Proper firewall rules for security 5060 and 5061

Thank you for the reply mpelchat.

I take it that RTP are always outbound?

Is it correct that SIP ports need to be left open for trunk providers?

The problem I am facing is how to block these sorts of request:
66.85.76.170 -> 192.168.1.110 SIP/SDP 806 Request: INVITE sip:[email protected]:5060

I am not familiar with iptables. I have whitelisted all the source IPs for SIP ports from my trunk providers, I do not have external SIP clients. I have left RTP ports open inbound/outbound.

How do I create a explicit rule to block all other requests on 5060,5061?