I put in a PR with a simple (untested) implementation: https://github.com/rtkwlf/cookbook-simple-iptables/pull/45.