MSR3600 禁止部分IP连接互联网

一台MSR3600路由器，GE0和GE1分别通过PPPOE方式连接互联网，通过GE25连接内网，目前是所有电脑都能上网，现在有要针对内网的部分ip（192.168.0.245为例）禁止上网。学习了https://zhiliao.h3c.com/questions/dispcont/32789 ，进行测试，但192.168.0.245仍能上网

<SJ-H3C-ROUTE-MSR3600>system-view

[SJ-H3C-ROUTE-MSR3600]acl advanced 3000

[SJ-H3C-ROUTE-MSR3600-acl-ipv4-adv-3000]rule deny ip source 192.168.0.245 0 dest ination any

[SJ-H3C-ROUTE-MSR3600-acl-ipv4-adv-3000]quit

[SJ-H3C-ROUTE-MSR3600]interface GigabitEthernet 0/0

[SJ-H3C-ROUTE-MSR3600-GigabitEthernet0/0]packet-filter 3000 outbound

[SJ-H3C-ROUTE-MSR3600-GigabitEthernet0/0]quit

再对GE1做同样的设置 ， 但192.168.0.245仍能上网。

请高手指教，应如何做才能达成目标？

附配置文件

#
version 7.1.064, Release 0615P15
#
sysname SJ-H3C-ROUTE-MSR3600
#
clock timezone Beijing add 08:00:00 clock protocol ntp
#
telnet server enable
#
dialer-group 1 rule ip permit
dialer-group 2 rule ip permit
#
ip load-sharing mode per-flow src-ip global
#
dhcp enable
dhcp server always-broadcast
#
dns proxy enable
#
password-recovery enable
#
vlan 1
#
controller Cellular0/0
#
interface Aux0
#
interface Dialer0 bandwidth 100000
ppp chap password cipher $c$3$yp7CN9ht0DsJgpEv
ppp chap user 076904
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user 0769045 password cipher $c$3$s45+
dialer bundle enable
dialer-group 1
dialer timer idle 0
dialer timer autodial 5
ip address ppp-negotiate
nat outbound
#
interface Dialer1 bandwidth 100000
ppp chap password cipher $c$3$LiblC
ppp chap user 076906
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user 076906 password cipher $c$3$XXZ0UUU
dialer bundle enable
dialer-group 2
dialer timer idle 0
dialer timer autodial 5
ip address ppp-negotiate
nat outbound
#
interface Virtual-Template0
#
interface NULL0
#
interface Vlan-interface1
ip address 192.168.0.1 255.255.255.0
tcp mss 1280
undo dhcp select server
#
interface GigabitEthernet0/0
port link-mode route
description Multiple_Line
packet-filter 3000 outbound
nat outbound 3000
pppoe-client dial-bundle-number 0
#
interface GigabitEthernet0/1
port link-mode route
description Multiple_Line
packet-filter 3000 outbound
nat outbound 3000
pppoe-client dial-bundle-number 1
#
interface GigabitEthernet0/2
port link-mode route
#
interface GigabitEthernet0/27
port link-mode route
#
interface GigabitEthernet0/3
port link-mode bridge
#
interface GigabitEthernet0/4
port link-mode bridge
#
......

#
interface GigabitEthernet0/26
port link-mode bridge
#
object-policy ip Any-Any
rule 65534 pass
#
security-zone name Local
#
security-zone name Trust
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
#
zone-pair security source Any destination Any
object-policy apply ip Any-Any
#
scheduler logfile size 16
#
line class aux
user-role network-admin
#
line class tty
user-role network-operator
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-operator
#
ip route-static 0.0.0.0 0 Dialer0
ip route-static 0.0.0.0 0 Dialer1
#
time-range alltime 00:00 to 23:59 daily
#
ntp-service enable
ntp-service unicast-server 118.24.4.66
ntp-service unicast-server 118.24.195.65
#
acl advanced 3000
rule 0 deny ip source 192.168.0.245 0
#
acl mac 4998
rule 5 deny
#
acl mac 4999
rule 25 permit
#
password-control enable
....
#
domain system
#
domain default enable system
#
role name level-0 description Predefined level-0 role
#
role name level-1 description Predefined level-1 role
#
role name level-2 description Predefined level-2 role
#
role name level-3 description Predefined level-3 role
#
....
role name level-14 description Predefined level-14 role
# user-group system
# local-user admin999 class manage
service-type .....
#
local-user olol class manage
service-type ....
#
ip http enable
#
wlan global-configuration
#
wlan ap-group default-group
#
cloud-management server domain oasis.h3c.com
#
return