Beurk :
exclude=kernel nss nss-
Package names are separated by a space. Shell globs using wildcards (eg. * and ?) are allowed.
For dnf, the configuration file is located under:
/etc/dnf/dnf.conf

par exemple :
iptables -A INPUT -p tcp -m tcp -m multiport ! --dports 22 -j DROP
iptables -A INPUT -p tcp -m tcp -m multiport ! --dports 80,443 -j DROP