The first firewall rule I always set up is deceptively simple, but it sets up the structure for every other rule. That's a default of denying all incoming traffic.