Good point. I think I need to study a bit more, because iptables is a kernel module and it is supposed to be there always (maybe worth checking the loaded module?) 

So rather than 'exists' we could always add an iptables rule even if it not strictly needed in all the distros.

@aledsage wdyt?