I have nginx serving files with uwsgi and I wanted to lock my server down just to allow SSH and Nginx to run.
#!/bin/bash
i=/sbin/iptables
# Flush all rules
$i -F
$i -X
# Setup default filter policy
$i -P INPUT DROP
$i -P OUTPUT DROP
$i -P FORWARD DROP
# Allow unlimited traffic on loopback
$i -A INPUT -i lo -j ACCEPT
$i -A OUTPUT -o lo -j ACCEPT
# Open up ports for nginx
$i -A INPUT -p tcp --dport 443 -j ACCEPT
$i -A INPUT -p tcp --dport 80 -j ACCEPT
$i -A INPUT -p tcp --dport 22 -j ACCEPT
# Make sure nothing comes or goes out of this box
$i -A INPUT -j DROP
$i -A OUTPUT -j DROP
It's quite a minimal example but it looks like it would do the job. Are there any improvements to be had?