Usually the NEW
state will be used to filter cases you don't wont to see as the first packet of a stream.
For instance :
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
Will drop everything that doesn't look like a valid TCP SYN
packet.
If your use case is to allow the world to connect to your server port 443, allow your server to reply and the connection to be established then you need to add the second rule but the NEW
state is not mandatory.
So your configuration could either be :
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Or
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Or (better)
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT