ComwareV7 FW NAT server与nat hairpin典型配置

现场有以下需求：

1.       公网路由器218.94.149.1可以通过218.94.149.194的23端口访问server192.168.10.77的23端口，23端口到23端口的映射；即端口到端口的映射

2.       内网client192.168.20.77可以使用公网的218.94.149.194的23端口访问server192.168.10.77的23端口，23端口到23端口的映射；即端口到端口的映射

3.       公网路由器218.94.149.1可以通过218.94.149.195的23端口访问server192.168.10.77的23端口，可以通过218.94.149.195的22端口访问server192.168.10.77的22端口；口全端口的映射

NAT相关配置如下：

FW的内网口要开启nat hairpin enable，此命令是为了实现内网终端通过公网地址访问内网服务器

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable copper

 ip address 10.0.0.2 255.255.255.0

 nat hairpin enable

nat地址池的address 218.94.149.194 218.94.149.194以及以下nat server是为了分别为了实现需求1与需求2

nat server protocol tcp global 218.94.149.194 23 inside 192.168.10.77 23

nat地址池的address 218.94.149.195 218.94.149.195与以下nat server是为了分别为了实现需求3

nat server global 218.94.149.195 inside 192.168.10.77

#

nat address-group 1

 address 218.94.149.194 218.94.149.194

 address 218.94.149.195 218.94.149.195

interface GigabitEthernet1/0/2

 port link-mode route

 combo enable copper

 ip address 218.94.149.194 255.255.255.0

 nat outbound address-group 1

 nat server global 218.94.149.195 inside 192.168.10.77

 nat server protocol tcp global 218.94.149.194 23 inside 192.168.10.77 23

结果验证：

1.       公网路由器218.94.149.1可以通过218.94.149.194的23端口访问server192.168.10.77的23端口

<gongwang>

<gongwang>tel

<gongwang>telnet 218.94.149.194

Trying 218.94.149.194 ...

Press CTRL+K to abort

Connected to 218.94.149.194 ...

******************************************************************************

* Copyright (c) 2004-2021 New H3C Technologies Co., Ltd. All rights reserved.*

* Without the owner's prior written consent,                                 *

* no decompiling or reverse-engineering shall be allowed.                    *

******************************************************************************

Login: admin

Password:

<server>

2.      内网client192.168.20.77可以使用公网的218.94.149.194的23端口访问server192.168.10.77的23端口，23端口到23端口的映射；即端口到端口的映射

<client>

<client>telnet  218.94.149.194

Trying 218.94.149.194 ...

Press CTRL+K to abort

Connected to 218.94.149.194 ...

******************************************************************************

* Copyright (c) 2004-2021 New H3C Technologies Co., Ltd. All rights reserved.*

* Without the owner's prior written consent,                                 *

* no decompiling or reverse-engineering shall be allowed.                    *

******************************************************************************

Login: admin

Password:

<server>

<server>

2.       公网路由器218.94.149.1可以通过218.94.149.195的23端口访问server192.168.10.77的23端口，可以通过218.94.149.195的22端口访问server192.168.10.77的22端口；口全端口的映射

<gongwang>telnet 218.94.149.195

Trying 218.94.149.195 ...

Press CTRL+K to abort

Connected to 218.94.149.195 ...

******************************************************************************

* Copyright (c) 2004-2021 New H3C Technologies Co., Ltd. All rights reserved.*

* Without the owner's prior written consent,                                 *

* no decompiling or reverse-engineering shall be allowed.                    *

******************************************************************************

Login: admin

Password:

<server>

<server>

<server>

<server>qui

The connection was closed by the remote host!

<gongwang>

<gongwang>

<gongwang>ssh 218.94.149.195

Username: admin

Press CTRL+C to abort.

Connecting to 218.94.149.195 port 22.

The server is not authenticated. Continue? [Y/N]:kongdefi@h3c!

Please type 'Y' or 'N':

Please type 'Y' or 'N':

Please type 'Y' or 'N': y

Do you want to save the server public key? [Y/N]:

Please type 'Y' or 'N': u

Please type 'Y' or 'N': y

admin@218.94.149.195's password:

admin@218.94.149.195's password:

Enter a character ~ and a dot to abort.

******************************************************************************

* Copyright (c) 2004-2021 New H3C Technologies Co., Ltd. All rights reserved.*

* Without the owner's prior written consent,                                 *

* no decompiling or reverse-engineering shall be allowed.                    *

******************************************************************************

<server>

配置关键点：

1.       内网口要配置nathairpin

2.       公网口的nat server要与公网口的地址池一起配置

比如

nat server global 218.94.149.195 inside 192.168.10.77

nat address-group 1

 address 218.94.149.194 218.94.149.194

 address 218.94.149.195 218.94.149.195

nat server protocol tcp global 218.94.149.194 23 inside 192.168.10.77 23

nat address-group 1

 address 218.94.149.194 218.94.149.194

 address 218.94.149.195 218.94.149.195