这是iptables -L的输出
Chain INPUT (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain RH-Firewall-1-INPUT (2 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere icmp any ACCEPT esp -- anywhere anywhere ACCEPT ah -- anywhere anywhere ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ACCEPT udp -- anywhere anywhere udp dpt:ipp ACCEPT tcp -- anywhere anywhere tcp dpt:ipp ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited 我想打开端口8140，所以其他puppet客户端可以与puppet master进行通信，所以我尝试添加这个规则：
iptables -I INPUT 2 -p tcp --dport 8140 -j ACCEPT
但它没有工作。 如果有帮助，iptables-save的输出是
# Generated by iptables-save v1.3.5 on Mon Jun 21 17:07:33 2010 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [605:28389] :RH-Firewall-1-INPUT - [0:0] -A INPUT -j RH-Firewall-1-INPUT -A INPUT -p tcp -m tcp --dport 8140 -j ACCEPT -A FORWARD -j RH-Firewall-1-INPUT -A RH-Firewall-1-INPUT -i lo -j ACCEPT -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT -A RH-Firewall-1-INPUT -p esp -j ACCEPT -A RH-Firewall-1-INPUT -p ah -j ACCEPT -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Mon Jun 21 17:07:33 2010
谢谢。
如果你要添加
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 8140 -j ACCEPT
在该行的前面：
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
这应该给你想要的结果，你正在寻找。
您需要更新名为RH-Firewall-1的链，而不是INPUT。
你应该可以使用system-config-security（或类似的东西）来修改防火墙规则。 这是首选，因为它是持久的，并保持服务器重新启动。