F1000-AI-25防火墙做了端口映射，但是内网机器无法通过公网访问服务器

F1000-AI-25防火墙做了端口映射，也开启了 nat hairpin enable。但是依然内网机器无法通过公网访问服务器

内网服务器是192.168.2.12 端口映射是8112

内网接口也开启了nat hairpin enable

也做了trust到trust的策略放通。

麻烦帮忙看一下。

下面是配置文件，帮忙看一下哪里出了问题。

#

 version 7.1.064, Release 8860P1212

#

 sysname SKSS_FW

#

 clock protocol none

#

context Admin id 1

#

 telnet server enable

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1

#

 nat log enable

#

 dns server 8.8.8.8

 dns server 114.114.114.114

#

 password-recovery enable

#

vlan 1

#

object-group ip address 192.168.1.0

 security-zone Trust

 0 network subnet 192.168.1.0 255.255.255.0

#

object-group ip address 192.168.2.0

 security-zone Trust

 0 network subnet 192.168.2.0 255.255.255.0

#

object-group ip address 192.168.5.0

 security-zone Trust

 0 network subnet 192.168.5.0 255.255.255.0

#

object-group ip address trust

 description 内网

 security-zone Trust

 0 network subnet 192.168.0.0 255.255.0.0

#

object-group service port_8098

 0 service tcp destination eq 8098

#

object-group service port_81

 0 service tcp destination eq 81

#

object-group service rule443

 0 service tcp destination eq 443

#

object-group service server5000

 0 service tcp source eq 5000 destination eq 5000

#

object-group service service1009

 0 service tcp destination eq 1009

#

object-group service service1090

 0 service tcp destination eq 1090

#

object-group service service1433

 0 service tcp destination eq 1433

#

object-group service service1455

 0 service tcp destination eq 1455

#

object-group service service1521

 0 service tcp destination eq 1521

#

object-group service service1655

 0 service tcp destination eq 1655

#

object-group service service21

 0 service tcp destination eq 21

#

object-group service service3389

 0 service tcp destination eq 3389

#

object-group service service443

 0 service tcp destination eq 443

#

object-group service service5222

 0 service tcp destination eq 5222

#

object-group service service5872

 0 service tcp destination eq 5872

#

object-group service service6000

 0 service tcp destination eq 6000

#

object-group service service6001

 0 service tcp destination eq 6001

#

object-group service service6008

 0 service tcp destination eq 6008

#

object-group service service6009

 0 service tcp destination eq 6009

#

object-group service service7070

 0 service tcp destination eq 7070

#

object-group service service80

 0 service tcp destination eq 80

#

object-group service service8030

 0 service tcp destination eq 8030

#

object-group service service8060

 0 service tcp destination eq 8060

#

object-group service service8077

 0 service tcp destination eq 8077

#

object-group service service8080

 0 service tcp destination eq 8080

#

object-group service service8081

 0 service tcp destination eq 8081

#

object-group service service8082

 0 service tcp destination eq 8082

#

object-group service service8087

 0 service tcp destination eq 8087

#

object-group service service8088

 0 service tcp destination eq 8088

#

object-group service service8090

 0 service tcp destination eq 8090

#

object-group service service8098

 0 service tcp destination eq 8098

#

object-group service service8099

 0 service tcp destination eq 8099

#

object-group service service81

 0 service tcp destination eq 81

#

object-group service service8112

 0 service tcp destination eq 8112

#

object-group service service8113

 0 service tcp destination eq 8113

#

object-group service service8115

 0 service tcp destination eq 8115

#

object-group service service8116

 0 service tcp destination eq 8116

#

object-group service service8117

 0 service tcp destination eq 8117

#

object-group service service82

 0 service tcp destination eq 82

#

object-group service service88

 0 service tcp destination eq 88

#

object-group service service8800

 0 service tcp destination eq 8800

#

object-group service service8888

 0 service tcp destination eq 8888

#

object-group service service8899

 0 service tcp destination eq 8899

#

object-group service service89

 0 service tcp destination eq 89

#

object-group service service9988

 0 service tcp destination eq 9988

#

policy-based-route xuanlu permit node 10

 if-match acl 2000

 apply next-hop 111.34.77.129 direct track 1

 apply default-output-interface GigabitEthernet1/0/0 track 1

#

policy-based-route xuanlu permit node 20

 if-match acl 2001

 apply next-hop 124.128.235.185 direct track 2

 apply output-interface GigabitEthernet1/0/2 track 2

#

interface NULL0

#

interface GigabitEthernet1/0/0

 port link-mode route

 ip address 111.34.77.216 255.255.255.128

 tcp mss 1024

 ip last-hop hold

 nat outbound 3001

 manage https inbound

 manage ping inbound

 manage ping outbound

 manage ssh inbound

 manage ssh outbound

 ipsec apply policy 1

#

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 192.168.16.2 255.255.255.0

 tcp mss 1024

 nat hairpin enable

 manage https inbound

 manage ping inbound

 manage ping outbound

 manage ssh inbound

 manage ssh outbound

 manage telnet inbound

 manage telnet outbound

 ip policy-based-route xuanlu

#

interface GigabitEthernet1/0/2

 port link-mode route

 ip address 124.128.235.186 255.255.255.248

 ip last-hop hold

 nat outbound 3001

 nat server protocol tcp global 124.128.235.186 443 inside 192.168.2.13 443 rule ServerRule_3

 nat server protocol tcp global 124.128.235.186 8077 inside 192.168.2.13 8077 rule ServerRule_2

 nat server protocol tcp global 124.128.235.186 8088 inside 192.168.2.13 8088 rule ServerRule_1

