I think you are making this way too complicated. If you want to set your OUTPUT policy to DENY then I would set up a bare minimum of rules, for example



That's simple and needs the last rule repeated per output port that you want to allow connections through to. It also allows all outgoing requests in response to packets that have already been allowed. The INPUT side of that is now handled by



You don't need separate input rules for accepting the replies to things that have been allowed out as they're allowed by the 2nd rule above. The things you want on your INPUT chain are for services that you have running on the machine - so, yes, port 1234 wants one like



This allows the initial connection (optionally from -s my.source.ip.addresses ) and subsequent traffic is allowed in and out by the RELATED,ESTABLISHED rules on input and output chains.