iptables

iptables -D INPUT -p tcp --dport 9696 -j REJECT

iptables -I INPUT -p tcp -m tcp --dport 80 -j ACCEPT

--append 　 -A chain        Append to chain
--delete  　　-D chain        Delete matching rule from chain
--delete  　　-D chain rulenum　　  Delete rule rulenum (1 = first) from chain
--insert  　　-I chain [rulenum]　　 Insert in chain as rulenum (default 1=first)
--replace 　 -R chain rulenum      Replace rule rulenum (1 = first) in chain
--list    　　  -L [chain [rulenum]]  List the rules in a chain or all chains
--list-rules -S [chain [rulenum]]  Print the rules in a chain or all chains
--flush   　　-F [chain]        Delete all rules in  chain or all chains
--zero    　 -Z [chain [rulenum]]  Zero counters in chain or all chains
--new     　 -N chain        Create a new user-defined chain
--delete-chain    -X [chain]        Delete a user-defined chain
--policy  -P chain target             Change policy on chain to target
--rename-chain  -E old-chain new-chain Change chain name, (moving any references)

firewall-cmd --direct --passthrough ipv4 -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE
adding iptables rule finished

http://blog.chinaunix.net/uid-26495963-id-3279216.html

http://www.zsythink.net/archives/1199