What you need is. Those services in the internal network need to be open to external network access. Assume that the internal network server needs to be accessed by the external network. The port is 9000 (some services have fixed ports), so the mapped port can be 9000 or other. (If it is 900 1) The server address is 192. 168.0.253, so when you visit the intranet, it is192.168.0.253: 9000. The external network access is public network IP: 900 1. That will consume equipment resources. Of course, external network access also needs to do destination address translation. Follow-up: Then I need to remap VPN ports. How to fill in the port number and alluding port in the above picture? How to fill in the mapping server? Is it a local ip? Is it an intranet IP or a public IP? Answer: Map VPN ports? Isn't VPN on the top floor? Vpn acts as a firewall. Mapping is to fill in the internal network address of the machine that needs external network access. Supplement: Because VPN has dialing function. He must be on the top floor. Otherwise, it is impossible to establish a virtual local area network. After dialing VPN, you can see the public network IP above. Access to VPN by external network only needs to input public network IP.