*filter
:INPUT DROP []
:FORWARD ACCEPT []
:OUTPUT ACCEPT []

# loopback allowed
-A INPUT -i lo -j ACCEPT

# Accept ping and traceroute (needs icmp)
-A INPUT -p icmp -j ACCEPT

# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# SSH
-A INPUT -p tcp -m tcp  --dport 22 -j ACCEPT

# SNMP allows from oit monitoring systems
#-A INPUT -p udp -m udp -s ips-allowed-here --dport 161 -j ACCEPT

# NTP servers (if any)
#-A INPUT -p udp -m udp -s ips-allowed-here --dport 123 -j ACCEPT

# Services TCP
<% tcpPorts.each do |port| -%> 
-A INPUT -p tcp -m tcp  --dport <%= port %> -j ACCEPT
<% end -%>

# Services UDP
<% udpPorts.each do |port| -%> 
-A INPUT -p tcp -m tcp  --dport <%= port %> -j ACCEPT
<% end -%>


# more services we use - ports for random services and TG listeners.