I would suggest you adjust your approach from single-port-focus to a full 'defense' posture: Whitelist IPs, reject all other connection attempts. This applies for most all ports on your environment - because otherwise you're going to have to blacklist every IP known to existence that does service scanning, so you're going to have an insanely long list in its place. Service scanners scan for every port so you should adopt a "denial of trust" approach first and foremost. Things like a web server (port 80, 443 for HTTP/HTTPS may need wider access than specific IPs if it's a public site) are also scanned but can be 'protected' by properly hardening the web server and content. However, all ports are scanned by service scanners, and all internet connected devices are subjected to scans, so denying everything to start is the better approach.
As such, the most effective approach to "denial of trust" is to simply allow certain IPs to connect to the port(s) and all other services on the machine, and then reject all other attempts to connect. While also allowing localhost to communicate to itself, which is OK.
Start by protecting everything with whitelisting before opening other ports. If you need more services we can configure additional ALLOW rules for HTTP traffic from everywhere, etc.
# Allow localhost traffic
iptables -A INPUT -i lo -j ACCEPT
# INVALID type packets should be DROPped regardless of source.
iptables -A INPUT -m state --state INVALID -j DROP
# Allow traffic for related/established connections already running
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow all new connections/traffic from the local subnet you're on
# (10.20.30.0/24 is used in example)
iptables -A INPUT -m state --state NEW -s 10.20.30.0/24 -j ACCEPT
# Whitelist your IPs - repeat this step for each of your IPs permitted
# to access the machine outside of local network
iptables -A INPUT -s IPADDRESS -m state --state NEW -j ACCEPT
# If you have other services you want to configure for *public* access, then
# use this rule as a template and execute this before you follow the last step.
#
# Change PROTO to the protocol (tcp/udp, etc.) and PORT to the port number
# (80 for HTTP, ex.)
#
# Add this to the end of the rule if you want to allow only certain
# IPs to the specified service:
# -s IPADDRESS
iptables -A INPUT -p PROTO --dport PORT -m state --state NEW -j ACCEPT
# Deny all other traffic
iptables -A INPUT -j REJECT --reject-with icmp-host-unreachable
This is based on my experience with servers for almost 15 years, and my network security training. As well as my knowledge as an IT Security Professional.
