Q:

setting upsimple iptables rules to allow ssh, 80, 443 and openvpn

The scenario:
I have a raspberry PI, I'd like to:

SSH into it from any device in my internal network
Reach port 80 and 443 from any device in my internal network
Reach port 4567 which is port-mapped in my router to be able to have an OpenVPN connection from outside of my network
block anything else
allow any outgoing traffic from my raspberryPi

These are my current Iptables rules (iptables -S output):
NAT
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -o eth0 -j MASQUERADE

Filter
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -s 192.168.2.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 192.168.2.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 192.168.2.0/24 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4567 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

I have seen this done slighlty differently in a couple of blog posts. I am basing this off of a book on Linux Admin from 2018 that covers iptables a little bit but mostly focuses on ufw and firewalld.
My question:

Is there any gaping security hole in this? Anything that makes my
firewall rules completely useless? (I am not looking for the world's most secure firewall configuration either, just anything that could be easily circumvented)
Is the rule A INPUT -i lo -j ACCEPT really necessary or should everything work without it? When I delete this rule, my owncloud doens't work anymore
Is there any better, more concise or more modern way to implement this in iptables? (I know there are other tools but I'd like to stick to iptables for now)

A:

To answer your question:

The rules look fine, there doesn't seem to be any surprises or holes.
You need this rule because you had set the policy to DROP on INPUT
There is really not much else to do with iptables' syntax, its always been like this. (not that its bad, its actually pretty consice and strict but not the most friendly to the untrained eye)

