3大厂家端口回流处理方案

华为端口回流解决方法 （内网用户通过域名或公网IP访问内部服务器的解决办法）

isp R4路由配置：
dis current-configuration
[V200R003C00]

dhcp enable

interface GigabitEthernet0/0/0
ip address 3.3.3.1 255.255.255.0

interface GigabitEthernet0/0/1
ip address 9.9.9.9 255.255.255.0
dhcp select interface

return

公司出口路由器R5配置：
dis current-configuration
[V200R003C00]

acl number 2000
rule 5 permit source 192.168.0.0 0.0.0.255

acl number 3000 //用于解决端口回流acl
rule 5 permit ip source 192.168.0.0 0.0.0.255 destination 3.3.3.8 0

nat address-group 1 3.3.3.5 3.3.3.6 /公司申请的公司地址池

interface GigabitEthernet0/0/0
ip address 3.3.3.3 255.255.255.0
nat static protocol tcp global 3.3.3.8 www inside 192.168.0.100 www
//映射内部服务器到申请的外网地址3.3.3.8 这个地址是公司申请的单独一个公网地址
nat outbound 2000 address-group 1 //内网用户上网

interface GigabitEthernet0/0/1 //出口路由的内网口
ip address 2.2.2.1 255.255.255.0
nat server protocol tcp global 3.3.3.8 www inside 192.168.0.100 www //解决端口回流
nat outbound 3000 //解决端口回流

ip route-static 0.0.0.0 0.0.0.0 3.3.3.1
ip route-static 192.168.0.0 255.255.255.0 2.2.2.2

return

核心交换机配置 ：
dis current-configuration

sysname Huawei

vlan batch 2 100

dhcp enable

diffserv domain default

drop-profile default

ip pool vlan1
gateway-list 192.168.0.1
network 192.168.0.0 mask 255.255.255.0

interface Vlanif1
ip address 192.168.0.1 255.255.255.0
dhcp select global

interface Vlanif2
ip address 2.2.2.2 255.255.255.0

interface MEth0/0/1

interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094

interface GigabitEthernet0/0/1
eth-trunk 1

interface GigabitEthernet0/0/2
eth-trunk 1

interface GigabitEthernet0/0/3
port link-type access
port default vlan 2

ip route-static 0.0.0.0 0.0.0.0 2.2.2.1

华为防火墙端口回流处理方法：

出口是easy-ip做法：
nat server 0 protocol tcp global 12.1.1.1 www inside 10.0.0.200 www

nat-policy
rule name out_inter
destination-address 10.0.0.200 0.0.0.0
action source-nat easy-ip
rule name nat1
source-zone trust
destination-zone untrust
source-address 10.0.0.0 mask 255.255.255.0
action source-nat easy-ip

出口是地址池做法：
nat server 0 protocol tcp global 12.1.1.1 www inside 10.0.0.200 www

nat address-group 1 12.1.1.1 12.1.1.1 //假如只有一个公网地址
nat-policy zone trust
policy 1
policy destation 10.0.0.200 0.0.0.0
action source-nat
address-group 1

锐捷(正常端口映射再尾部加上permit-inside)

ip nat inside source static tcp 服务器ip 80 公网ip 80 permit-inside

h3c

在出口路由器下联的内网口上打上;:
nat hairpin enable