msr3600

内网客户端能不能ping通公网的网关呢？需要测试一下另外把配置贴上来看看吧！不看配置不好判断，发我邮箱 帮你看看347515066@qq.com

<H3C>dis cu # version 7.1.064, Release 0707P19 # sysname H3C # clock timezone Beijing add 08:00:00 clock protocol ntp # telnet server enable # dhcp enable dhcp server forbidden-ip 192.168.11.220 192.168.11.254 dhcp server forbidden-ip 192.168.12.220 192.168.12.254 dhcp server forbidden-ip 192.168.13.220 192.168.13.254 dhcp server forbidden-ip 192.168.14.220 192.168.14.254 dhcp server forbidden-ip 192.168.15.220 192.168.15.254 # password-recovery enable # vlan 1 # vlan 11 to 15 # dhcp server ip-pool vlan11 network 192.168.11.0 mask 255.255.255.0 address range 192.168.11.1 192.168.11.220 dns-list 218.30.19.40 62.*.1.4 # dhcp server ip-pool vlan12 network 192.168.12.0 mask 255.255.255.0 address range 192.168.12.1 192.168.12.220 dns-list 218.30.19.40 62.*.1.4 # dhcp server ip-pool vlan13 network 192.168.13.0 mask 255.255.255.0 address range 192.168.13.1 192.168.13.220 dns-list 218.30.19.40 62.*.1.4 # dhcp server ip-pool vlan14 network 192.168.14.0 mask 255.255.255.0 address range 192.168.14.1 192.168.14.220 dns-list 218.30.19.40 62.*.1.4 # dhcp server ip-pool vlan15 network 192.168.15.0 mask 255.255.255.0 address range 192.168.15.1 192.168.15.220 dns-list 218.30.19.40 62.*.1.4 # controller Cellular0/0 # interface Aux0 # interface NULL0 # interface Vlan-interface11 ip address 192.168.11.254 255.255.255.0 nat hairpin enable # interface Vlan-interface12 ip address 192.168.12.254 255.255.255.0 nat hairpin enable # interface Vlan-interface13 ip address 192.168.13.254 255.255.255.0 nat hairpin enable # interface Vlan-interface14 ip address 192.168.14.254 255.255.255.0 nat hairpin enable # interface Vlan-interface15 ip address 192.168.15.254 255.255.255.0 nat hairpin enable # interface GigabitEthernet0/0 port link-mode route description Multiple_Line bandwidth 30000 ip address 117.*.*.* 255.255.255.252 nat outbound 3000 nat server protocol tcp global 117.*.*.* 21 inside 192.168.12.251 21 nat server protocol tcp global 117.*.*.* 80 inside 192.168.12.251 80 nat server protocol tcp global 117.*.*.* 554 inside 192.168.15.230 554 nat server protocol tcp global 117.*.*.* 8000 inside 192.168.15.230 8000 nat server protocol tcp global 117.*.*.* 8001 inside 192.168.15.230 8001 nat server protocol tcp global 117.*.*.* 8080 inside 192.168.12.227 80 # interface GigabitEthernet0/1 port link-mode route # interface GigabitEthernet0/2 port link-mode route # interface GigabitEthernet0/3 port link-mode bridge port access vlan 11 ....... # interface GigabitEthernet0/50 port link-mode bridge # security-zone name Local # security-zone name Trust # security-zone name DMZ # security-zone name Untrust # security-zone name Management # scheduler logfile size 16 # line class aux user-role network-admin # line class tty user-role network-operator # line class vty user-role network-operator # line aux 0 user-role network-admin # line vty 0 4 authentication-mode scheme user-role network-operator # line vty 5 63 user-role network-operator # ip route-static 0.0.0.0 0 GigabitEthernet0/0 117.*.*.x # ntp-service enable ntp-service unicast-server 120.25.115.20 ntp-service unicast-server 203.107.6.88 # acl advanced 3000 rule 0 permit ip source 192.168.11.0 0.0.0.255 rule 2 permit ip source 192.168.12.0 0.0.0.255 rule 3 permit ip source 192.168.13.0 0.0.0.255 rule 4 permit ip source 192.168.14.0 0.0.0.255 rule 5 permit ip source 192.168.15.0 0.0.0.255 rule 6 deny ip # domain system # domain default enable system # role name level-0 description Predefined level-0 role ...... role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$5w8HZ3GW/5FcVyLd$vyqKiDQXfFqyxlM4+Z79AuLB8LsAn/G3mc2nf3gneQn zGkQqpLAXEmBBtg7HaxTquhPqwctw9cggXqXXChmwgg== service-type telnet https authorization-attribute user-role level-15 authorization-attribute user-role network-admin # ip https enable # wlan global-configuration # wlan ap-group default-group vlan 1 # return

分两步测试：

1，测试线路，分别ping 路由器lan口地址、wan口地址、wan口下一跳地址、然后公网地址，看看到哪断的，排查哪

2，如果第一步没问题的话，测试dns解析是否正常，命令提示符下，nslookup 命令测试dns解析