iptables打开22,80,8080,3306等端口

systemctl stop firewalld
systemctl mask firewalld

Then, install the iptables-services package:

yum install iptables-services

Enable the service at boot-time:

systemctl enable iptables

Managing the service

systemctl [stop|start|restart] iptables

Saving your firewall rules can be done as follows:

service iptables save

or

/usr/libexec/iptables/iptables.init save

reference:https://www.cnblogs.com/anne32184/p/5961806.html

 vi /etc/sysconfig/iptables
 -A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT（允许80端口通过防火墙）
 -A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT（允许3306端口通过防火墙）
 特别提示：很多网友把这两条规则添加到防火墙配置的最后一行，导致防火墙启动失败，正确的应该是添加到默认的22端口这条规则的下面
 添加好之后防火墙规则如下所示：
 ######################################
 # Firewall configuration written by system-config-firewall
 # Manual customization of this file is not recommended.
 *filter
 :INPUT ACCEPT [0:0]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [0:0]
 -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
 -A INPUT -i lo -j ACCEPT
 -A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
 -A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT
 -A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT
 -A INPUT -j REJECT –reject-with icmp-host-prohibited
 -A FORWARD -j REJECT –reject-with icmp-host-prohibited
 COMMIT
 #####################################
 /etc/init.d/iptables restart      #最后重启防火墙使配置生效

 # Generated by iptables-save v1.4.21 on Fri Jul 28 19:10:39 2017
 *nat
 :PREROUTING ACCEPT [0:0]
 :INPUT ACCEPT [0:0]
 :OUTPUT ACCEPT [136:8416]
 :POSTROUTING ACCEPT [136:8416]
 :OUTPUT_direct - [0:0]
 :POSTROUTING_ZONES - [0:0]
 :POSTROUTING_ZONES_SOURCE - [0:0]
 :POSTROUTING_direct - [0:0]
 :POST_public - [0:0]
 :POST_public_allow - [0:0]
 :POST_public_deny - [0:0]
 :POST_public_log - [0:0]
 :PREROUTING_ZONES - [0:0]
 :PREROUTING_ZONES_SOURCE - [0:0]
 :PREROUTING_direct - [0:0]
 :PRE_public - [0:0]
 :PRE_public_allow - [0:0]
 :PRE_public_deny - [0:0]
 :PRE_public_log - [0:0]
 -A PREROUTING -j PREROUTING_direct
 -A PREROUTING -j PREROUTING_ZONES_SOURCE
 -A PREROUTING -j PREROUTING_ZONES
 -A OUTPUT -j OUTPUT_direct
 -A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
 -A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
 -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
 -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
 -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
 -A POSTROUTING -j POSTROUTING_direct
 -A POSTROUTING -j POSTROUTING_ZONES_SOURCE
 -A POSTROUTING -j POSTROUTING_ZONES
 -A POSTROUTING_ZONES -o enp0s3 -g POST_public
 -A POSTROUTING_ZONES -g POST_public
 -A POST_public -j POST_public_log
 -A POST_public -j POST_public_deny
 -A POST_public -j POST_public_allow
 -A PREROUTING_ZONES -i enp0s3 -g PRE_public
 -A PREROUTING_ZONES -g PRE_public
 -A PRE_public -j PRE_public_log
 -A PRE_public -j PRE_public_deny
 -A PRE_public -j PRE_public_allow
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 9904 -j ACCEPT

 -A INPUT -j REJECT --reject-with icmp-host-prohibited
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited
 #（之前我添加在下面，浏览器也是不能访问的，必须放在上面！）
 #允许8080端口通过防火墙
 #-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
 #允许3306端口通过防火墙
 #-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
 #允许9904端口通过防火墙
 #-A INPUT -m state --state NEW -m tcp -p tcp --dport 9904 -j ACCEPT
 COMMIT
 # Completed on Fri Jul 28 19:10:39 2017
 # Generated by iptables-save v1.4.21 on Fri Jul 28 19:10:39 2017
 *mangle
 :PREROUTING ACCEPT [732:348610]
 :INPUT ACCEPT [732:348610]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [765:100277]
 :POSTROUTING ACCEPT [767:100547]
 :FORWARD_direct - [0:0]
 :INPUT_direct - [0:0]
 :OUTPUT_direct - [0:0]
 :POSTROUTING_direct - [0:0]
 :PREROUTING_ZONES - [0:0]
 :PREROUTING_ZONES_SOURCE - [0:0]
 :PREROUTING_direct - [0:0]
 :PRE_public - [0:0]
 :PRE_public_allow - [0:0]
 :PRE_public_deny - [0:0]
 :PRE_public_log - [0:0]
 -A PREROUTING -j PREROUTING_direct
 -A PREROUTING -j PREROUTING_ZONES_SOURCE
 -A PREROUTING -j PREROUTING_ZONES
 -A INPUT -j INPUT_direct
 -A FORWARD -j FORWARD_direct
 -A OUTPUT -j OUTPUT_direct
 -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
 -A POSTROUTING -j POSTROUTING_direct
 -A PREROUTING_ZONES -i enp0s3 -g PRE_public
 -A PREROUTING_ZONES -g PRE_public
 -A PRE_public -j PRE_public_log
 -A PRE_public -j PRE_public_deny
 -A PRE_public -j PRE_public_allow
 COMMIT
 # Completed on Fri Jul 28 19:10:39 2017
 # Generated by iptables-save v1.4.21 on Fri Jul 28 19:10:39 2017
 *security
 :INPUT ACCEPT [727:348220]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [765:100277]
 :FORWARD_direct - [0:0]
 :INPUT_direct - [0:0]
 :OUTPUT_direct - [0:0]
 -A INPUT -j INPUT_direct
 -A FORWARD -j FORWARD_direct
 -A OUTPUT -j OUTPUT_direct
 COMMIT
 # Completed on Fri Jul 28 19:10:39 2017
 # Generated by iptables-save v1.4.21 on Fri Jul 28 19:10:39 2017
 *raw
 :PREROUTING ACCEPT [732:348610]
 :OUTPUT ACCEPT [765:100277]
 :OUTPUT_direct - [0:0]
 :PREROUTING_direct - [0:0]
 -A PREROUTING -j PREROUTING_direct
 -A OUTPUT -j OUTPUT_direct
 COMMIT
 # Completed on Fri Jul 28 19:10:39 2017
 # Generated by iptables-save v1.4.21 on Fri Jul 28 19:10:39 2017
 *filter
 :INPUT ACCEPT [0:0]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [14:984]
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
 -A INPUT -i lo -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 9904 -j ACCEPT
 -A INPUT -j REJECT --reject-with icmp-host-prohibited
 #-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
 #允许3306端口通过防火墙
 #-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
 #允许9904端口通过防火墙
 #-A INPUT -m state --state NEW -m tcp -p tcp
 -A INPUT -j REJECT --reject-with icmp-host-prohibited
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited
 COMMIT
 # Completed on Fri Jul 28 19:10:39 201