MSR2600的ACL问题求助

公司最近老是中病毒，需要做一个外网端口到内网的端口限制，目前只有一台2600路由器，但是当我做好ACL应用到外网接口后，内网就掉线不能上网，加了per 内网端口也不行，求助！

路由器配置：

version 5.20, Release 2516P15

#

 sysname H3C

#

 super password level 3 cipher $c$3$MNVczce7/ATf+y1LbdMbuvKNt6S2PIWi

#

 firewall enable

#

 domain default enable system

#

 dns proxy enable

#

 telnet server enable

#

 dar p2p signature-file flash:/p2p_default.mtd

#

 port-security enable

#

 ip http port 8081

#

 password-recovery enable

#

 blacklist enable

#

acl number 3001

 rule 0 permit tcp destination 192.168.5.127 0 destination-port eq 3389

 rule 1 deny ip

acl number 4999

 rule 0 deny source-mac fc15-b42d-d4f6 ffff-ffff-ffff

 rule 1 permit

#

vlan 1         

#

vlan 10

#

vlan 20

#

domain system

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

#

user-group system

 group-attribute allow-guest

#

local-user admin

 password cipher $c$3$M9NQfpJE0ql8KUXJQTFr7YMTZ0rSvrcRJF5J2o68

 authorization-attribute level 3

 service-type telnet

 service-type web

#

cwmp

 undo cwmp enable

#

interface Aux0

 async mode flow

 link-protocol ppp

#

interface Cellular0/0

 async mode protocol

 link-protocol ppp

#

interface NULL0

#              

interface Vlan-interface10

 ip address 192.168.5.1 255.255.255.0

 dhcp server apply ip-pool vlan10

#

interface Vlan-interface20

 ip address 192.168.2.1 255.255.255.0

 dhcp server apply ip-pool vlan20

#

interface GigabitEthernet0/0

 port link-mode route

 nat outbound

 undo dhcp select server global-pool

 ip address dhcp-alloc

#

interface GigabitEthernet0/1

 port link-mode route

 firewall packet-filter 3001 intbound

 nat outbound

 nat server 1 protocol tcp global current-interface 7501 inside 192.168.5.127 3389

 ip address 1.1.1.1 255.255.255.128

 undo dhcp select server global-pool

 #

interface GigabitEthernet0/2

 port link-mode bridge

 port access vlan 10

#

interface GigabitEthernet0/3

 port link-mode bridge

 port access vlan 10

#              

interface GigabitEthernet0/4

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet0/5

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet0/6

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet0/7

 port link-mode bridge

#

interface GigabitEthernet0/8

 port link-mode bridge

#

interface GigabitEthernet0/9

 port link-mode bridge

#

 ip route-static 0.0.0.0 0.0.0.0 1.1.1.2

#

 ip https port 4431

 ip https enable

#

 nms primary monitor-interface GigabitEthernet0/1

#              

 load xml-configuration

#

 load tr069-configuration

#

user-interface tty 12

user-interface aux 0

user-interface vty 0 4

 user privilege level 3

 set authentication password cipher %#!@#$!$@!%^!@$@!%^

#

return