*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
# otherwise self-referential connections to local host will fail
-A INPUT -i lo -j ACCEPT
# this enables ping etc.
-A INPUT -p icmp -j ACCEPT
# SSH
-A INPUT -p tcp --dport 22 -j ACCEPT
# HTTP; uncomment for creating LetsEncrypt certificates in standalone mode.
#-A INPUT -p tcp --dport 80 -j ACCEPT
# SMTP (allowing for STARTTLS); necessary for mail server to mail server banter
# HTTPS in theory, in practice my second SSH port, see sshd_config
-A INPUT -p tcp --dport 443 -j ACCEPT
# SMTP (allowing for STARTTLS); necessary for mail server to mail server banter
-A INPUT -p tcp --dport 25 -j ACCEPT
# SMTPS, for mail server to mail user agent communication
-A INPUT -p tcp --dport 465 -j ACCEPT
# IMAPS
-A INPUT -p tcp --dport 993 -j ACCEPT
# tolerate any inbound connections requested by our server, no matter the port
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# this last line is here because iptables-restore ignores the final command if no newline follows it