Lock down public-facing interfaces with iptables.

Add a default DROP policy to br-ex interface, and open ports
only for web/api services.