If you want to, say, run iptables from a script to ban naughty users on your website, you’re going to quickly find yourself with an error:

Can't initialize iptables table 'some table': Permission denied (you must be root)

Since only root is allowed to run iptables, then we need to let apache be root to run it. Just edit /etc/sudoers and add the line apache (ALL)=(root) NOPASSWD: /sbin/iptables. This means that the user apache is allowed to run iptables as root for any server group, so it is not particularly security adverse. It certainly doesn’t grant apache all of root permissions, which would lead to instant disaster. After you make this change, you can now run sudo iptables as apache:

sudo -u apache sudo iptables -I INPUT -s 127.0.0.1 -j DROP