diff --git a/agent/app/service/firewall.go b/agent/app/service/firewall.go
index 7fee78e2e..53d2148b2 100644
--- a/agent/app/service/firewall.go
+++ b/agent/app/service/firewall.go
@@ -186,6 +186,9 @@ func (u *FirewallService) OperateFirewall(req dto.FirewallOperation) error {
 		if err := client.Restart(); err != nil {
 			return err
 		}
+		if err := u.addPortsBeforeStart(client); err != nil {
+			return err
+		}
 		needRestartDocker = true
 	case "disableBanPing":
 		if err := firewall.UpdatePingStatus("0"); err != nil {
@@ -579,6 +582,13 @@ func (u *FirewallService) cleanUnUsedData(client firewall.FirewallClient) {
 }
 
 func (u *FirewallService) addPortsBeforeStart(client firewall.FirewallClient) error {
+	if client.Name() == "iptables" {
+		isInit, _ := iptables.LoadInitStatus("iptables", "base")
+		if !isInit {
+			return nil
+		}
+		return syncIptablesFirewallPortWhiteList(true)
+	}
 	portWhiteList, err := loadFirewallPortWhiteList()
 	if err != nil {
 		return err
diff --git a/agent/app/service/firewall_setting.go b/agent/app/service/firewall_setting.go
index 4af09187a..fba99f319 100644
--- a/agent/app/service/firewall_setting.go
+++ b/agent/app/service/firewall_setting.go
@@ -16,7 +16,7 @@ type firewallPortWhitelist struct {
 	Protocol string
 }
 
-func loadFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
+func loadConfiguredFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
 	value, err := settingRepo.GetValueByKey(constant.FirewallPortWhiteList)
 	if err != nil {
 		value = constant.FirewallPortWhiteListValue
@@ -24,21 +24,30 @@ func loadFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
 			return nil, err
 		}
 	}
-	return parseFullFirewallPortWhiteList(value)
+	return parseFirewallPortWhiteList(value)
 }
 
-func parseFullFirewallPortWhiteList(value string) ([]firewallPortWhitelist, error) {
-	portWhiteList, err := parseFirewallPortWhiteList(value)
+func loadFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
+	portWhiteList, err := loadConfiguredFirewallPortWhiteList()
 	if err != nil {
 		return nil, err
 	}
+	requiredPorts, err := loadRequiredFirewallPortWhiteList()
+	if err != nil {
+		return nil, err
+	}
+	return normalizeFirewallPortWhiteList(append(portWhiteList, requiredPorts...)), nil
+}
+
+func loadRequiredFirewallPortWhiteList() ([]firewallPortWhitelist, error) {
 	panelPort := LoadPanelPort()
 	if panelPort == "" {
 		return nil, fmt.Errorf("find 1panel service port failed")
 	}
-	portWhiteList = append(portWhiteList, firewallPortWhitelist{Port: panelPort, Protocol: "tcp"})
-	portWhiteList = append(portWhiteList, firewallPortWhitelist{Port: loadSSHPort(), Protocol: "tcp"})
-	return normalizeFirewallPortWhiteList(portWhiteList), nil
+	return normalizeFirewallPortWhiteList([]firewallPortWhitelist{
+		{Port: panelPort, Protocol: "tcp"},
+		{Port: loadSSHPort(), Protocol: "tcp"},
+	}), nil
 }
 
 func parseFirewallPortWhiteList(value string) ([]firewallPortWhitelist, error) {
@@ -97,22 +106,36 @@ func syncFirewallPortWhiteListAfterUpdate(oldValue string) error {
 	if err != nil {
 		return err
 	}
+	if client.Name() == "iptables" {
+		isInit, _ := iptables.LoadInitStatus("iptables", "base")
+		if !isInit {
+			return nil
+		}
+		oldPortWhiteList, err := parseFirewallPortWhiteList(oldValue)
+		if err != nil {
+			return err
+		}
+		return syncIptablesFirewallPortWhiteList(true, oldPortWhiteList)
+	}
+
+	isActive, _ := client.Status()
+	if !isActive {
+		return nil
+	}
 	portWhiteList, err := loadFirewallPortWhiteList()
 	if err != nil {
 		return err
 	}
-	if client.Name() != "iptables" {
-		oldPortWhiteList, err := parseFullFirewallPortWhiteList(oldValue)
-		if err != nil {
-			return err
-		}
-		return syncFirewallClientPortWhiteList(client, oldPortWhiteList, portWhiteList)
+	oldPortWhiteList, err := parseFirewallPortWhiteList(oldValue)
+	if err != nil {
+		return err
 	}
-	isInit, _ := iptables.LoadInitStatus("iptables", "base")
-	if !isInit {
-		return nil
+	requiredPorts, err := loadRequiredFirewallPortWhiteList()
+	if err != nil {
+		return err
 	}
-	return applyFirewallPortWhiteListRules(portWhiteList, true)
+	oldPortWhiteList = normalizeFirewallPortWhiteList(append(oldPortWhiteList, requiredPorts...))
+	return syncFirewallClientPortWhiteList(client, oldPortWhiteList, portWhiteList)
 }
 
