h3c-F100-m-g 防火墙

内网地址连通性正常，telnet端口正常。防火墙上做端口映射后，访问外网地址加端口测试不成功。

version 5.20, Release 5142P02 # sysname H3C_F100-M-G_Firewall # undo voice vlan mac-address 00e0-bb00-0000 # interzone policy default by-priority # domain default enable system # ip host sw1 10.1.0.2 ip host sw2 10.1.0.3 # telnet server enable # undo alg dns undo alg rtsp undo alg h323 undo alg sip undo alg sqlnet undo alg pptp undo alg ils undo alg nbt undo alg msn undo alg qq undo alg tftp undo alg sccp undo alg gtp # session synchronization enable # password-recovery enable # acl number 3000 rule 5 permit ip source 10.1.0.2 0 rule 10 permit ip source 10.1.120.11 0 # vlan 1 # vlan 10 # vlan 999 to 1000 # domain system access-limit disable state active idle-cut disable self-service-url disable # pki domain default crl check disable # user-group system group-attribute allow-guest # local-user admin password cipher $c$3$Mp7zgWbIGFXdMmKdcDwhpeocmTmVxA6g9gH0IQ== authorization-attribute level 3 service-type telnet service-type web # stp enable # interface NULL0 # interface Vlan-interface1 ip address 10.1.2.254 255.255.0.0 # interface Vlan-interface10 ip address 1.1.1.5 255.255.255.0 # interface Vlan-interface999 description TO_SW1_SW2 ip address 10.10.10.1 255.255.255.248 # interface Vlan-interface1000 description ip address 172.1.1.254 255.255.255.0 # interface GigabitEthernet0/0 port link-mode route description TO_ nat outbound static nat outbound 3000 ip address 172.16.68.164 255.255.255.0 ip address 172.16.68.231 255.255.255.0 sub ip address 172.16.68.232 255.255.255.0 sub ip address 172.16.68.233 255.255.255.0 sub ip address 172.16.68.234 255.255.255.0 sub # interface GigabitEthernet0/2 port link-mode route # interface GigabitEthernet0/3 port link-mode route # interface GigabitEthernet0/1 port link-mode bridge port access vlan 10 # interface GigabitEthernet0/4 port link-mode bridge port link-type trunk port trunk permit vlan 1 10 999 to 1000 # interface GigabitEthernet0/5 port link-mode bridge port link-type trunk port trunk permit vlan 1 10 999 to 1000 # vd Root id 1 # zone name Management id 0 priority 100 zone name Local id 1 priority 100 zone name Trust id 2 priority 85 import interface GigabitEthernet0/1 vlan 10 import interface GigabitEthernet0/4 vlan 1 999 import interface Vlan-interface1 import interface Vlan-interface10 import interface Vlan-interface999 zone name DMZ id 3 priority 50 zone name Untrust id 4 priority 5 import interface GigabitEthernet0/0 import interface GigabitEthernet0/4 vlan 1000 import interface Vlan-interface1000 switchto vd Root zone name Management id 0 ip virtual-reassembly zone name Local id 1 ip virtual-reassembly zone name Trust id 2 ip virtual-reassembly zone name DMZ id 3 ip virtual-reassembly zone name Untrust id 4 ip virtual-reassembly interzone source Trust destination Untrust interzone source Any destination Any rule 0 permit source-ip any_address destination-ip any_address service any_service rule enable # ip route-static 0.0.0.0 0.0.0.0 172.16.68.1 ip route-static 10.1.0.0 255.255.0.0 10.10.10.2 ip route-static 10.1.120.0 255.255.255.0 10.10.10.2 ip route-static 172.20.0.0 255.254.0.0 1.1.1.4 ip route-static 172.22.0.0 255.254.0.0 1.1.1.4 ip route-static 172.24.0.0 255.255.0.0 1.1.1.4 ip route-static 172.25.0.0 255.255.0.0 1.1.1.4 ip route-static 172.28.0.0 255.252.0.0 1.1.1.4 # nat static 10.1.110.31 172.16.68.231 nat static 10.1.110.32 172.16.68.232 nat static 10.1.110.33 172.16.68.233 nat static 10.1.110.12 172.16.68.234 #