# allow ESP
iptables -A INPUT -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -p udp --dport 500 -j ACCEPT
# allow NAT-T (IKE and ESP-in-UDP)
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
# allow SSH and other protocols
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
...
# drop packets by default
iptables -P INPUT DROP