Iptables (IV)

Allow:

ssh (listening on TCP/22)
dns (listening on UDP/53 and TCP/53)
zabbix (listening on port TCP/10050)

/etc/iptables.up.rules:
-----------------------
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-P INPUT DROP
-P FORWARD DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 10050 -j ACCEPT
-A INPUT -j DROP
COMMIT

/etc/network/if-pre-up.d/iptables:
----------------------------------
#!/bin/bash
/sbin/iptables-restore < /etc/iptables.up.rules

_$: chmod +x /etc/network/if-pre-up.d/iptables
_$: /etc/network/if-pre-up.d/iptables
_$: iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:zabbix-agent
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination