Is my iptables fine?

I have recently bought a VPS with CentOS 6.5 and DirectAdmin already installed on it. Knowing that I need to configure the firewall and security tools, I have already studied some basic tutorials about Linux's famous firewall, that is, Iptables and have added some lines to it according to the material I have read. I have also installed and configure the fail2ban. Now, I wanted to ask if my Iptables configuration is correct or I need to make any other changes. Please be kind enough to let me know if I have to make any corrections.

Many thanks

Here's the output of iptable --list

Chain INPUT (policy DROP)
target     prot opt source               destination         
fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
DROP       tcp  --  anywhere             anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN state NEW 
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:urd 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:54736 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:EtherNet/IP-1 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp ctstate NEW,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp-data ctstate NEW,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpts:ftp-data:65535 ctstate NEW,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            state ESTABLISHED 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp spt:domain 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp ctstate NEW,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp-data ctstate NEW,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1024:65535 dpts:ftp-data:65535 ctstate NEW,ESTABLISHED 

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere

Your default policy on your INPUT chain is "DROP" but you end with a global REJECT (meaning the DROP will never happen), I'd recommend removing that last line, or changing your default policy to ACCEPT, having both could be confusing during debugging.

I'm a fan of DROP over REJECT as it slows scanners and helps differentiate between something being offline or broken, and something being blocked by your firewall.

I think you are probably accepting too many INPUT ports, I'd wager you don't need pop,pops,imap & imaps?

Are you sure you want to be allowing incoming DNS requests?

Change your default policy of the FORWARD chain to either REJECT or DROP (or at least add a few rules to ensure you are only forwarding for things on your internal network).

Near the start, you are accepting Related and Established replies, then further down near the end of the INPUT chain you accept Established again, don't need that second one.

The three DROP rules near the top also have some redundancy in them (dropping FIN packets in two different rules for instance).

Your OUTPUT chain's default policy is ACCEPT, but you also have a bunch of rules that ACCEPT certain outbound connections, I'd assume that you probably meant to have the default policy as REJECT or DROP?

---------- Post updated at 09:15 AM ---------- Previous update was at 09:15 AM ----------

Edit: These are relatively small points, though, overall I think you are on the right track with this.

Hi Smiling Dragon

Thanks for the neat explanation. Actually, I have installed CSF now it seems to kind of automatically write iptables rules and add rules to it. It is not flawless, but for me it is good enough for now.

Thanks again.