You can set up one PC or virtual machine to host 2 or 3 different services (Web server, FTP server, SSH for example). This is the PC where you'll be editing the iptables rules.
First demo a different PC accessing each service and show it works (e.g., visit the web site, ftp and ssh servers).
Next, use an iptables rule to rejects access from any IP to port 80, then try to visit the website again. The connection should fail immediately. You can also show what happens when you use the drop directive instead of rejects. It makes the web browser hang. Connections to the SSH or FTP server should still work. Here are 2 rules for blocking access to port 80.
iptables -A INPUT -p tcp --dport 80 -j REJECT
iptables -A INPUT -p tcp --dport 80 -j DROP
Then you can do the same for the other services (--dport 22, --dport 21), or do it for a single ip:
iptables -A INPUT -s 192.168.1.100 -j REJECT #assuming client is at 192.168.1.100
The rules above assume that the default firewall policy is to accept any packets that don't match a rule, so you could maybe also demo adding exceptions, so "opening" ports e.g.:
iptables -P INPUT DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
There are far more examples you could do, but doing the client/server model should help students see what's going on when you type those commands in. See Firewall demo - iptables for other examples.