I'm complete newbie on game server work. As I know, online (massively multiplay) game server should keep some TCP or UDP connection from the user. As I (=newbie) guess, maybe huge count of socket port should be opened. So how should I configure firewall for game server? Or should I use some other special method to security? Any advise will be appreciated.
From the way your question is worded, I get the impression that you think there needs to be one incoming port per player connection; this is not at all the case. Each client connects to one public port, whichever that port may be, and all communication comes in through that single listening port, even if there are thousands of players.
There can of course be several ports open, but the main point is that each port can handle more than one simultaneous connection to or from it, so you need only open ports on your firewall corresponding to any ports that the game server listens on; this may be one or a few, but it should not be thousands of ports.
On a low level, a "port" is just a number tacked onto a packet. The firewall can read it and drop the packet if it's out of your specified ranges, and the operating system obviously obeys it and hands the packet to the application listening for that port, but the network system doesn't care if two or more people send and receive packets over the same port. They're just packets, they don't somehow "collide" if they are of the same port.
In terms of configuring your firewall for maximum security: block EVERYTHING except that which you absolutely cannot live without.
In his post @Ricket makes several great points , I'd like to add a bit more background for you. You mention TCP and UDP "Connections" -- TCP has connections and has handshakes built into the protocol, UDP does not. For both protocols, a port must be "allowed" and an application must be listening on that port. Think of an IP address like a physical address, and think of the port as the apartment number -- take a web server for example, it has an IP address and listens on TCP port 80, even though the website can be viewed by hundreds or thousands of clients they all send their requests to "port 80" and the operating system sends those to the web server which is listening on that port.
The reason some games use both UDP and TCP is because in-game, there are a variety of services being communicated with from client --> server and also server --> client.
GameState is a great candidate for a UDP type of transmission, because speed is more important than getting every packet in order, loss of packets is made up for by client-side prediction.
In-Game-Chat is a great candidate for TCP, since performance is not critical, and order of data is important.
So a game might use UDP 5678 for GameState transfer, and might use TCP 5679 for chat -- in this case, you'd add these two (and only these two) exceptions in the firewall.
For maximum security when configuring the firewall you want to leave open any ports that people will need to play the game, and close all others. You may also want to allow ping (ICMP) through.
At the very least this will mean blocking the first 1024 ports.
That should leave the only security issues that can be remotely exploited to be those in the game server itself, so that will need to be coded with security in mind.