 manage ping inbound

#

interface GigabitEthernet1/0/3

 port link-mode route

#

interface GigabitEthernet1/0/4

 port link-mode route

#

interface GigabitEthernet1/0/5

 port link-mode route

#

interface GigabitEthernet1/0/6

 port link-mode route

#

interface GigabitEthernet1/0/7

 port link-mode route

#

interface GigabitEthernet1/0/8

 port link-mode route

#

interface GigabitEthernet1/0/9

 port link-mode route

#

interface GigabitEthernet1/0/10

 port link-mode route

#

interface GigabitEthernet1/0/11

 port link-mode route

#

interface GigabitEthernet1/0/12

 port link-mode route

#

interface GigabitEthernet1/0/13

 port link-mode route

#

interface GigabitEthernet1/0/14

 port link-mode route

#

interface GigabitEthernet1/0/15

 port link-mode route

#

interface GigabitEthernet1/0/16

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/17

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/18

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/19

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/20

 port link-mode route

#

interface GigabitEthernet1/0/21

 port link-mode route

#

interface GigabitEthernet1/0/22

 port link-mode route

#

interface GigabitEthernet1/0/23

 port link-mode route

#

interface GigabitEthernet1/0/24

 port link-mode route

#

interface GigabitEthernet1/0/25

 port link-mode route

#

interface M-GigabitEthernet1/0/0

 ip address 192.168.0.1 255.255.255.0

#

interface Ten-GigabitEthernet1/0/26

 port link-mode route

#

interface Ten-GigabitEthernet1/0/27

 port link-mode route

#

interface Tunnel0 mode gre

 ip address 10.10.10.10 255.255.255.0

 source 111.34.77.216

 destination 60.216.86.50

 keepalive 10 3

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/1

#

security-zone name DMZ

#

security-zone name Untrust

 import interface GigabitEthernet1/0/0

 import interface GigabitEthernet1/0/2

 import interface Tunnel0

#

security-zone name Management

 import interface M-GigabitEthernet1/0/0

#

 scheduler logfile size 16

#

line class console

 authentication-mode scheme

 user-role network-admin

#

line class vty

 user-role network-operator

#

line con 0

 user-role network-admin

#

line vty 0 63

 authentication-mode scheme

 user-role network-admin

#

 ip route-static 0.0.0.0 0 223.98.185.81

 ip route-static 0.0.0.0 0 111.34.77.129

 ip route-static 60.216.86.50 32 223.98.185.81

 ip route-static 60.216.86.50 32 111.34.77.129

 ip route-static 192.168.1.0 24 192.168.16.1

 ip route-static 192.168.2.0 24 192.168.16.1

 ip route-static 192.168.5.0 24 223.98.185.81

 ip route-static 192.168.5.0 24 111.34.77.129

#

 info-center loghost 127.0.0.1 port 3301 format default

 info-center source CFGLOG loghost level informational

#

 ssh server enable

#

acl basic 2000

 rule 0 permit source 192.168.1.0 0.0.0.255

#

acl basic 2001

 rule 0 permit source 192.168.2.0 0.0.0.255

#

acl advanced 3000

 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.5.0 0.0.0.255

 rule 1 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.5.0 0.0.0.255

#

acl advanced 3001

 rule 0 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.5.0 0.0.0.255

 rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.5.0 0.0.0.255

 rule 10 permit ip

#

acl advanced 3333

 rule 0 permit ip source 192.168.2.85 0 destination 124.128.235.186 0

 rule 1 permit ip source 124.128.235.186 0 destination 192.168.2.85 0

 rule 2 permit ip source 124.128.235.186 0 destination 192.168.2.13 0

 rule 3 permit ip source 192.168.2.13 0 destination 124.128.235.186 0

#

acl advanced 3999

 rule 0 permit ip source 192.168.5.15 0 destination 192.168.1.9 0

 rule 5 permit ip source 192.168.1.9 0 destination 192.168.5.15 0

#

 password-control length 8

#

domain system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

local-user admin class manage

 password hash $h$6$jtXvdjnQnojsAhX9$4FO01OEDWCFtYKztHDMwuuTPWn2yG0EQ77HYUWgHDbKYPazErxGM9uY/UPus2HLzJTz/tO6l6f/Nred0cy9wOQ==

