vi /etc/sysconfig/iptables

-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT(允许80端口通过防火墙)

-A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT(允许3306端口通过防火墙)

特别提示：很多网友把这两条规则添加到防火墙配置的最后一行，导致防火墙启动失败，正确的应该是添加到默认的22端口这条规则的下面

添加好之后防火墙规则如下所示：

######################################

# Firewall configuration written by system-config-firewall

# Manual customization of this file is not recommended.

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT

-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT

-A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT

-A INPUT -j REJECT –reject-with icmp-host-prohibited

-A FORWARD -j REJECT –reject-with icmp-host-prohibited

COMMIT

#####################################

/etc/init.d/iptables restart

#最后重启防火墙使配置生效

以上内容来自

以下内容来自 稻草人，欢迎来到我的在线笔记本= =(没错就是笔记本，，，)

(配图是我的ovh实验的结果)，第一个是不禁ping，第二个是禁ping，禁ping是显示丢包百分百的，不禁ping的话虽然ping的值很大但是可以看出是没怎么丢包的。(不管我的事情。他们的机器绕地球的ping值当然大。。。)

这里提供一份防火墙配置规则，可以粘贴下，然后重启防火墙配置即可(不禁ping)

# Generated by iptables-save v1.4.7 on Thu Dec 1 02:40:57 2016

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [121:26822]

-A INPUT -p tcp -m state –state NEW -m tcp –dport 30000:40000 -j ACCEPT

-A INPUT -p tcp -m state –state NEW -m tcp –dport 888 -j ACCEPT

-A INPUT -p tcp -m state –state NEW -m tcp –dport 80 -j ACCEPT

-A INPUT -p tcp -m state –state NEW -m tcp –dport 22 -j ACCEPT

-A INPUT -p tcp -m state –state NEW -m tcp –dport 21 -j ACCEPT

-A INPUT -p tcp -m state –state NEW -m tcp –dport 20 -j ACCEPT

-A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state –state NEW -m tcp –dport 22 -j ACCEPT

-A INPUT -j REJECT –reject-with icmp-host-prohibited

-A FORWARD -j REJECT –reject-with icmp-host-prohibited

COMMIT

# Completed on Thu Dec 1 02:40:57 2016

禁ping的话，可以把

:OUTPUT ACCEPT [121:26822]

改成

:OUTPUT ACCEPT [149:25845]