1.前段配置：
r1:
<Huawei>u t m
<Huawei>system-view
[Huawei]sysname r1
[r1]interface GigabitEthernet 0/0/1
[r1-GigabitEthernet0/0/1]ip address 192.168.12.1 24
[r1]interface GigabitEthernet 0/0/2
[r1-GigabitEthernet0/0/2]ip address 192.168.13.1 24
[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]ip address 1.1.1.254 24
[r1]display ip interface brief
[r1]ip route-static 192.168.1.0 24 192.168.12.2
[r1]ip route-static 192.168.10.0 24 192.168.12.2
[r1]ip route-static 192.168.20.0 24 192.168.12.2
[r1]ip route-static 192.168.30.0 24 192.168.13.2
[r1]ip route-static 192.168.1.0 24 192.168.13.2
R2:
<Huawei>u t m
<Huawei>system-view
[Huawei]sysname r2
[r2]interface GigabitEthernet 0/0/1
[r2-GigabitEthernet0/0/1]ip address 192.168.10.254 24
[r2]interface GigabitEthernet 0/0/2
[r2-GigabitEthernet0/0/2]ip address 192.168.20.254 24
[r2]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]ip address 192.168.12.2 24
<r2>display ip interface brief
[r2]ip route-static 0.0.0.0 0.0.0.0 192.168.12.1
R3:
<Huawei>u t m
<Huawei>system-view
[Huawei]sysname r3
[r3]interface GigabitEthernet 0/0/1
[r3-GigabitEthernet0/0/1]ip address 192.168.30.254 24
[r3]interface GigabitEthernet 0/0/2
[r3-GigabitEthernet0/0/2]ip address 192.168.1.254 24
[r3]interface GigabitEthernet 0/0/0
[r3-GigabitEthernet0/0/0]ip address 192.168.13.2 24
<r3>display ip interface brief
[r3]ip route-static 0.0.0.0 0.0.0.0 192.168.13.1
WG:
<Huawei>u t m
<Huawei>system-view
[Huawei]sysname WG
[WG]interface GigabitEthernet 0/0/0
[WG-GigabitEthernet0/0/0]ip address 192.168.10.1 24
[WG]ip route-static 0.0.0.0 0.0.0.0 192.168.10.254
2.在r1设置远程与基本ACL：
[r1]acl 2000
[r1-acl-basic-2000]rule 5 permit source 192.168.10.1 0.0.0.0
[r1-acl-basic-2000]rule 10 deny source any
[r1-acl-basic-2000]quit
[r1]user-interface vty 0 4
[r1-ui-vty0-4]acl 2000 inbound
[r1-ui-vty0-4]authentication-mode aaa
[r1-ui-vty0-4]aaa
[r1-aaa]local-user tata password cipher 123
[r1-aaa]local-user tata service-type telnet
3.设置高级ACL:
R2:
[r2]acl 3000
[r2-acl-adv-3000]rule 5 permit ip source 192.168.20.1 0 destination 192.168.10.1 0
[r2-acl-adv-3000]rule 10 permit ip source 192.168.20.1 0 destination 1.1.1.1 0
[r2-acl-adv-3000]rule 15 permit tcp source 192.168.20.1 0 destination 192.168.1.1 0 destination-port eq 80
[r2-acl-adv-3000]rule 20 deny ip source any
[r2-acl-adv-3000]quit
[r2]interface GigabitEthernet 0/0/2
[r2-GigabitEthernet0/0/2]traffic-filter inbound acl 3000
R3:
[r3]acl 3000
[r3-acl-adv-3000]rule 5 permit ip source 192.168.30.1 0 destination 192.168.10.1 0
[r3-acl-adv-3000]rule 10 permit tcp source 192.168.30.1 0 destination 192.168.1.
1 0 destination-port eq 80
[r3-acl-adv-3000]rule 15 deny ip source any
[r3-acl-adv-3000]quit
[r3]interface GigabitEthernet 0/0/1
[r3-GigabitEthernet0/0/1]traffic-filter inbound acl 3000