Minimal LAMP iptables setup

Question

What rules are needed for an Ubuntu LAMP server only having minimum necessary ports open.

Answer 1

Minimal? Depending on how minimal we're talking, this'd work (I'm including SSH as being needed in this though):

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p udp --dport 80 -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-unreachable

---

If you want to add other ports or services to be internet facing, those ports can be opened with iptables -I INPUT [numberOfRules] -p [protocol] --dport [port or port:range] -j ACCEPT, where [numberOfRules] is the number of the rule which has the REJECT target, [protocol] is the protocol (TCP, UDP, etc.), and [port or port:range] is either a single port or a range of ports defined with start:end. Using comma separation also seems to work there.

---

A more in-depth explanation of what each of these rules does, and what I intentionally left out of the rules selections I did exists at my blog, if you wish to understand this a little bit better.