H3C SecPath F100-S-G 作为L2TP服务端，终端拨号后无法连接外网

需求：终端（Windows/MAC 电脑）连接VPN后可以正常访问外网及对端内网

    问题简述：H3C SecPath F100-S-G 作为L2TP服务端，终端（Windows/MAC 电脑）拨号后无法连接外网

    处理进度：Windows使用HUAWEI VPN Client拨号并做相应配置后可以正常使用，使用修改终端本地路由的方式也可以解决，但MAC端不知道怎么配置

    现存疑问：能不能让终端连接VPN后直接通过对端防火墙上外网？或者有没有MAC端的拨号工具？

设备型号：H3C SecPath F100-S-G

版本号：Comware Software, Version 5.20, Release 5140

组网：防火墙直接连接公网

防火墙配置：

# version 5.20, Release 5140 

# sysname Mushiny-FW 

# clock timezone Beijing add 08:00:00 

# l2tp enable 

# undo voice vlan mac-address 00e0-bb00-0000 

# ip local policy-based-route aaa 

# domain default enable system 

# telnet server enable 

# port-security enable 

# session synchronization enable 

# password-recovery enable

 # acl number 2001 description zhuanyong 

 rule 0 permit source 192.168.3.18 0 

 rule 5 permit source 192.168.3.19 0 

 rule 10 permit source 192.168.3.105 0 

acl number 2051 rule 0 permit

 # acl number 3003 

 rule 0 permit ip source 36.152.26.58 0 

# vlan 1

 # domain system 

 access-limit disable 

 state active 

 idle-cut disable 

 self-service-url disable 

 ip pool 1 10.10.10.1 10.10.10.200 

# pki domain default crl check disable

 # policy-based-route zhuanyong permit node 1

 if-match acl 2001

 apply ip-precedence priority 

 apply ip-address next-hop 36.152.26.60

 apply ip-address default next-hop 36.152.26.60 

# policy-based-route aaa permit node 5 

 if-match acl 3003 

 apply ip-address next-hop 36.152.26.60 

# user-group system group-attribute allow-guest

 # local-user admin password cipher $c$3$3NmBM4Uy7xytL9aMgRZ5szIJPblDt8ja 

 authorization-attribute level 3

 service-type ssh telnet 

 service-type web 

local-user l2tp_vpn password cipher $c$3$+wW2fidSTkSJ3oOUeWo4zrAFMqLHxpnpSxXnJVU= 

 service-type ppp 

local-user root password cipher $c$3$4pVSRbh6DECz3Py6MR22b7li7Zvp8lnIv2imSUPM6Q== 

 service-type ppp

 local-user test password cipher $c$3$zaIN3vCpdbA3iWVqBtP3iOuy9DYXQLIzo8yCIqOHIQ== 

 service-type ppp

 # cwmp

 undo cwmp enable 

# l2tp-group 1

 undo tunnel authentication 

 allow l2tp virtual-template 0 

# interface Dialer1 nat outbound 2051 

 link-protocol ppp 

 ppp chap user 02518586067 

 ppp chap password cipher $c$3$pUraOtHFjaprDJcmt83oi44bVf4X1dbR9yoA  

 ppp pap local-user 02518586423 password cipher $c$3$bIU/nrKiy9VOB9+LaWJmXu/n7hyOH2LnDpNq 

 ppp ipcp dns request ip address ppp-negotiate 

 dialer user pppoeclient 

 dialer-group 1 

 dialer bundle 1 

# interface Virtual-Template0 

 ppp authentication-mode chap domain system 

 remote address pool 1

 ip address 10.10.10.1 255.255.255.0

 nat outbound 2051 

# interface Virtual-Template1 

# interface NULL0 

# interface GigabitEthernet0/0 

 port link-mode route 

 ip address 172.16.100.1 255.255.255.0 

 ip policy-based-route zhuanyong 

# interface GigabitEthernet0/1 

 port link-mode route 

 pppoe-client dial-bundle-number 1 

# interface GigabitEthernet0/2 

 port link-mode route

 ip address 172.17.100.1 255.255.255.0

 ip policy-based-route zhuanyong 

# interface GigabitEthernet0/3 

 port link-mode route 

 ip address 172.16.99.1 255.255.255.0 

# interface GigabitEthernet0/4 

 port link-mode route 

 nat outbound 2051

 ip address 36.152.26.58 255.255.255.252 

# vd Root id 1 

# zone name Management id 0 

 priority 100 

 import interface GigabitEthernet0/0

 import interface Virtual-Template0 

 zone name Local id 1

 priority 100 

 zone name Trust id 2 

 priority 85 

 import interface GigabitEthernet0/2 

 import interface GigabitEthernet0/3

 zone name DMZ id 3

 priority 50 

zone name Untrust id 4 

 priority 5 

 import interface Dialer1 

 import interface GigabitEthernet0/4 

switchto vd Root 

 zone name Management id 0 

 ip virtual-reassembly 

 zone name Local id 1 

 ip virtual-reassembly 

 zone name Trust id 2

 ip virtual-reassembly 

 zone name DMZ id 3 

 ip virtual-reassembly 

 zone name Untrust id 4

 ip virtual-reassembly

 interzone source Untrust destination Local 

 rule 0 permit

 source-ip any_address

 destination-ip any_address

 service any_service

 rule enable

 interzone source Any 

 destination Any

 # ip route-static 0.0.0.0 0.0.0.0 Dialer1

 ip route-static 172.16.99.0 255.255.255.0 172.16.100.2

 ip route-static 192.168.3.0 255.255.255.0 172.16.100.2

 ip route-static 192.168.10.0 255.255.255.0 172.16.100.2

 # ssh server enable

 # dialer-rule 1 ip permit 

# load xml-configuration 

# load tr069-configuration 

# user-interface con 0 user-interface vty 0 4 authentication-mode scheme user privilege level 3 

# return