Add a pkg for iptables support

Depends on #1592 (exec support, duped into this PR).
Is the caller responsible for handling the inherent raciness of iptables, or should this interface provide that?