What rules are needed for an Ubuntu LAMP server only having minimum necessary ports open.
Minimal? Depending on how minimal we're talking, this'd work (I'm including SSH as being needed in this though):
iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p udp --dport 80 -j ACCEPT iptables -A INPUT -j REJECT --reject-with icmp-host-unreachable
If you want to add other ports or services to be internet facing, those ports can be opened with
iptables -I INPUT [numberOfRules] -p [protocol] --dport [port or port:range] -j ACCEPT, where
[numberOfRules] is the number of the rule which has the REJECT target,
[protocol] is the protocol (TCP, UDP, etc.), and
[port or port:range] is either a single port or a range of ports defined with
start:end. Using comma separation also seems to work there.