First write a little script to flush the iptables rules:
echo "Stopping firewall and allowing everyone..."
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
(You probably don't need the 'nat' and 'mangle' commands.) Call it 'flush.sh' and put the script in the '/root' directory. Remember to 'chmod +x flush.sh'.
Test the script by adding a harmless iptables rule such as
iptables -A INPUT -p tcp -j ACCEPT
and then running the script from the command line. Verify that the rule that you added is gone.
Add the script to root's crontab to run every ten minutes:
*/10 * * * * /root/flush.sh
Add back the harmless iptables rule that you used to test the script. Wait ten minutes and verify that your cron job executed successfully and removed the rule.
At this point you should be able to debug your iptables rule set with the flush.sh safety net running every ten minutes. When you are finished debugging your rules, comment out the line in crontab that runs the flush.sh script.
Where you put your rules is somewhat distro dependent. For Ubuntu, have a look at this link. Towards the end you will see two options for setting up your firewall rules permanently - /etc/network/interfaces and by using the Network Manager configuration. Since you are running a server, the former option is probably better.
You shouldn't ever need to reboot in order to change or flush your iptables rules, unless you lock yourself out.
It is best to configure sshd to only allow root login using public key authentication rather than by password.
If you have a secure gateway available with a fixed IP address such as a server at your office that you can log into from anywhere, it would be good to have an iptables rule on the remote server to allow SSH only from that gateway.
Changing the SSH port from 22 to something else is of very limited value as most port scanners will find the new SSH port quickly.