.I'm still not 100% sure you cannot not do very basic iptables (setting input policy to drop for example) with the stock kernel.