In fact, I did not have a little idea about iptables before, only know that it is a firewall. But when I deployed the kms service, it showed that I could not connect, and the solution found on the Internet was to set the iptables rule to allow the kms service to pass. I knew that I needed to supplement this knowledge. I will not read this website for detailed instructions. The main content of this paper is to solve the problem that the kms service cannot connect to the local 127.0.0.1:1688, and cannot connect to the local 1688 port on the external network.

# Unable to connect to local 127.0.0.1:1688

When the service is first turned on, an error is displayed and the local port 127.0.0.1:1680 cannot be connected. Use the following command to release the local ring connection:

iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

# Unable to link local 1688 port on external network

Use the following command to release:

iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 1688 -j ACCEPT

Use the following command to see a list of the rules currently executed by iptables (currently! Because all changes are now only stored in memory)

iptables -L -n

At least the following four rules kms service are required:

Chain INPUT (policy ACCEPT)
targetprot opt sourcedestination
ACCEPTall  --  127.0.0.1  127.0.0.1
ACCEPTtcp  --  0.0.0.0/0  0.0.0.0/0  state NEW tcp dpt:1688
ACCEPTtcp  --  0.0.0.0/0  0.0.0.0/0  tcp spt:1688
Chain FORWARD (policy ACCEPT)
\*\*\*\*\*\*\*\*\*\*\*\*\*
Chain OUTPUT (policy ACCEPT)
ACCEPTtcp  --  0.0.0.0/0  0.0.0.0/0  tcp spt:1688

If there are these rules in the output, you can try to activate it again and it should be activated normally. However, these are temporary, will be invalid after restart, will return to the state before the setup.

If it needs to be restarted and it will take effect, please refer to: iptables firewall restart failure solution.