# Flush INPUT/OUTPUT/FORWARD chains
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
 
# Drop invalid packets
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
 
# Accept everything on loopback
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
 
# Accept incoming packets for established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
# Accept incoming ICMP
iptables -A INPUT -p icmp -j ACCEPT
 
# Pass incoming SSH
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
 
# Accept outgoing packets for established connections
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
# Accept outgoing DNS
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
 
# Accept outgoing NTP
iptables -A OUTPUT -p tcp --dport 123 -j ACCEPT
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
 
# Accept outgoing HTTP/S
iptables -A OUTPUT -p tcp --dport 80  -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
 
# Accept outgoing SSH
iptables -A OUTPUT -p tcp --dport 22  -j ACCEPT
 
# Accept outgoing ICMP
iptables -A OUTPUT -p icmp -j ACCEPT
 
# Drop everything else
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  DROP

Источник: https://blog.sleeplessbeastie.eu/2018/06/13/how-to-create-iptables-firewall/