F100-C80-WINET+有一台服务器做了映射不能访问

服务器上8812,1433,8080，要求内网外网都通过外网地址能访问服务器，现映射后外网不能访问服务器。在内网测试127.0.0.1已经能用。

配置如下：

<FUPINBAN-firewall>dis cur
#
 version 7.1.064, Ess 9508
#
 sysname FUPINBAN-firewall
#
context Admin id 1
#
ip vpn-instance management
 route-distinguisher 1000000000:1
 vpn-target 1000000000:1 import-extcommunity
 vpn-target 1000000000:1 export-extcommunity
#
 telnet server enable
#
 irf mac-address persistent timer
 irf auto-update enable
 undo irf link-delay
 irf member 1 priority 1
#
 dhcp enable
#
 password-recovery enable
#
vlan 1        
#
vlan 100
 description neiwang
#
object-group ip address fuwuqi
 0 network host address 192.168.100.100
#
object-group ip address neiwang
 0 network subnet 192.168.100.0 255.255.255.0
#
object-group service 1433
 0 service tcp destination eq 1433
#
object-group service 3389
 0 service tcp destination eq 3389
#
object-group service 8080
 0 service tcp destination eq 8080
#
object-group service 8812
 0 service tcp destination eq 8812
#
dhcp server ip-pool vlan100
 gateway-list 192.168.100.1
 network 192.168.100.0 mask 255.255.255.0
 address range 192.168.100.105 192.168.100.250
 dns-list 202.99.192.68 202.99.192.66
#
interface NULL0
#
interface Vlan-interface100
 ip address 192.168.100.1 255.255.255.0
 nat server protocol tcp global 60.220.217.254 1433 inside 192.168.100.100 1433
 nat server protocol tcp global 60.220.217.254 8080 inside 192.168.100.100 8080
 nat server protocol tcp global 60.220.217.254 8812 inside 192.168.100.100 8812
#
interface GigabitEthernet1/0/0
 port link-mode route
 ip binding vpn-instance management
 ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-mode route
#
interface GigabitEthernet1/0/2
 port link-mode route
 ip binding vpn-instance management
 ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet1/0/3
 port link-mode route
 description waiwang
 ip address 60.220.217.254 255.255.255.252
 nat outbound 2000
 nat server protocol tcp global current-interface 1433 inside 192.168.100.100 1433
 nat server protocol tcp global current-interface 3389 inside 192.168.100.100 3389
 nat server protocol tcp global current-interface 8080 inside 192.168.100.100 8080
 nat server protocol tcp global current-interface 8812 inside 192.168.100.100 8812
#
interface GigabitEthernet1/0/4
 port link-mode bridge
 port access vlan 100
#
interface GigabitEthernet1/0/5
 port link-mode bridge
 port access vlan 100
#
interface GigabitEthernet1/0/6
 port link-mode bridge
 port access vlan 100
#
interface GigabitEthernet1/0/7
 port link-mode bridge
 port access vlan 100
#
interface GigabitEthernet1/0/8
 port link-mode bridge
 port access vlan 100
#
interface GigabitEthernet1/0/9
 port link-mode bridge
 port access vlan 100
#
object-policy ip Local-Trust
 rule 0 pass
#
object-policy ip Trust-Local
 rule 0 pass
#
object-policy ip Trust-Untrust
 rule 0 pass source-ip neiwang
#             
object-policy ip Untrust-Trust
 rule 1 pass destination-ip fuwuqi service 1433
 rule 2 pass destination-ip fuwuqi service 3389
 rule 3 pass destination-ip fuwuqi service 8080
 rule 4 pass destination-ip fuwuqi service 8812
#
security-zone name Local
#
security-zone name Trust
 import interface Vlan-interface100
 import interface GigabitEthernet1/0/4 vlan 100
 import interface GigabitEthernet1/0/5 vlan 100
 import interface GigabitEthernet1/0/6 vlan 100
 import interface GigabitEthernet1/0/7 vlan 100
 import interface GigabitEthernet1/0/8 vlan 100
 import interface GigabitEthernet1/0/9 vlan 100
#
security-zone name DMZ
#
security-zone name Untrust
 import interface GigabitEthernet1/0/3
#
security-zone name Management
 import interface GigabitEthernet1/0/0
 import interface GigabitEthernet1/0/2
#
zone-pair security source Local destination Trust
 object-policy apply ip Local-Trust
#
zone-pair security source Trust destination Local
 object-policy apply ip Trust-Local
#
zone-pair security source Trust destination Untrust
 object-policy apply ip Trust-Untrust
#
zone-pair security source Untrust destination Trust
 object-policy apply ip Untrust-Trust
#
 scheduler logfile size 16
#
line class aux
 user-role network-operator
#
line class console
 user-role network-admin
#             
line class vty
 user-role network-operator
#
line aux 0
 user-role network-admin
#
line con 0
 authentication-mode scheme
 user-role network-admin
#
line vty 0 63
 authentication-mode scheme
 user-role network-admin
#
 ip route-static 0.0.0.0 0 60.220.217.253
#
 ssh server enable
#
acl basic 2000
 rule 0 permit
#
domain system
#             
 aaa session-limit ftp 16
 aaa session-limit telnet 16
 aaa session-limit ssh 16
 domain default enable system
#
role name level-0
 description Predefined level-0 role
#
role name level-1
 description Predefined level-1 role
#
role name level-2
 description Predefined level-2 role
#
role name level-3
 description Predefined level-3 role
#
role name level-4
 description Predefined level-4 role
#
role name level-5
 description Predefined level-5 role
#             
role name level-6
 description Predefined level-6 role
#
role name level-7
 description Predefined level-7 role
#
role name level-8
 description Predefined level-8 role
#
role name level-9
 description Predefined level-9 role
#
role name level-10
 description Predefined level-10 role
#
role name level-11
 description Predefined level-11 role
#
role name level-12
 description Predefined level-12 role
#
role name level-13
 description Predefined level-13 role
#
role name level-14
 description Predefined level-14 role
#
user-group system
#
local-user admin class manage
 password hash $h$6$Izx21IFGtiVId+JR$U3unMF50bDlNwEC5kzR8DJ8kpLsV5Ld730EZl5Fur/vkeAk2eGl9lMvv+yJ8nhRp0BDTsGDNDHPCnN1tpNmVVA==
 service-type ssh telnet terminal http https
 authorization-attribute user-role level-3
 authorization-attribute user-role level-15
 authorization-attribute user-role network-admin
 authorization-attribute user-role network-operator
#
 ip https enable
#
return
<FUPINBAN-firewall> dis dev man
 Slot 1 CPU 0:
 DEVICE_NAME          : F100-C80-WiNet
 DEVICE_SERIAL_NUMBER : 219801A15M916CQ00234
 MAC_ADDRESS          : D461-FECF-1C94
 MANUFACTURING_DATE   : 2016-12-14
 VENDOR_NAME          : H3C
Power 0:
The operation is not supported on the specified power.

外网接防火墙3口，4至9口接内网