Lock down public-facing interfaces with iptables.

Add a default DROP policy to br-ex interface, and open ports
only for web/api services.

Also open ip_local_port_range for dns responses,
and allow icmp.