华三F1000防火墙拨号上网web配置问题

能ping通运营商的DNS说明外网通了，直接访问域名和其他域名试试，试一下是所有域名有问题还是部分域名有问题，部分域名有问题的话检查下有没有做限制

1、dhcp server forbidden-ip   命令用来配置全局不参与自动分配的IP地址。

2、接口4的电脑能ping通192.168.1.1和运营商的dns，就是无法ping通域名(比如www.qq.com)

看下是不是没有做关于NAT的配置

看下dhcp配置DNS了没，PC网卡手动换个DNS试试

网络搭建要求：0口通过网线连接到光猫拨号上网，4口设置192.168.1.1的内网段，且地址自动分配后只能分配100~254的地址。

可能自动地址分配设置成了192.168.1.100-255.255.254.0；改为192.168.1.1-255.255.254.0就可以了

改完保存重启

1、拨号的物理接口、vlan-interface 、dialer 接口都需要加入对应的安全域，并放通相应的安全策略；

2、检查一下nat 配置；和默认路由是否正确；

3、终端更换一下dns 试一下  、可以在防火墙进行ping  www.qq.com 测试、（防火墙需配置dns server  ）

4、接口优化一条配置 tcp mss  1280 试试；

您好，vlan和接口都需要加入安全域

我把配置发一下，麻烦大家帮忙看下，现在4口和5口自动获取地址获取不了，但是可以手动设置ip，然后也能正常上网。

#
version 7.1.064, Ess 9536P1917
#
sysname H3C
#
context Admin id 1
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dialer-group 1 rule ip permit
dialer-group 2 rule ip permit
dialer-group 4 rule ip permit
#
dhcp enable
#
dns proxy enable
dns server 202.103.44.150
dns server 202.103.24.68
#
password-recovery enable
#
vlan 1
#
vlan 2
description 拨号端口0
#
vlan 3
description 政务网接口1
#
vlan 4
description Lan口4
#
dhcp server ip-pool vlan4
gateway-list 192.168.1.1
network 192.168.1.0 mask 255.255.255.0
dns-list 202.103.24.68 202.103.44.150
expired day 7
#
controller Cellular1/0/0
#
interface Dialer2
mtu 1492
ppp chap password cipher $c$3$kiV9X6HZK9cQlcToxkFGJC0+csbkYRv5EA==
ppp chap user hga101801185
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user hga101801185 password cipher $c$3$3BwEvbcY7m7CUgUfrc7B96eKAxq2qZFsFQ==
dialer bundle enable
dialer-group 4
dialer timer idle 0
dialer timer autodial 5
ip address ppp-negotiate
tcp mss 1400
#
interface NULL0
#
interface Vlan-interface2
description 拨号
ip last-hop hold
undo dhcp select server
pppoe-client dial-bundle-number 2
#
interface Vlan-interface3
description Vlan-interface3 Interface 政务网
ip address 10.253.1.225 255.255.255.0
ip last-hop hold
undo dhcp select server
gateway 10.253.1.1
#
interface Vlan-interface4
description Vlan-interface4 Interface 内网
ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet1/0/2
port link-mode route
ip address 192.168.3.1 255.255.255.0
undo dhcp select server
#
interface GigabitEthernet1/0/3
port link-mode route
undo dhcp select server
#
interface GigabitEthernet1/0/6
port link-mode route
undo dhcp select server
#
interface GigabitEthernet1/0/7
port link-mode route
undo dhcp select server
#
interface GigabitEthernet1/0/8
port link-mode route
undo dhcp select server
#
interface GigabitEthernet1/0/9
port link-mode route
undo dhcp select server
#
interface GigabitEthernet1/0/10
port link-mode route
undo dhcp select server
#
interface GigabitEthernet1/0/11
port link-mode route
undo dhcp select server
#
interface GigabitEthernet1/0/0
port link-mode bridge
port access vlan 2
combo enable copper
#
interface GigabitEthernet1/0/1
port link-mode bridge
port access vlan 3
combo enable copper
#
interface GigabitEthernet1/0/4
port link-mode bridge
port access vlan 4
#
interface GigabitEthernet1/0/5
port link-mode bridge
port access vlan 4
#
security-zone name Local
#
security-zone name Trust
#
security-zone name DMZ
#
security-zone name Untrust
import interface Dialer2
import interface Vlan-interface2
import interface GigabitEthernet1/0/0 vlan 2
#
security-zone name Management
import interface GigabitEthernet1/0/2
#
security-zone name JiaoYuWang
#
security-zone name Lan
import interface Vlan-interface4
import interface GigabitEthernet1/0/4 vlan 4
import interface GigabitEthernet1/0/5 vlan 4
#
security-zone name ZhengWuWang
import interface Vlan-interface3
import interface GigabitEthernet1/0/1 vlan 3
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 Dialer2
#
undo info-center enable
#
customlog format dpi url-filter
customlog format dpi ips
customlog format dpi anti-virus
customlog with-sn
#
ssh server enable
#
arp ip-conflict log prompt
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$+b/0Cp/IIijUufyM$p5F2lhboCPKmlQZevL6Q3lvk4QxXAHoztkxxaN18jFCTqJZxNLDSKGOBjUIT7YsAUUwzJNyAvQeBEafyKJL1yg==
service-type ssh terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
ipsec logging negotiation enable
#
ike logging negotiation enable
#
netconf soap http enable
netconf soap https enable
restful http enable
restful https enable
#
ip http enable
ip https enable
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
traffic-policy
rule 1 name GuideWANAccPolicy
action qos profile guidewanaccprofile
source-zone Trust
destination-zone DMZ
destination-zone Untrust
service ike
service ipsec-ah
service ipsec-esp
service l2tp
service nat-t-ipsec
rule 2 name GuideAVCPolicy
action qos profile guideavcprofile1
source-zone Trust
destination-zone DMZ
destination-zone Untrust
profile name guideavcprofile1
bandwidth downstream guaranteed 70000000
bandwidth downstream maximum 70000000
profile name guidewanaccprofile
bandwidth downstream guaranteed 30000000
bandwidth downstream maximum 30000000
#
security-policy ip
rule 0 name Lan_Any_0_IPv4
action pass
source-zone Lan
destination-zone Local
destination-zone Trust
destination-zone DMZ
destination-zone Untrust
destination-zone Management
destination-zone JiaoYuWang
destination-zone ZhengWuWang
#
cloud-management server domain opstunnel-seccloud.h3c.com
#
return