H3C F100-s-g防火墙配置求助

manutd24

防火墙做了nat和端口映射 可是外网还是无法访问内网！求大神帮助
这是配置：
<f100>dis cur

#
sysname f100
#
undo voice vlan mac-address xxxxx
#
interzone policy default by-priority
#
nat address-group 1 x.x.x.246 x.x.x.246（外网地址）
#
domain default enable system
#
ip ttl-expires enable
ip unreachables enable
#
port-security enable
#
undo ip http enable
#
undo alg dns
undo alg rtsp
undo alg h323
undo alg sip   
undo alg sqlnet
undo alg pptp
undo alg ils
undo alg nbt
undo alg msn
undo alg qq
undo alg tftp
undo alg sccp
undo alg gtp
#
session synchronization enable
#
password-recovery enable
#
acl number 2000
rule 0 permit source 192.168.10.0 0.0.0.255
rule 5 deny
#
vlan 1
#
domain system
access-limit disable
state active   
idle-cut disable
self-service-url disable
#
pki domain default
  crl check disable
#
user-group system
group-attribute allow-guest
#
local-user admin
password cipher gsdfhshdrth
authorization-attribute level 3
service-type ssh
service-type web
#
ssl server-policy access-policy
pki-domain default
#
cwmp
undo cwmp enable
#
interface NULL0
#               
interface GigabitEthernet0/0
port link-mode route
ip address x.x.x.x 255.255.255.192
#
interface GigabitEthernet0/1
port link-mode route
ip address 192.168.10.1 255.255.255.0
#
interface GigabitEthernet0/2
port link-mode route
nat outbound 2000 address-group 1 pat
nat server 2000 protocol tcp global x.x.x.246 1000 inside 192.168.10.2 telnet
ip address x.x.x.246 255.255.255.0
#
interface GigabitEthernet0/3
port link-mode route
#
interface GigabitEthernet0/4
port link-mode route
#
vd Root id 1
#
zone name Management id 0
priority 100
import interface GigabitEthernet0/0
zone name Local id 1
priority 100
zone name Trust id 2
priority 85
zone name DMZ id 3
priority 50
import interface GigabitEthernet0/1
zone name Untrust id 4
priority 5
import interface GigabitEthernet0/2
zone name Management id 0
ip virtual-reassembly
zone name Local id 1
ip virtual-reassembly
zone name Trust id 2
ip virtual-reassembly
zone name DMZ id 3
ip virtual-reassembly
zone name Untrust id 4
ip virtual-reassembly
#
ip route-static 0.0.0.0 0.0.0.0 x.x.x.246

#
ssh server enable
#
ip https ssl-server-policy access-policy
ip https enable
#
load xml-configuration
#
load tr069-configuration
#
user-interface con 0
user-interface vty 0 4
authentication-mode scheme
user privilege level 3
set authentication password cipher xxxxx
return         

霸气的壞壊

策略没做吧

ackca

兄弟，这是防火墙，不是路由器，域间策略呢？

manutd24

ackca 发表于 2017-4-5 16:47
兄弟，这是防火墙，不是路由器，域间策略呢？

加入域间策略后已解决问题，谢谢

manutd24

ackca 发表于 2017-4-5 16:47
兄弟，这是防火墙，不是路由器，域间策略呢？

加入域间策略后已解决问题，谢谢