The netfilter/iptable project is designed in this way:
The kernel modules named ip_tables, ip6_tables, arp_tables (the underscore is part of the name) and ebtables are some of the significant users of the Netfilter hook system. They provide a table-based system for defining firewall rules that can filter or transform packets. The tables can be administered through the user-space tools iptables, ip6tables, arptables and ebtables, respectively.

So I think we can ensure iptables is installed on the vm, and run the insert/append rule to it.