华为AR611W路由器完整配置指南

一、网络拓扑与配置目标

1.1 网络拓扑

Internet
    ↓
光猫/宽带Modem
    ↓
[AR611W路由器]
    ├─ GigabitEthernet0/0/0 (上行接口) → PPPoE拨号 → 公网IP
    └─ Vlanif1 (下行接口) → 192.168.1.0/24 → 内网设备
        ├─ Web服务器: 192.168.1.2:80
        ├─ FTP服务器: 192.168.1.3:21
        └─ 其他内网设备: DHCP自动分配

1.2 配置目标

• ✅ 内网用户访问Internet
• ✅ 外网用户访问内网服务器
• ✅ 内网用户通过公网IP访问内网服务器
• ✅ 提供DHCP服务，自动分配内网IP地址

二、基础配置

2.1 系统基础配置

<Huawei> system-view
[Huawei] sysname Router
[Router] undo info-center enable  // 关闭日志提示（可选）

2.2 PPPoE拨号配置（上行接口）

配置Dialer接口

[Router] interface Dialer1
[Router-Dialer1] link-protocol ppp
[Router-Dialer1] ppp chap user 你的宽带账号
[Router-Dialer1] ppp chap password cipher 你的宽带密码
[Router-Dialer1] ip address ppp-negotiate
[Router-Dialer1] dialer user user1
[Router-Dialer1] dialer bundle 1
[Router-Dialer1] quit

配置物理接口绑定

[Router] interface GigabitEthernet 0/0/0
[Router-GigabitEthernet0/0/0] pppoe-client dial-bundle-number 1
[Router-GigabitEthernet0/0/0] quit

2.3 VLANIF接口和DHCP配置（下行接口）

配置物理接口VLAN

[Router] interface GigabitEthernet 0/0/1
[Router-GigabitEthernet0/0/1] port link-type access
[Router-GigabitEthernet0/0/1] port default vlan 1
[Router-GigabitEthernet0/0/1] quit

配置Vlanif1接口

[Router] interface Vlanif1
[Router-Vlanif1] ip address 192.168.1.2 255.255.255.0
[Router-Vlanif1] quit

配置DHCP地址池

[Router] ip pool dhcp-pool
[Router-ip-pool-dhcp-pool] network 192.168.1.0 mask 255.255.255.0
[Router-ip-pool-dhcp-pool] gateway-list 192.168.1.2
[Router-ip-pool-dhcp-pool] dns-list 114.114.114.114 8.8.8.8
[Router-ip-pool-dhcp-pool] excluded-ip-address 192.168.1.2 192.168.1.99
[Router-ip-pool-dhcp-pool] lease day 1 hour 0 minute 0
[Router-ip-pool-dhcp-pool] quit

开启DHCP服务

[Router] interface Vlanif1
[Router-Vlanif1] dhcp select global
[Router-Vlanif1] quit

三、路由配置

3.1 配置默认路由

[Router] ip route-static 0.0.0.0 0.0.0.0 Dialer1

3.2 配置DNS服务器

[Router] dns resolve
[Router] dns server 114.114.114.114
[Router] dns server 8.8.8.8

四、NAT配置

4.1 NAT Outbound配置（内网访问外网）

创建ACL

[Router] acl 3000
[Router-acl-adv-3000] rule 5 permit ip source 192.168.1.0 0.0.0.255
[Router-acl-adv-3000] quit

应用Easy IP

[Router] interface Dialer1
[Router-Dialer1] nat outbound 3000
[Router-Dialer1] quit

4.2 NAT Server配置（外网访问内网服务器）

[Router] interface Dialer1
// Web服务器映射
[Router-Dialer1] nat server protocol tcp global current-interface 8080 inside 192.168.1.2 www
// FTP服务器映射
[Router-Dialer1] nat server protocol tcp global current-interface 21 inside 192.168.1.3 21
// 其他服务器映射
[Router-Dialer1] nat server protocol tcp global current-interface 8085 inside 192.168.1.120 www
[Router-Dialer1] quit

4.3 配置FTP ALG功能

[Router] nat alg ftp enable

4.4 下行接口NAT配置（内网通过公网IP访问）

创建ACL

[Router] acl 3001
[Router-acl-adv-3001] rule 5 permit ip source 192.168.1.0 0.0.0.255 destination any
[Router-acl-adv-3001] quit

应用NAT Outbound

[Router] interface Vlanif1
[Router-Vlanif1] nat outbound 3001
[Router-Vlanif1] quit

