问

路由器nat回流

2024-11-07提问

0关注
0收藏，237浏览

丨Answer

丨Answer 零段

粉丝：0人关注：0人

问题描述：

nat hairpin enable 和双向nat 都没生效，求大佬帮忙看下

组网及组网描述：

[GW_RT]dis cu
#
version 7.1.064, Release 0615P13
#
sysname GW_RT
#
nat log enable
nat log flow-begin
nat log flow-end
nat log alarm
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
policy-based-route pbr1 permit node 0
if-match acl 3002
apply next-hop 10.10.10.1
#
policy-based-route pbr1 permit node 2
if-match acl 3000
apply next-hop 20.20.20.1
#
policy-based-route pbr1 permit node 4
if-match acl 3010
apply next-hop 30.30.30.1
#
controller Cellular2/0/0
#
controller Cellular2/0/1
#
interface Route-Aggregation1
#
interface NULL0
#
interface GigabitEthernet2/0/0
port link-mode route
combo enable fiber
#
interface GigabitEthernet2/0/1
port link-mode route
description TO_ISP
combo enable copper
ip address 10.10.10.2 255.255.255.252
packet-filter 3200 inbound
nat outbound 2000
#
interface GigabitEthernet2/0/2
port link-mode route
description TO_ISP
combo enable fiber
mtu 1460
ip address 30.30.30.2 255.255.255.248
tcp mss 1024
packet-filter 3200 inbound
nat outbound 3010
nat server protocol tcp global 30.30.30.6 8000 inside 192.168.51.121 8080
#
interface GigabitEthernet2/6/0
port link-mode route
#
interface GigabitEthernet2/6/1
port link-mode route
#
interface GigabitEthernet2/6/2
port link-mode route
description TO_ISP
ip address 20.20.20.2 255.255.255.248
packet-filter 3200 inbound
nat outbound 3000
#
interface GigabitEthernet2/6/3
port link-mode route
#
interface GigabitEthernet2/6/4
port link-mode route
#
interface GigabitEthernet2/6/5
port link-mode route
description to_USG6600E_g0/0/5 内网口
ip address 192.168.254.254 255.255.255.0
nat hairpin enable
ip policy-based-route pbr1
#
interface GigabitEthernet2/6/6
port link-mode bridge
port link-type trunk
port trunk permit vlan all
#
interface GigabitEthernet2/6/7
port link-mode bridge
port link-type trunk
port trunk permit vlan all
#
interface M-GigabitEthernet0
#
interface Ten-GigabitEthernet2/0/3
port link-mode route
#
interface Ten-GigabitEthernet2/0/4
port link-mode route
#
scheduler logfile size 16
#
ip route-static 0.0.0.0 0 30.30.30.1
ip route-static 0.0.0.0 0 10.10.10.1
ip route-static 0.0.0.0 0 20.20.20.1
ip route-static 192.168.0.0 16 192.168.254.1
#
acl basic 2000
rule 0 permit
#
acl advanced 3000
description wuxian
rule 0 permit ip source 192.168.64.0 0.0.31.255
rule 40 permit ip source 192.168.30.0 0.0.1.255
#
acl advanced 3002
rule 0 permit ip source 192.168.0.0 0.0.15.255 destination 10.184.20.249 0
rule 1 permit ip source 192.168.64.0 0.0.31.255 destination 10.184.20.249 0
rule 2 permit ip source 192.168.64.0 0.0.31.255 destination 10.189.1.41 0
rule 4 permit ip source 192.168.0.0 0.0.15.255 destination 10.189.1.41 0
rule 10 permit ip source 192.168.64.0 0.0.31.255 destination 202.119.133.3 0
#
acl advanced 3010
rule 0 deny ip source 192.168.22.0 0.0.1.255
rule 10 deny ip source 192.168.13.192 0.0.0.63
rule 15 permit ip
#
acl advanced 3200
description JinZhiDuanKou
rule 0 deny tcp destination-port eq 445
rule 5 deny udp destination-port eq 445
rule 10 deny tcp destination-port eq 137
rule 15 deny udp destination-port eq netbios-ns
rule 20 deny tcp destination-port eq 138
rule 25 deny udp destination-port eq netbios-dgm
rule 30 deny tcp destination-port eq 139
rule 35 deny udp destination-port eq netbios-ssn
rule 40 deny tcp destination-port eq 135
rule 45 deny udp destination-port eq 135
#
user-group system
#
return
[GW_RT]