Question

h3c F100c 防火墙配置内网连接

我想不同网段的ip 可以互相访问 但是现在的设置只能单方面的访问

20网段可以访问10网段
10网段却无法ping通20网段
求修改
sysname H3C
#
firewall packet-filter enable
firewall packet-filter default permit
#
insulate
#
firewall url-filter host ip-address permit
#
nat address-group 0 192.168.10.1 192.168.10.10
#
firewall statistic system enable
#
radius scheme system
server-type extended
#
domain system
#
local-user admin
password simple admin
service-type telnet terminal
level 3
service-type ftp
#
acl number 2000
rule 0 permit source 192.168.20.0 0.0.0.255
#
interface Aux0
async mode flow
#
interface Ethernet0/0
ip address 192.168.20.1 255.255.255.0
#
interface Ethernet0/1
#
interface Ethernet0/2
#
interface Ethernet0/3
#
interface Ethernet0/4
ip address 192.168.10.1 255.255.255.0
nat outbound 2000 address-group 0
nat server protocol tcp global 192.168.10.2 www inside 192.168.20.100 www
#
interface Encrypt1/0
#
interface NULL0
#
firewall zone local
set priority 100
#
firewall zone trust
add interface Ethernet0/0
set priority 85
#
firewall zone untrust
add interface Ethernet0/4
set priority 5
#
firewall zone DMZ
set priority 50
#
firewall interzone local trust
#
firewall interzone local untrust
#
firewall interzone local DMZ
#
firewall interzone trust untrust
#
firewall interzone trust DMZ
#
firewall interzone DMZ untrust
#
FTP server enable
#
ip route-static 0.0.0.0 0.0.0.0 192.168.10.0 preference 60
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
authentication-mode scheme
#
return

Answer 1

interface Ethernet0/4
undo nat outbound 2000 address-group 0 将这个删掉就可以了

追问

不行啊 我加上这句 还能单方面的联通 也就是 20网段可以ping通 10网段
但是删除之后 连单方面都无法ping通

Answer 2

rule 0 permit source 192.168.10.0 0.0.0.255

追问

还是在acl number 2000么 还是另加一个 acl number 2001 之类的？