配置NAT Server

[Router] interface Vlanif1
[Router-Vlanif1] nat server protocol tcp global interface Dialer1 8080 inside 192.168.1.2 www
[Router-Vlanif1] nat server protocol tcp global interface Dialer1 21 inside 192.168.1.3 21
[Router-Vlanif1] nat server protocol tcp global interface Dialer1 8085 inside 192.168.1.120 www
[Router-Vlanif1] quit

五、配置验证

5.1 检查PPPoE拨号状态

[Router] display interface Dialer1

预期输出：

Dialer1 current state : UP
Line protocol current state : UP
Internet Address is negotiated, 123.232.169.44/32
Physical is PPPoE

5.2 检查DHCP服务状态

[Router] display ip pool

5.3 检查NAT配置

[Router] display nat outbound
[Router] display nat server

5.4 检查路由表

[Router] display ip routing-table

5.5 测试网络连通性

// 内网测试
ping www.baidu.com
ping 192.168.1.2

// 外网测试
telnet 公网IP 8080
ftp 公网IP

六、NAT Server管理命令

6.1 查看NAT Server配置

[Router] display nat server

6.2 逐个删除NAT Server配置

[Router] interface Dialer1
[Router-Dialer1] undo nat server protocol tcp global current-interface 8080 inside 192.168.1.2 www
[Router-Dialer1] undo nat server protocol tcp global current-interface 21 inside 192.168.1.3 21

七、常见问题排查

问题	可能原因	排查命令
PPPoE拨号失败	账号密码错误、物理接口故障	display interface GigabitEthernet 0/0/0
内网无法获取DHCP地址	Vlanif1接口故障、DHCP配置错误	display interface Vlanif1 display ip pool
内网无法访问Internet	路由配置错误、NAT配置错误	display ip routing-table display nat outbound
外网无法访问内网服务器	NAT Server配置错误、服务器防火墙	display nat server
FTP连接失败	FTP ALG未开启、服务器配置错误	display nat alg

八、配置注意事项

8.1 安全配置

• 避免使用默认端口，降低被攻击风险
• 配置防火墙策略，限制不必要的访问
• 定期更换宽带密码

8.2 配置保存

[Router] save

8.3 配置备份

[Router] tftp client put flash:/config.cfg 192.168.1.100 config.cfg

8.4 配置恢复

[Router] tftp client get 192.168.1.100 config.cfg flash:/config.cfg
[Router] reboot

九、配置优化建议

9.1 使用NAT Server替代NAT Static

• 华为设备V200R005及以后版本推荐使用NAT Server
• 配置更简洁，功能更强大

9.2 使用current-interface参数

• 适配动态公网IP场景
• 简化PPPoE拨号配置

9.3 配置日志监控

[Router] info-center enable
[Router] info-center loghost 192.168.1.100

9.4 定期检查配置

[Router] display current-configuration
[Router] display ip routing-table
[Router] display nat server

十、完整配置文件示例

#
sysname Router
#
vlan batch 1
#
aclnumber 3000  
 rule 5 permit ip source 192.168.1.0 0.0.0.255 
aclnumber 3001  
 rule 5 permit ip source 192.168.1.0 0.0.0.255 destination any
#
ip pool dhcp-pool
 gateway-list 192.168.1.2
 network 192.168.1.0 mask 255.255.255.0
 excluded-ip-address 192.168.1.2 192.168.1.99
 dns-list 114.114.114.114 8.8.8.8
 lease day 1 hour 0 minute 0
#
interface GigabitEthernet0/0/0
 pppoe-client dial-bundle-number 1
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 1
#
interface Dialer1
 link-protocol ppp
 ppp chap user 你的宽带账号
 ppp chap password cipher %^%#你的加密密码%^%#
 ip address ppp-negotiate
 dialer user user1
 dialer bundle 1
 nat server protocol tcp global current-interface 8080 inside 192.168.1.2 www
 nat server protocol tcp global current-interface 21 inside 192.168.1.3 21
 nat server protocol tcp global current-interface 8085 inside 192.168.1.120 www
 nat outbound 3000
#
interface Vlanif1
 ip address 192.168.1.2 255.255.255.0
 dhcp select global
 nat server protocol tcp global interface Dialer1 8080 inside 192.168.1.2 www
 nat server protocol tcp global interface Dialer1 21 inside 192.168.1.3 21
 nat server protocol tcp global interface Dialer1 8085 inside 192.168.1.120 www
 nat outbound 3001
#
ip route-static 0.0.0.0 0.0.0.0 Dialer1
#
nat alg ftp enable
#
dns resolve
dns server 114.114.114.114
dns server 8.8.8.8
#
return

---

文档版本：V1.0
适用设备：华为AR611W路由器
软件版本：V300R023C00SPC100
更新日期：2026-01-16