iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Description:
Specifies the state of the package to be matched. There are currently 4 states available: INVALID, ESTABLISHED, NEW and RELATED. INVALID means that this packet has no known stream or connection associated with it, or that there is something wrong with the data it contains or the packet header. ESTABLISHED means that the packet is fully valid and belongs to an established connection where data has been sent on both ends of the connection. NEW indicates that the packet is about to or has started to establish a new connection, or that the packet is related to a connection that has not yet sent data at both ends. RELATED indicates that the packet is establishing a new connection that is related to an already established connection. For example, FTP data transfer, ICMP errors are associated with a TCP or UDP connection. Note that the NEW state does not look for the SYN flag in TCP packets trying to establish a new connection, so it should not be used unmodified where there is only one firewall or where load balancing is not enabled between different firewalls.
Note: If you set OUTPUT to DROP, write
iptables -A OUTPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT