I'm pretty lazy, so I just use UFW block all connections by default, then open the ones I need up to my VPN IP's only (aside from the odd port I give public access to). I also remove pretty much everything I don't need, but that's very much a necessity as most of my VPS's are under 128MB.
One...