Iptables - general

Allow incoming ports :
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Incoming ports for samba :

netbios-ns – 137/tcp # NETBIOS Name Service
netbios-dgm – 138/tcp # NETBIOS Datagram Service
netbios-ssn – 139/tcp # NETBIOS session service
microsoft-ds – 445/tcp # if you are using Active Directory
 
iptables -A INPUT -p tcp -m tcp --dport 137 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 138 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 139 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 445 -j ACCEPT

Good ref - https://fedoraproject.org/wiki/How_to_edit_iptables_rules#Appending_Rules
This adds a rule at the end of the specified chain - https://fedoraproject.org/wiki/How_to_edit_iptables_rules#Appending_Rules

To delete a rule you must know its position in the chain
iptables -D INPUT 5

Postion 3 looks good for insert

iptables -I INPUT 1 -p tcp -m tcp --dport 137 -j ACCEPT
iptables -I INPUT 1 -p tcp -m tcp --dport 138 -j ACCEPT
iptables -I INPUT 1 -p tcp -m tcp --dport 139 -j ACCEPT
iptables -I INPUT 1 -p tcp -m tcp --dport 445 -j ACCEPT

Suggestion for masquerading:

# /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# /sbin/iptables -A FORWARD -i tun0 -o eth0 -m state   --state RELATED,ESTABLISHED -j ACCEPT
# /sbin/iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT