For a LAMP server (Linux, Apache, MySQL, PHP), a secure firewall configuration begins with a default deny policy, blocking all incoming traffic. We then selectively open the minimum required ports for the server to function as a web host, while restricting sensitive services like SSH to known management networks.
These commands implement a secure setup where SSH (Port 22) is only accessible from your two administrative subnets: 128.226.31.0/24 and 128.226.30.0/24. All other traffic is implicitly or explicitly blocked.
firewalld (Recommended for RHEL/CentOS/Fedora)
# 1. Set the default policy to DENY (optional, as the default zone usually handles this)
# firewall-cmd --set-default-zone=drop
# 2. Allow HTTP (80) and HTTPS (443) to all sources
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
# 3. Block the default 'ssh' service rule (if it was added before)
firewall-cmd --permanent --remove-service=ssh
# 4. Implement Rich Rules to allow SSH only from the specified subnets (128.226.31.x and 128.226.30.x)
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="128.226.31.0/24" service name="ssh" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="128.226.30.0/24" service name="ssh" accept'
# 5. Reload firewalld to apply the changes
firewall-cmd --reload
iptables (Legacy/Older Systems)
# 1. Start with a default DENY policy (crucial step for iptables security)
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# 2. Allow loopback traffic (local communication)
iptables -A INPUT -i lo -j ACCEPT
# 3. Allow established and related connections (allows replies to outgoing traffic)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# 4. Allow HTTP (80) and HTTPS (443) to all sources
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# 5. Allow SSH (22) ONLY from the specified subnets
iptables -A INPUT -p tcp -s 128.226.31.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -s 128.226.30.0/24 --dport 22 -j ACCEPT
# 6. Save the rules (command varies based on OS/distribution)
# service iptables save
⚠️ Important Note about MySQL (3306/tcp): You typically do NOT open MySQL to the internet. MySQL should only be accessible:
Keep it simple and secure! Only open ports when absolutely necessary.
For specific scenarios you may need to open other ports, but this is the minimum for a standard production LAMP server: