Argent

This was really helpful! I tweaked it just a bit to keep all rules on 1 screen. If you add a final deny rule (as seen below), you don't have to deny on the local and vpn interfaces.