需要的命令：
查看配置情况 iptables -L -n
记得保存 /etc/init.d/iptables save
添加input记录 iptables -A
INPUT -p tcp --
dport 22 -j ACCEPT
添加output记录 iptables -A
OUTPUT -p tcp --
sport 22 -j ACCEPT
一些软件的默认端口：
ftp用到端口是 20 21
ssh 端口是 22
http端口是 80
telnet端口是 23
rsync端口是 873
svn 端口3690
pop3端口110
smtp端口25
dns端口53
mysql端口3306
nfs端口111
大概常用的就这些，其他的可查看具体软件
1、查看本机关于 IPTABLES的设置情况,并关闭所有的端口,#慎重，要不你的ssh也失去链接了
iptables -L -n --line-number //显示行号
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP #慎重，要不你的ssh也失去链接了
2.添加规则
iptables -A INPUT -p tcp --dport 873 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 873 -j ACCEPT
#加-s 10.210.31.111为来源ip
3.保存规则
/etc/init.d/iptables save
4.重启iptables
service iptables restart
5.删除规则,删除相应的条目，然后记得保存和重启
iptables -L -n --line-number
iptables -D INPUT 2
iptables -D OUTPUT 2
6.例子如，加873端口号，只允许10.218.32.153访问
iptables -A INPUT -p tcp -s 10.218.32.153 --dport 873 -j ACCEPT
iptables -A OUTPUT -p tcp -d 10.218.32.153 --sport 873 -j ACCEPT
结果如下
[root@localhost /]# iptables -L -n
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ACCEPT tcp -- 10.218.32.153 0.0.0.0/0 tcp dpt:873
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22
ACCEPT tcp -- 0.0.0.0/0 10.218.32.153 tcp spt:873
iptables -F
iptables -X
iptables -Z
iptables -D RH-Firewall-1-INPUT 4
/etc/init.d/iptables save
service iptables restart
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 192.168.1.0 --dport 22 -j ACCEPT
iptables -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT
iptables -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 192.168.1.0 --dport 80 -j ACCEPT*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
iptables -A INPUT -p tcp --dport 12345 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 12345 -j ACCEPT
iptables -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 12345 -j ACCEPT
iptables -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 12345 -j ACCEPT
编辑
/etc/sysconfig/iptables
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 12345 -j ACCEPT
OK.
