A practical baseline.
THE DEFAULT
Deny all incoming. Permit all outgoing, unless you have a reason to restrict it.
INCOMING RULES TO PERMIT
SSH, ideally restricted to known source addresses HTTP and HTTPS from anywhere Mail ports, if the server handles mail Control panel ports, ideally restricted by source
WHAT TO KEEP CLOSED
Database ports. Always, unless there is a specific documented need, and then restricted by source address. Administrative interfaces bound to localhost where possible, reached through an SSH tunnel rather than exposed. Anything you do not actively use.
RATE LIMITING
Limiting connection rates to SSH reduces brute-force effectiveness even before fail2ban acts.
OUTBOUND RULES
Restricting outbound traffic limits what a compromised application can do: exfiltrating data, joining a botnet, sending spam. More work to maintain, and worth it on sensitive systems.
REVIEWING
Periodically list your rules and ask whether each is still needed. Rules added for a temporary purpose survive for years.
TESTING
Scan your server from outside and confirm only the expected ports respond.
