etc/iptables: update firewall rules

* Be a bit more restrictive about accepted ICMP codes
* Drop non-sollicited broadcast (Dropbox, Slim devices...) to get clear
  network dumps in noisy networks (using NFLOG target)
* Minor changes (rules reordering, change in comments...)

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>