NAT后网络回流造成内网无法通过公网IP访问应用服务器.docVIP

一、思科设备示例 1.1?Router示例 Router(config)#?interfacee0/0????????????????????????????????????????????????????????????????????????????????????????????? Router(config-if)#ip?add?? Router(config-if)#ip?nat?inside Router(config)#?interfacee0/1 Router(config-if)#ip?add?6?48 Router(config-if)#ip?nat?outside Router(config)#?ipnat?inside?source?static? tcp?00?80?5?80 Router(config)#?access-list1?permit??55???????????????????????????????????????? Router(config)#?ipnat?inside?source?list?1?interface?e0/1?overload Router(config)#?iproute???1? Router(config)#ip?dns?server Router(config)#ip?domain-lookup Router(config)#ip?name- server?6 Router(config)#ip?host??00 内部网络主机的DNS配置成? 1.2?Firewall示例 A方法： static(inside,outside?)?5?00?netmask?55 access-list?100extended?permit? tcp?any?host?5?eq?80 access-group?100?in?interface?ouside alias?(inside)00?5?55 注意事项：某些FirewallIOS版本下，命令或不可成功，在policy-map添加一条命令即可： policy-mapglobal_policy ??????class?inspection_default ?inspect?dns?maximum-length?512? B方法： static(inside,outside?)?5?00?netmask?55dns access-list?100extended?permit?tcp?any?host?5?eq?80 access-group?100?in?interface?ouside? 二、华为与华三设备示例 [h3c]?interface?ethernet0/0/0 [h3c-ethernet0/0/0]ip?address?5?48 [ h3c-ethernet0/0/0]nat?outbound?2000 [h3c-ethernet0/0/0]nat?server?protocol?tcp?global?5?www?inside 00?www [h3c-ethernet0/0/0]nat? server?protocol? tcp?global?5?ftp?inside 00?ftp [h3c-ethernet0/0/0]quit? [h3c]? acl?number?2000 [h3c-acl-basic-2000]rule?0?permit?source??55 [h3c-acl-basic-2000]rule?1?deny? [h3c]?interface?ethernet1/0/0 [ h3c-ethernet1/0/0]?ip?address??? [h3c]nat?dns-map?www.??5?80?tcp [h3c]nat?dns-map?ftp.??5?21?tcp? 注意事项：较早的系统版本可能没有nat?dns-map命令，可参照如下配置： [h3c]?acl?number?3000? [h3c- acl-basic-3000]?rule?permit?ip?source??55?destination?00?? [h3c]?interface?ethernet1/0/0 [h3c-ethernet1/0/0]?nat?outbound?3000?[ h3c-ethernet1/0/0]nat? server?protocol? tcp?global?5?www?inside?00?www?? 三、天融信设备示例 ?企业WEB服务器（IP：）通过防火墙MAP为01对内网用户提供WEB服务 管理 主机和WEB服务器同样处于网段/24。正常情