IPtables for webserver with SSH
Scripts should have a shebang line. If you happen to be running in a shell other than 'sh' or compoatible, then this script will fail. Add:

#!/bin/sh


as the very first line.

The rest of the script looks fine enough.

The script has a duplicate declaration:


$i -A INPUT -i lo -j ACCEPT



That line says that, if the computer is talking to itself (on the lo interface , the 'localhost'...), that it is allowed to listen to itself.

The other line:


$i -A INPUT -p icmp --icmp-type any -j ACCEPT



says that the computer will listen and respond to 'ping' requests.

The computer will also allow the two standard webserver ports (http and https) but that assumes your webserver is running on those ports.

Also allowed is ssh (port 22).

In essence, the script is doing what you need. You have a server that can listen on the standard http, https and ssh ports only on the public interfaces. You can also ping it.

What is unusual is the very restrictive outbound rules. This is nice, if you can live with it, but, for example, your computer will not be able to connect to anything else, so, it cannot use:


NTP
DNS
send mail
ping other computers
ssh out
etc.


It is recommended practice to have a default-DROP policy for OUTPUT, but, in practice, I have seen very few servers that actually do that.... it is hard to live with.