I would like to set up a local Apache server with PHP and MySQL on a raspberry pi for learning purposes.

To my understanding, the server is only accessible by devices connected to my home network. Are there any security issues I should be aware of beforehand? Is it necessary to install a firewall?


There are many things to be taken into account with securing a webserver, if there is any sensitive information on it you should have it secured whether or not you have it publicly accessible. Here is a guide for securing apache, it's not exhaustive but it's a good start: https://geekflare.com/apache-web-server-hardening-security/

When doing mysql calls in apache, you should always use PDO so there is a much smaller risk of sql injection, here is a basic guide for that: https://phpdelusions.net/pdo

You should also make sure your firewall on the pi does no allow any remote sql connections, here are some basic iptables rules to get you started.

This first one is probably the most important, without it most connections will quickly fail after being established.

 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 

These next ones allow only traffic on specified ports, you should do this for every port you want to be connectable

This one will allow http traffic:

iptables -A INPUT --proto tcp --dport 80 -j ACCEPT

This one will allow https traffic:

iptables -A INPUT --proto tcp --dport 443 -j ACCEPT

This one will allow ssh traffic:

iptables -A INPUT --proto tcp --dport 22 -j ACCEPT

This one will block all traffic that is not explicitly allowed:

iptables -P INPUT DROP
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.