More details later, but in a nutshell
Remove SSH (usually port 22) and Webconfig (port 81) access from default Incoming Firewall (https://example.org:81/app/incoming_firewall) and replace by rules in the Custom Firewall
Be careful not to lock yourself out!
iptables -I INPUT -p tcp --dport 22 -j DROP
iptables -I INPUT -p tcp --source 100.100.100.100 --dport 2002 -j ACCEPT