I want to be able to access my Linux desktop from my phone from outside my lan, which I'm actually doing without problem.  However, I get lots of attempts from hackers, who so far have never been able to get in, but I'd feel better if they could be blocked.

Ideally, I'd like to whitelist a device like my phone by MAC address.  I have a rule set up for that, but I don't see how to use it for what I want.  My first attempt simply blocked everything except my phone from using the internet, which is not desirable.  Is there a way to block incoming traffic from the WAN side, but not block outgoing?