求助！！！华为AR201-S路由端口映射

[李泯哲]

公司有一台华为AR201-S路由，其IP地址是125.71.210.XXX，掩码255.255.255.XXX，然后下面连一交换机，内网IP段是10.0.0.0~10.0.255.255，掩码255.255.255.0

现在想把125.71.210.XXX这个IP映射到内网的10.0.0.169，实现访问169的web功能，主要是169是linux系统，现在要达到的目的是：外网（其他地方）的电脑在网页里输入125.71.210.XXX，就直接进到10.0.0.169的web界面。当然内网的电脑也可以。

1.将路由器的外网地址来映射可行吗？
2.具体命令行是怎样的呢？
3.路由器里面的acl怎么理解和使用？

非常感谢!!!!!!!!!!!

[wfexp]

可行. 具体命令参考说明书. acl是允许访问列表.

[李泯哲]

引用 1 楼 wfexp 的回复:

可行. 具体命令参考说明书. acl是允许访问列表.

那版主能说一下具体的命令行吗？ 刚入门，还不知道怎么弄啊！！！ 另外，我把之前路由器的配置（建立VPN）给你看看嘛！ 看不懂啊！

[李泯哲]

[V200R002C00SPC200] # snmp-agent local-engineid 800007DB03FC48EF2BF6DD snmp-agent # http server enable # drop illegal-mac alarm # dhcp enable # set transceiver-monitoring disable # acl number 3001 rule 10 deny ip source 10.0.0.0 0.0.0.255 destination 192.168.0.0 0.0.255.255 rule 17 deny ip source 10.0.0.110 0 rule 18 deny ip source 10.0.0.102 0 rule 19 deny ip source 10.0.0.100 0 rule 20 permit ip source 10.0.0.0 0.0.0.255 acl number 3010 rule 5 permit ip source 10.0.0.0 0.0.0.255 destination 192.168.0.0 0.0.255.255 # ipsec proposal 1 esp authentication-algorithm sha1 # ike proposal 1 dh group2 sa duration 100000 # ike peer 1 v1 pre-shared-key abcdefg ike-proposal 1 remote-address 124.31.217.147 # ipsec policy test 10 isakmp security acl 3010 ike-peer 1 proposal 1 # aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default domain default_admin local-user admin password simple admin local-user admin privilege level 15 local-user admin service-type telnet http # nat address-group 0 125.71.210.105 125.71.210.106 # interface Vlanif1 ip address 10.0.0.1 255.255.255.0 dhcp select interface dhcp server excluded-ip-address 10.0.0.100 10.0.0.200 dhcp server dns-list 61.139.2.69 # interface Ethernet0/0/0 # interface Ethernet0/0/1 # interface Ethernet0/0/2 # interface Ethernet0/0/3 # interface Ethernet0/0/4 # interface Ethernet0/0/5 # interface Ethernet0/0/6 # interface Ethernet0/0/7 # interface Ethernet0/0/8 ip address 125.71.210.105 255.255.255.0 ipsec policy test nat outbound 3001 # interface NULL0 # ip route-static 0.0.0.0 0.0.0.0 125.71.210.1 # user-interface con 0 user-interface vty 0 authentication-mode aaa user privilege level 15 user-interface vty 1 4 authentication-mode aaa user-interface vty 16 20 # voice # return