 service-type ssh telnet terminal https

 authorization-attribute user-role level-3

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

 session statistics enable

#

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm md5 

#

ipsec policy 1 1 isakmp

 transform-set 1 

 security acl 3000 

 local-address 111.34.77.216

 remote-address 60.216.86.50 

 description IPSec@123

 ike-profile 1

#

nat policy

#

nat global-policy

 rule name rule81

  service service81

  source-zone Trust

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.6 local-port 81

  disable

  counting enable

 rule name rule5872

  service service5872

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.6 local-port 5872

  disable

  counting enable

 rule name rule1433

  service service1433

  source-zone Untrust

  destination-ip host 223.98.185.83

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.9 local-port 1433

  disable

  counting enable

 rule name rule3389

  service service3389

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.22 local-port 3389

  disable

  counting enable

 rule name rule1655

  service service1655

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.22 local-port 1655

  disable

  counting enable

 rule name rule1009

  service service1009

  source-zone Untrust

  destination-ip host 223.98.185.83

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.22 local-port 1099

  disable

  counting enable

 rule name rule21

  service service21

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.22 local-port 21

  disable

  counting enable

 rule name rule88

  service service88

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.22 local-port 88

  disable

  counting enable

 rule name rule8888

  service service8888

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.22 local-port 8888

  disable

  counting enable

 rule name rule82

  service service82

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.182 local-port 82

  disable

  counting enable

 rule name rule89

  service service89

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.13 local-port 89

  disable

  counting enable

 rule name rule6000

  service service6000

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.91 local-port 6000

  disable

 rule name rule6001

  service service6001

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.91 local-port 6001

  disable

 rule name rule8800

  service service8800

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.13 local-port 8800

  disable

 rule name rule6008

  service service6008

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.0.2 local-port 6008

  disable

 rule name rule6009

  service service6009

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.0.2 local-port 6009

  disable

 rule name rule8090

  service service8090

  source-zone Trust

  source-zone Untrust

  destination-ip host 223.98.185.85

  action snat easy-ip

  action dnat ip-address 192.168.1.39 local-port 8090

  disable

 rule name rule8081

  service service8081

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.22 local-port 8081

  disable

 rule name rule8082

  service service8082

  source-zone Trust

  source-zone Untrust

  destination-ip host 223.98.185.85

  action snat easy-ip

  action dnat ip-address 192.168.1.39 local-port 8082

  disable

 rule name rule8087

  service service8087

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.39 local-port 8087

  disable

 rule name rule8098

  service port_8098

  source-zone Trust

  source-zone Untrust

  destination-ip host 223.98.185.85

  action snat easy-ip

  action dnat ip-address 192.168.1.141 local-port 8098

  disable

 rule name rule80

  service service80

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.12 local-port 80

  disable

 rule name rule8030

  service service8030

  source-zone Untrust

  destination-ip host 111.34.77.216

  action dnat ip-address 192.168.1.244 local-port 8030

 rule name rule8060

  service service8060

  source-zone Untrust

  destination-ip host 111.34.77.216

