外网IP地址可以通过域名访问内外800端口网站，内网地址不可以，需要做回流




定义ACL3001

acl number 3001

rule 0 permit ip source 192.168.1.1 0.0.0.255


在E0/2端口配置nat server

nat server protocol tcp global 122.1.1.1 800 192.168.1.11 800

nat outbound 3001




以下是交换机的配置




acl number 3000


description nat-private


rule 0 permit tcp


acl number 3001


rule 0 permit ip source 192.168.1.0 0.0.0.255


acl number 3333


rule 0 permit ip



interface GigabitEthernet0/1


port link-mode route


nat outbound 3333


nat outbound 3000



nat server protocol tcp global 122.1.1.1 800 inside 192.168.1.11 800


ip address 122.1.1.1 255.255.255.240




interface GigabitEthernet0/2


port link-mode route


nat outbound 3001


nat server protocol tcp global 122.1.1.1 800 inside 192.168.1.11 800


ip address 192.168.1.1 255.255.255.0




注：122.1.1.1为公网IP； 192.168.1.11为服务器IP； 192.168.1.1为连接交换机接口的IP