 func syncFirewallClientPortWhiteList(client firewall.FirewallClient, oldPortWhiteList, portWhiteList []firewallPortWhitelist) error {
diff --git a/agent/app/service/iptables.go b/agent/app/service/iptables.go
index 47488bbee..de0e9b96d 100644
--- a/agent/app/service/iptables.go
+++ b/agent/app/service/iptables.go
@@ -187,6 +187,9 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
 		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
 			return err
 		}
+		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
+			return err
+		}
 		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
 			return err
 		}
@@ -231,6 +234,9 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
 		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
 			return err
 		}
+		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
+			return err
+		}
 		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
 			return err
 		}
@@ -371,11 +377,7 @@ func initPreRules() error {
 	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT", "-m", "comment", "--comment", "ESTABLISHED Whitelist"); err != nil {
 		return err
 	}
-	portWhiteList, err := loadFirewallPortWhiteList()
-	if err != nil {
-		return err
-	}
-	if err := applyFirewallPortWhiteListRules(portWhiteList, false); err != nil {
+	if err := syncIptablesFirewallPortWhiteList(false); err != nil {
 		return err
 	}
 	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, "-p", "tcp", "-j", "DROP"); err != nil {
@@ -387,8 +389,23 @@ func initPreRules() error {
 	return nil
 }
 
-func applyFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, withSave bool) error {
-	if err := syncFirewallPortWhiteListRules(portWhiteList); err != nil {
+func syncIptablesFirewallPortWhiteList(withSave bool, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
+	requiredPorts, err := loadRequiredFirewallPortWhiteList()
+	if err != nil {
+		return err
+	}
+	if err := applyRequiredFirewallPortWhiteListRules(requiredPorts, withSave); err != nil {
+		return err
+	}
+	portWhiteList, err := loadConfiguredFirewallPortWhiteList()
+	if err != nil {
+		return err
+	}
+	return applyFirewallPortWhiteListRules(portWhiteList, withSave, oldConfiguredPortWhiteList...)
+}
+
+func applyRequiredFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, withSave bool) error {
+	if err := syncRequiredFirewallPortWhiteListRules(portWhiteList); err != nil {
 		return err
 	}
 	for _, item := range portWhiteList {
@@ -405,7 +422,22 @@ func applyFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, with
 	return iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName)
 }
 
-func syncFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist) error {
+func applyFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, withSave bool, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
+	if err := syncFirewallPortWhiteListRules(portWhiteList, oldConfiguredPortWhiteList...); err != nil {
+		return err
+	}
+	for _, item := range portWhiteList {
+		if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "-m", item.Protocol, "--dport", item.Port, "-j", "ACCEPT"); err != nil {
+			return err
+		}
+	}
+	if !withSave {
+		return nil
+	}
+	return iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName)
+}
+
+func syncRequiredFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist) error {
 	tcpWhitelist := make(map[string]struct{})
 	udpWhitelist := make(map[string]struct{})
 	for _, item := range portWhiteList {
@@ -425,6 +457,25 @@ func syncFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist) error
 	return cleanExtraFirewallPortRules(iptables.Chain1PanelBasicAfter, "udp", map[string]struct{}{})
 }
 
+func syncFirewallPortWhiteListRules(portWhiteList []firewallPortWhitelist, oldConfiguredPortWhiteList ...[]firewallPortWhitelist) error {
+	portWhitelist := firewallPortWhiteListMap(portWhiteList)
+	if len(oldConfiguredPortWhiteList) == 0 {
+		return nil
+	}
+	for _, item := range oldConfiguredPortWhiteList[0] {
+		if _, ok := portWhitelist[firewallPortWhiteListKey(item)]; ok {
+			continue
+		}
+		if !iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "--dport", item.Port, "-j", "ACCEPT") {
+			continue
+		}
+		if err := iptables.DeleteRule(iptables.FilterTab, iptables.Chain1PanelBasic, "-p", item.Protocol, "--dport", item.Port, "-j", "ACCEPT"); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func cleanExtraFirewallPortRules(chain, protocol string, whitelist map[string]struct{}) error {
 	rules, err := iptables.ReadFilterRulesByChain(chain)
 	if err != nil {