[Vince]

Rules are matched top to bottom. Therefore lo0 should be first or you're going to screw yourself over. Then you need to allow traffic with a connection state "related" or "established" and then you can start checking the ports. And instead of blacklisting use whitelisting: make exceptions for the things you want to allow through and then have an unconditional drop as the final rule (you can also set the default policy as drop, but that's dangerous).