vps设置iptables后shadowsocks代理失败

[umbrella330]

vps系统是debian7，成功安装ss服务可以正常代理上网。当vps服务器设置开启iptables后，ss代理上网失败，症状是用影梭连接，提示连接成功，但是代理上网失败。清除所有规则后，恢复正常。ss服务器端口是8368，也不知道是哪个端口没有打开？刚刚接触iptables，不甚了解，请大神多多帮助，谢谢
网上找了一个vps设置教程，修改了一下，如下所示


*filter

# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
#-A OUTPUT -o lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# DNS(not need this rule, as we only accept the input with [ESTABLISHED,RELATED])
#-A INPUT -p udp --dport 53 -j ACCEPT
# DNS
#-A OUTPUT -p udp --dport 53 -j ACCEPT

# Allow ports for testing
#-A INPUT -p tcp --dport 8080:8090 -j ACCEPT

# Allow ports for MOSH (mobile shell)
#-A INPUT -p udp --dport 60000:61000 -j ACCEPT

# Allow SSH connections
# The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
#-A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
#-A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

# DDoS
-A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

# Log
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A OUTPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Log iptables denied calls
# -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Allow shadowsocks connections
# The -dport number should be the same port number you set in config.json
-A INPUT -p tcp --dport 8368 -j ACCEPT

# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT
#-A OUTPUT -j DROP

COMMIT