Unless these iptables rules are now managed by puppet, we'll want to re-introduce these. We really need a VPN server on the bastion :(