  action dnat ip-address 192.168.1.9 local-port 80

 rule name rule8099

  service service8099

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.108 local-port 8099

  disable

 rule name rule8899

  service service8899

  source-zone Untrust

  destination-ip host 223.98.185.83

  action dnat ip-address 192.168.1.74 local-port 8899

  disable

 rule name rule5222

  service service5222

  source-zone Trust

  source-zone Untrust

  destination-ip host 223.98.185.83

  action snat easy-ip

  action dnat ip-address 192.168.1.141 local-port 5222

  disable

 rule name rule7070

  service service7070

  source-zone Trust

  source-zone Untrust

  destination-ip host 223.98.185.83

  action snat easy-ip

  action dnat ip-address 192.168.1.41 local-port 7070

  disable

 rule name GlobalPolicyRule_1

  source-zone Trust

  destination-zone Untrust

  action snat easy-ip

  disable

  counting enable

 rule name rule_8090

  service service8090

  source-zone Trust

  source-zone Untrust

  destination-ip host 223.98.185.83

  action snat easy-ip

  action dnat ip-address 192.168.1.141 local-port 8090

  disable

 rule name rule1521

  service service1521

  source-zone Untrust

  destination-ip host 223.98.185.85

  action dnat ip-address 192.168.1.39 local-port 1521

  disable

 rule name IPSec_VPN

  source-zone Trust

  destination-zone Untrust

  source-ip 192.168.1.0

  source-ip 192.168.2.0

  destination-ip 192.168.5.0

  action snat no-nat

 rule name rule8080

  service service8080

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.12 local-port 8080

 rule name rule443

  service rule443

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.12 local-port 443

 rule name rule8112

  service service8112

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.12 local-port 8112

 rule name rule8113

  service service8113

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.12 local-port 8113

 rule name rule8115

  service service8115

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.12 local-port 8115

 rule name rule8117

  service service8117

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.12 local-port 8117

 rule name rule8116

  service service8116

  source-zone Untrust

  destination-ip host 124.128.235.186

  action dnat ip-address 192.168.2.12 local-port 8116

#

ike profile 1

 keychain 1

 local-identity address 111.34.77.216

 match remote identity address 60.216.86.50 255.255.255.255

 match local address GigabitEthernet1/0/0

 proposal 1 

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike proposal 2

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain 1

 match local address GigabitEthernet1/0/0

 pre-shared-key address 60.216.86.50 255.255.255.255 key cipher $c$3$tPKMa5QqY6TWkH7okncsPcWtzBJ07MYUk02Exu0=

#

 ip https enable

#

 blacklist global enable

#

app-profile 6_IPv4

 anti-virus apply policy default mode protect

#

app-profile 7_IPv4

 anti-virus apply policy default mode protect

#

inspect logging parameter-profile url_logging_default_parameter

#

 loadbalance isp file flash:/lbispinfo_v1.5.tp

#

 packet-capture max-bytes 4096

 packet-capture max-file-packets 1000

 packet-capture storage local limit 10240

#

security-policy ip

 rule 6 name test

  action pass

  counting enable

  profile 6_IPv4

  source-zone Local

  source-zone Trust

  destination-zone Untrust

  source-ip trust

 rule 5 name any_any

  action pass

  counting enable

  source-zone Trust

  source-zone Local

  destination-zone Local

  destination-zone Trust

 rule 9 name xiaochengxu

  action pass

  source-zone Trust

  source-zone Local

  destination-zone Trust

  destination-zone Local

 rule 7 name Untrust-Trust_new

  description 192.168.0.2,192.168.1.9,192.168.1.22,192.168.1.99,192.168.1.244,192.168.2.12

  action pass

  logging enable

  counting enable

  profile 7_IPv4

  source-zone Untrust

  destination-zone Trust

 rule 8 name ipsec

  action pass

#

anti-virus signature auto-update

 update schedule weekly sat start-time 02:00:00 tingle 120

#

 cloud-management server domain opstunnel-seccloud.h3c.com

#

return