iptables_rule(only allow ssh connection)

firewalld_direct_message.sh

# using firewalld utility

firewall-cmd  --direct --add-rule ipv4 filter INPUT 0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -p tcp -m multiport --dports 200:65535 -j DROP

iptables_rule.sh

#!/bin/bash

# Only allow ssh connection.
# And boud a specific destnation range ports(200~65535) to block unhappy connection

# clear iptables
sudo iptables -F

# set policy
sudo iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -m multiport --dports 200:65535 -j DROP

# list 
sudo iptables  -L