Can you critique the iptables rules?

Question

iptables

Good afternoon!
I'm learning IPTABLES. I want constructive criticism according to the above rules (home server that uses Samba and CUPS. SSH connection from one computer):
*filter
:INPUT DROP [1082:114493]
:FORWARD DROP [0:0]
:OUTPUT DROP [34:1780 ]
# Allow lo
-A INPUT -i lo -j ACCEPT
# Drop packets with status INVALID
-A INPUT -m state --state INVALID -j DROP
# Allow ssh connection (port 1212 changed from 22) from a specific mac address.
-A INPUT -m mac --mac-source 00:00:00:00:00:01 -p tcp -m multiport --port 1212 -j ACCEPT
# apt
-A INPUT -p tcp -m multiport --port 80 ,53,32768:61000 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m multiport --port 80,53,32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --port 80,53,32768:61000 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m multiport --port 80,53,32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
# Samba
-A INPUT -s 192.168. 14.0/24 -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -s 192.168.14.0/24 -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -s 192.168.14.0/24 - p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -s 192.168.14.0/24 -p tcp -m tcp --dport 445 -j ACCEPT
# CUPS
-A INPUT -s 192.168.14.0/24 -p udp -m udp --dport 631 -j ACCEPT
-A INPUT -s 192.168.14.0/24 -p tcp -m tcp --dport 631 -j ACCEPT
COMMIT

Answer 1

There is something odd about ssh.
If the server is exposed directly to the Internet, then there is no point in --mac-source when accessed from outside.
If the server is on the local network and access from the outside is only through the router, then it is not clear why ssh on a non-standard port, because for access from the outside on the router, port forwarding is still required.
Further, Samba and CUPS will not work, because only INPUT is allowed, and OUTPUT is DROP by default. In general, dropping OUTPUT by default is not the best idea, IMHO. Unless we were talking about a computer in the dungeons of the special services :)