外网连接内网kafka-kerberos 报错验证失败！

内网有个ambari-hdp3.1的kafka环境 2节点 kafka版本2.0

目前已经映射出去6667 6668 kerberoos通信端口 2181端口
公网ip只有一个ip 58.240.xxx.xxx
节57的6667 6668 映射成外网ip的6667 6668。

内网kafka1配置：

advertised.listeners=SASL_PLAINTEXT://dn9057:6667,EXTERNAL://58.240.xxx.xxx:6668
listeners=SASL_PLAINTEXT://:6667,EXTERNAL://:6668
security.inter.broker.protocol   SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol GSSAPI
listener.security.protocol.map=SASL_PLAINTEXT:SASL_PLAINTEXT,EXTERNAL:SASL_PLAINTEXT

kafka2配置：

advertised.listeners=SASL_PLAINTEXT://dn9057:6667,EXTERNAL://dn_kafka:6668
listeners=SASL_PLAINTEXT://:6667,EXTERNAL://:6668
security.inter.broker.protocol   SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol GSSAPI
listener.security.protocol.map=SASL_PLAINTEXT:SASL_PLAINTEXT,EXTERNAL:SASL_PLAINTEXT

内网58节点 域名映射

58.240.xxx.xxx dn_kafka

公网1节点 的/etc/hosts都加了域名映射

58.240.xxx.xxx dn9057
58.240.xxx.xxx dn9058
58.240.xxx.xxx dn_kafka

（两个节点外部连接一直会报错，所以节点2绕了一下）

然后再kerberos数据库里添加dn_kafka票据

另外krb5文件也优化了 加了配置改成tcp通信

公网节点：

上传了krb5conf
添加环境变量

export KAFKA_OPTS="-Djava.security.auth.login.config=/usr/hdp/current/kafka-broker/conf/kafka_jaas.conf -Djava.security.krb5.conf=/etc/krb5.conf"

KafkaClient {
com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab = true
    useTicketCache=false
    storeKey = true
    keyTab="/home/kafka.user.keytab"
    principal="kafka@DDP.COM"
    serviceName="kafka";
};


[libdefaults]
  renew_lifetime = 7d
  forwardable = true
  default_realm = DDP.COM
  udp_preference_limit = 1
  ticket_lifetime = 24h
  dns_lookup_realm = false
  dns_lookup_kdc = false
  default_ccache_name = /tmp/krb5cc_%{uid}
  default_tgs_enctypes = aes128-cts
  default_tkt_enctypes = aes128-cts

[logging]
  default = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
  kdc = FILE:/var/log/krb5kdc.log

[realms]
  DDP.COM = {
    admin_server = dn9057
    kdc = dn9057
  }

节点上kinit也能通过 klist也能正常显示

然后启动producer连接内网kafka

cd /usr/hdp/3.1.0.0-78/kafka/bin/ && ./kafka-console-producer.sh --broker-list dn9057:6668 --topic hk --producer.config /home/producer.properies

发10条消息能消费5条，其中发到节点57的5条能正常消费，但是其他5条消息：

Connection to node 1002 failed authentication due to: Authentication failed due to invalid credentials with SASL mechanism GSSAPI (org.apache.kafka.clients.NetworkClient)

/home/producer.properies

bootstrap.servers=dn9057:6668
compression.type=none
security.protocol=SASL_PLAINTEXT
sasl.mechanism=GSSAPI
sasl.kerberos.service.name=kafka

我尝试bootstrap.server写多个也没效果。

排查过程：

58开出去一个6669端口 然后58监听端口改用6669 还是一样的错误。

有大佬可以替我解答一下吗。