防火墙做vrf问题

我在防火墙上做了一个vrf将内网口与外网口归到同一个安全域中。然后在域间策略里也绑定了vrf。但是为啥终端只能访问网关但是无法反问外网。抓包看外网设备是有收到数据，并且有回传。但是无法到达终端。配置如下：

ip vpn-instance 1
 vpn-target 100:1 import-extcommunity
 vpn-target 100:1 export-extcommunity

interface GigabitEthernet1/0/0
 port link-mode route
 combo enable copper
 ip binding vpn-instance 1
 ip address 10.20.1.1 255.255.255.0
 nat outbound

interface GigabitEthernet1/0/1
 port link-mode route
 combo enable copper
 ip binding vpn-instance 1
 ip address 192.168.1.1 255.255.255.0

ip route-static vpn-instance 1 0.0.0.0 0 10.20.1.2

security-policy ip
rule 1 name test
  counting enable
  vrf 1
  source-zone test
  destination-zone test
  destination-zone Local