1.检查系统是否安装防火墙

iptables -V

2.安装

yum -y install iptables-services

3.查看防火墙的状态

service iptable status

4.临时关闭防火墙

service iptables stop

5.重启防火墙

service iptables restart

6.添加规则

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

7.编辑配置

vim /etc/sysconfig/iptables

8.保存

service iptables save

9.重启

service iptables restart

完整的配置

# Generated by iptables-save v1.4.7 on Wed Aug 30 18:46:28 2017
*filter
#:INPUT ACCEPT [6:384]
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:544]
#COMMIT
# 允许io接口的数据包，如果没有则不能访问本地
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -m state --state NEW -p TCP --dport 60000:60010 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
# 这两条的意思是在INPUT表和FORWARD表中拒绝所有其他不符合上述任何一条规则的数据包。并且发送一条host prohibited的消息给被拒绝的主机。
COMMIT
# Completed on Wed Aug 30 18:46:28 2017