F100-S-G acl中deny了的ip段还是能访问外网，请问如何解决？

#
 version 5.20, Release 5142P02
#
 sysname chengdu
#
 clock timezone Beijing add 08:00:00
#
 undo voice vlan mac-address 00e0-bb00-0000
#
 ike local-name chengdu
#
 interzone policy default by-priority
#
 domain default enable system
#
 telnet server enable
#
 port-security enable
#
 undo alg dns
 undo alg rtsp
 undo alg h323
 undo alg sip
 undo alg sqlnet
 undo alg pptp
 undo alg ils
 undo alg nbt
 undo alg msn
 undo alg qq
 undo alg tftp
 undo alg sccp
 undo alg gtp
#
session synchronization enable
#
 password-recovery enable
#
acl number 3000
 rule 0 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.0.0 0.0.0.255
 rule 1 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.111.0 0.0.0.255
 rule 2 permit ip source 192.168.2.0 0.0.0.255 destination 47.98.104.125 0
 rule 3 permit ip source 192.168.2.0 0.0.0.255 destination 116.62.215.145 0
 rule 4 permit ip source 192.168.2.0 0.0.0.255 destination 116.62.126.211 0
 rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 47.99.224.84 0
 rule 20 permit ip source 192.168.20.0 0.0.0.255
 rule 30 deny ip
acl number 3001
 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.0 0.0.0.255
acl number 3002
 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.111.0 0.0.0.2
55
#
vlan 1
#
domain system
 access-limit disable
 state active
 idle-cut disable
 self-service-url disable
#
pki domain default
  crl check disable
#
ike proposal 11
#
ike proposal 12
 encryption-algorithm 3des-cbc
 dh group2
 authentication-algorithm md5
#
ike peer chengdu
 exchange-mode aggressive
 proposal 11
 pre-shared-key cipher $c$3$0LsNcZVrkUfqgwmhirY6b+FXy6zeRClAjF4+eSf6pOw=
 id-type name
 remote-name hangzhou
 remote-address 124.160.92.178
 local-name chengdu
 nat traversal
#
ike peer chengdu12
 exchange-mode aggressive
 proposal 12
 pre-shared-key cipher $c$3
 id-type name
 remote-name shimaozhongxin
 remote-address 60.191.109.90
 local-name chengdu12
 nat traversal
#
ipsec transform-set 1
 encapsulation-mode tunnel
 transform esp
 esp authentication-algorithm md5
 esp encryption-algorithm des
#
ipsec transform-set 12
 encapsulation-mode tunnel
 transform esp
 esp authentication-algorithm md5
 esp encryption-algorithm 3des
#
ipsec policy chengdu 10 isakmp
 security acl 3001
 ike-peer chengdu
 transform-set 1
#
ipsec policy chengdu 12 isakmp
 security acl 3002
 ike-peer chengdu12
 transform-set 12
#
user-group system
 group-attribute allow-guest
#
local-user admin
 password cipher $c$3
 authorization-attribute level 3
 service-type telnet
 service-type web
#
cwmp
 undo cwmp enable
#
interface Dialer1
 nat outbound 3000
 link-protocol ppp
 ppp chap user CD83375221
 ppp chap password cipher $c$3$
 ppp pap local-user CD83375221 password cipher $c$
TM5IA+qb
 ppp ipcp dns request
 mtu 1400
 ip address ppp-negotiate
 tcp mss 1024
 dialer user cd83375221
 dialer user pppoeclient
 dialer-group 1
 dialer bundle 1
 dialer timer idle 0
 ipsec policy chengdu
#
interface NULL0
#
interface GigabitEthernet0/0
 port link-mode route
 ip address 172.12.12.1 255.255.255.0
#
interface GigabitEthernet0/1
 port link-mode route
 pppoe-client dial-bundle-number 1
#
interface GigabitEthernet0/2
 port link-mode route
 ip address 10.0.0.1 255.255.255.0
#
interface GigabitEthernet0/3
 port link-mode route
#
interface GigabitEthernet0/4
 port link-mode route
#
vd Root id 1
#
zone name Management id 0
 priority 100
 import interface GigabitEthernet0/0
zone name Local id 1
 priority 100
zone name Trust id 2
 priority 85
 import interface GigabitEthernet0/2
zone name DMZ id 3
 priority 50
zone name Untrust id 4
 priority 5
 import interface Dialer1
 import interface GigabitEthernet0/1
switchto vd Root
 object network subnet da
  subnet 192.168.0.0 0.0.0.255
 object network subnet nw
  subnet 192.168.2.0 0.0.0.255
 object network subnet sm
  subnet 192.168.111.0 0.0.0.255
 object service 3389
  service tcp destination-port 3389
 zone name Management id 0
 ip virtual-reassembly
 zone name Local id 1
 ip virtual-reassembly
 zone name Trust id 2
 ip virtual-reassembly
 zone name DMZ id 3
 ip virtual-reassembly
 zone name Untrust id 4
 ip virtual-reassembly
 interzone source Trust destination Untrust
  rule 0 deny
   source-ip nw
   destination-ip da
   service 3389
   rule enable
 interzone source Untrust destination Trust
  rule 0 permit
   source-ip da
   destination-ip nw
   service any_service
   rule enable
  rule 1 permit
   comment smzx
   source-ip sm
   destination-ip nw
   service any_service
   rule enable
#
 ip route-static 0.0.0.0 0.0.0.0 Dialer1
 ip route-static 192.168.2.0 255.255.255.0 GigabitEthernet0/2 10.0.0.2
 ip route-static 192.168.20.0 255.255.255.0 GigabitEthernet0/2 10.0.0.2
#
 ip https port 36365
 ip https enable
#
 dialer-rule 1 ip permit
#
 load xml-configuration
#
 load tr069-configuration
#
user-interface con 0
 authentication-mode password
 set authentication password cipher $c$3$fBdH
=
user-interface vty 0 4
 authentication-mode scheme
#
return

192.168.2.0为内网，192.168.20.0为外网，2.0异常可访问外网。