vi /etc/sysconfig/iptables
如：-A INPUT -m state –state NEW -m tcp -p tcp –dport 139 -j ACCEPT（允许139端口通过防火墙）
-A INPUT -m state –state NEW -m tcp -p tcp –dport 445 -j ACCEPT（允许445端口通过防火墙） 特别提示：把规则添加到防火墙配置的最后一行，会导致防火墙启动失败。其余服务的端口号可以修改进去即可
正确添加好之后防火墙规则如下所示：######################################
# Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
-A INPUT -m state –state NEW -m tcp -p tcp –dport 23 -j ACCEPT
-A INPUT -m state –state NEW -m tcp -p tcp –dport 25 -j ACCEPT
-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT
-A INPUT -m state –state NEW -m tcp -p tcp –dport 139 -j ACCEPT -A INPUT -m state –state NEW -m tcp -p tcp –dport 445 -j ACCEPT-A INPUT -m state –state NEW -m tcp -p tcp –dport 1723 -j ACCEPT
-A INPUT -m udp -p udp –dport 137 -j ACCEPT-A INPUT -m udp -p udp –dport 138 -j ACCEPT
-A INPUT -j REJECT –reject-with icmp-host-prohibited -A FORWARD -j REJECT –reject-with icmp-host-prohibited COMMIT #####################################/etc/init.d/iptables restart #最后重启防火墙使配置生效