防火墙 DNAT

防火墙做 目的nat ，外网访问服务器端口不通

以下是debug信息

<H3C>dis cur*Nov 20 17:36:03:053 2023 H3C IPFW/7/IPFW_PACKET: Receiving, interface = GigabitEthernet1/0/1 version = 4, headlen = 20, tos = 0 pktlen = 52, pktid = 3201, offset = 0, ttl = 117, protocol = 6 checksum = 6148, s = 183.150.182.186, d = 221.10.149.227 channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0. VsysID = 1 prompt: Receiving IP packet from interface GigabitEthernet1/0/1. Payload: TCP source port = 53542, destination port = 8083 sequence num = 0xfaf69de8, acknowledgement num = 0x00000000, flags = 0x2 window size = 64240, checksum = 0x0a91, header length = 32. *Nov 20 17:36:03:053 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 1(pre routing), Service ID is 8(ipsec), Bitmap is c0004000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/1, s= 183.150.182.186, d= 221.10.149.227, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:053 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 1(pre routing), Service ID is 9(ipsec attack), Bitmap is 40004000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/1, s= 183.150.182.186, d= 221.10.149.227, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:053 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 1(pre routing), Service ID is 25(nat), Bitmap is 4000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/1, s= 183.150.182.186, d= 221.10.149.227, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:053 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 2(pre routing2), Service ID is 1(tcp mss all), Bitmap is 4000000000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/1, s= 183.150.182.186, d= 192.168.8.253, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:053 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 3(post routing), Service ID is 1(keep lasthop), Bitmap is 4100000000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/1, s= 183.150.182.186, d= 192.168.8.253, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:054 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 3(post routing), Service ID is 7(rir), Bitmap is 100000000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/1, s= 183.150.182.186, d= 192.168.8.253, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:054 2023 H3C FILTER/7/PACKET: The packet is permitted. Src-ZOne=Untrust, Dst-ZOne=Trust;If-In=GigabitEthernet1/0/1(2), If-Out=GigabitEthernet1/0/5(6); Packet Info:Src-IP=183.150.182.186, Dst-IP=192.168.8.253, VPN-Instance=, Src-MacAddr=cc1a-faee-cac0,Src-Port=53542, Dst-Port=8083, Protocol=TCP(6), Application=general_tcp(2086),Terminal=invalid(0), SecurityPolicy=Dnat, Rule-ID=2. *Nov 20 17:36:03:054 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 9(post routing beforefrag), Service ID is 3(interzone), Bitmap is 1100004000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/5, s= 183.150.182.186, d= 192.168.8.253, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:054 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 9(post routing beforefrag), Service ID is 7(nat), Bitmap is 100004000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/5, s= 183.150.182.186, d= 192.168.8.253, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:054 2023 H3C IPFW/7/IPFW_INFO: MBUF was intercepted! Phase Num is 9(post routing beforefrag), Service ID is 25(tcp mss all), Bitmap is 4000000000, return 0(0:continue, 1:dropped, 2:consumed, 3:enqueued, 4:relay)! Interface is GigabitEthernet1/0/5, s= 183.150.182.186, d= 192.168.8.253, protocol= 6, pktid = 3201 VsysID = 1. *Nov 20 17:36:03:054 2023 H3C IPFW/7/IPFW_PACKET: Sending, interface = GigabitEthernet1/0/5 version = 4, headlen = 20, tos = 0 pktlen = 52, pktid = 3201, offset = 0, ttl = 116, protocol = 6 checksum = 49740, s = 183.150.182.186, d = 192.168.8.253 channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0. VsysID = 1 prompt: Sending IP packet received from interface GigabitEthernet1/0/1 at interface GigabitEthernet1/0/5. Payload: TCP source port = 53542, destination port = 8083 sequence num = 0xfaf69de8, acknowledgement num = 0x00000000, flags = 0x2 window size = 64240, checksum = 0xb3d9, header length = 32.

会话信息

<H3C>dis session table ipv4 destination-port 8083 verbose Slot 1: Initiator: Source IP/port: 183.150.182.186/54169 Destination IP/port: 221.10.149.227/8083 DS-Lite tunnel peer: - VPN instance/VLAN ID/Inline ID: -/-/- Protocol: TCP(6) Inbound interface: GigabitEthernet1/0/1 Source security zone: Untrust Responder: Source IP/port: 192.168.8.253/8083 Destination IP/port: 183.150.182.186/54169 DS-Lite tunnel peer: - VPN instance/VLAN ID/Inline ID: -/-/- Protocol: TCP(6) Inbound interface: GigabitEthernet1/0/5 Source security zone: Trust State: TCP_SYN_SENT Application: GENERAL_TCP Rule ID: 2 Rule name: Dnat Start time: 2023-11-20 17:38:13 TTL: 29s Initiator->Responder: 0 packets 0 bytes Responder->Initiator: 0 packets 0 bytes Total sessions found: 1

服务器本地端口测试过可通，且ping出接口网关均可通