Block outbound traffic too.
Open up just what you need.
Segment internally and restrict access. You don’t need more than SSH to a Linux Server, or perhaps to it’s web interface for an application running on it.
