigabitEthernet1/0/7 vlan 1 to 4094
 import interface GigabitEthernet1/0/8 vlan 1 to 4094
 import interface GigabitEthernet1/0/9 vlan 1 to 4094
 import vlan 16
#
security-zone name DMZ
#
security-zone name Untrust
 import interface GigabitEthernet1/0/1
 import interface GigabitEthernet1/0/2
 import interface GigabitEthernet1/0/3
 import interface Virtual-Template1
#
security-zone name Management
 import interface GigabitEthernet1/0/0
#
zone-pair security source Local destination Trust
 object-policy apply ip pass
#
zone-pair security source Local destination Untrust
 object-policy apply ip 1701
#
zone-pair security source Trust destination Local
 object-policy apply ip pass
#
zone-pair security source Trust destination Untrust
 object-policy apply ip pass
#
zone-pair security source Untrust destination Local
 object-policy apply ip 1701
#
 scheduler logfile size 16
#
line class aux
 user-role network-operator
#
line class console
 authentication-mode scheme
 user-role network-admin
#
line class vty
 user-role network-operator
#
line aux 0
 user-role network-admin
#
line con 0
 user-role network-admin
#
line vty 0 63
 authentication-mode scheme
 user-role network-admin
#
 ip route-static 0.0.0.0 0 113.23.35.97
 ip route-static 0.0.0.0 0 192.168.10.1
#
 ssh server enable
#
domain system
#
 aaa session-limit ftp 16
 aaa session-limit telnet 16
 aaa session-limit ssh 16
 domain default enable system
#
role name level-0
 description Predefined level-0 role
#
role name level-1
 description Predefined level-1 role
#
role name level-2
 description Predefined level-2 role
#
role name level-3
 description Predefined level-3 role
#
role name level-4
 description Predefined level-4 role
#
role name level-5
 description Predefined level-5 role
#
role name level-6
 description Predefined level-6 role
#
role name level-7
 description Predefined level-7 role
#
role name level-8
 description Predefined level-8 role
#
role name level-9
 description Predefined level-9 role
#
role name level-10
 description Predefined level-10 role
#
role name level-11
 description Predefined level-11 role
#
role name level-12
 description Predefined level-12 role
#
role name level-13
 description Predefined level-13 role
#
role name level-14
 description Predefined level-14 role
#
user-group system
#
local-user admin class manage
 password hash $h$6$jwtwPSfcpKAxlWrd$zqp81fd8pZLxCiTsBeAj5FpA7gIDXjMXnzV59qzLz5JvpWe+39ukMjBL1tX5p4FKZabenLbrIMMOK2qWbq6XaQ==
 service-type ssh telnet terminal https
 authorization-attribute user-role level-3
 authorization-attribute user-role network-admin
 authorization-attribute user-role network-operator
#
local-user manager class manage
 password hash $h$6$j5PfkcdY6t/PYOPl$JEqa6f+y/6+JprfR1U/ZgRIwkXgO1ZdoHD0X1zgNsCIbTMt3xHDbc60l/8I9DtmPR5b9jXGklHIBY6dHvQ5BTw==
 service-type telnet
 authorization-attribute user-role network-admin
 authorization-attribute user-role network-operator
#
local-user user01 class network
 password cipher $c$3$BU235UsABNe6rMTT2gzvGuM/o69/iC7/OQ==
 service-type ppp
 authorization-attribute user-role network-operator
#
local-user user02 class network
 password cipher $c$3$Ic+7JqQF7KT5iFv0JQZ3wTWL9WFosSppiA==
 service-type ppp
 authorization-attribute user-role network-operator
#
local-user vpdnuser class network
 password cipher $c$3$H098jCnmvdHAvOgfls/oJeB8nJVQL7+A
 service-type ppp
 authorization-attribute user-role network-operator
#
 session statistics enable
#
l2tp-group 1 mode lns
 allow l2tp virtual-template 1
 undo tunnel authentication
 tunnel name LNS
#
 l2tp enable
#
 ip https enable
 webui log enable
#
traffic-policy
 rule name 16
  action qos profile 下行5M/IP
  source-address address-set 16
  source-zone Trust
  destination-zone Untrust
 profile name 下行5M/IP
  bandwidth downstream maximum per-ip 5000
#
uapp-control
#
security-policy ip
 rule 0 name 10
  action pass
  source-zone Trust
  destination-zone Untrust
  destination-zone DMZ
  destination-zone Local
 rule 1 name 11
  action pass
  source-zone Untrust
  destination-zone Local
 rule 2 name 12
  action pass
  source-zone Untrust
  destination-zone Trust
 rule 3 name 13
  action pass
  source-zone Local
  destination-zone Untrust
 rule 4 name 14
  action pass
  source-zone Untrust
  destination-zone Untrust
#
return