You can use the following commands to allow access to HTTP server given that you have default policy set to DROP
for INPUT
and OUTPUT
chains.
$ sudo iptables -A INPUT -i lo -j ACCEPT
$ sudo iptables -A OUTOUT -i lo -j ACCEPT
$ sudo iptables -A INPUT -s 128.171.21.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
$ sudo iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
$ sudo iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
$ sudo iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
All subnet 128.171.21.0/24 will be allowed to access your web server. You can customize it according to your needs.
Be careful, uou may need to allow other protocols such as SSH (port 22) to be able to access the server remotely.
EDIT: The last four rules added to allow the server to request DNS and HTTP.