[Huawei P8 ROMs, Kernels, Recoveries, & Other Devel] nexolight:
ok source of this iptables problem is probably that netd doesn't start properly:

10-05 15:49:59.333 6742 6742 E Netd : cannot find interface dummy0
10-05 15:49:59.334 6742 6742 D MDnsDS : MDnsSdListener::Hander starting up
10-05 15:49:59.334 6742 7001 D MDnsDS : MDnsSdListener starting to monitor
10-05 15:49:59.334 6742 7001 D MDnsDS : Going to poll with pollCount 1
10-05 15:50:01.273 3222 3238 D NetworkManagement: enabling bandwidth control
10-05 15:50:01.805 3222 3238 E NetdConnector: NDC Command {110 bandwidth enable} took too long (531ms)
10-05 15:50:02.304 6742 7004 I ip6tables: ip6tables: Protocol wrong type for socket.
10-05 15:50:02.304 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.305 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_penalty_log -j CONNMARK --or-mark 0x1000000
10-05 15:50:02.338 6742 7004 I iptables: iptables: No chain/target/match by that name.
10-05 15:50:02.338 6742 7004 I iptables: iptables terminated by exit(1)
10-05 15:50:02.339 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/iptables -w -A st_penalty_log -j NFLOG --nflog-group 0
10-05 15:50:02.364 6742 7004 I ip6tables: ip6tables: No chain/target/match by that name.
10-05 15:50:02.365 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.365 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_penalty_log -j NFLOG --nflog-group 0
10-05 15:50:02.432 6742 7004 I ip6tables: ip6tables: Protocol wrong type for socket.
10-05 15:50:02.433 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.433 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_penalty_reject -j CONNMARK --or-mark 0x2000000
10-05 15:50:02.449 6742 7004 I iptables: iptables: No chain/target/match by that name.
10-05 15:50:02.449 6742 7004 I iptables: iptables terminated by exit(1)
10-05 15:50:02.449 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/iptables -w -A st_penalty_reject -j NFLOG --nflog-group 0
10-05 15:50:02.464 6742 7004 I ip6tables: ip6tables: No chain/target/match by that name.
10-05 15:50:02.465 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.465 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_penalty_reject -j NFLOG --nflog-group 0
10-05 15:50:02.650 6742 7004 I ip6tables: ip6tables: Protocol wrong type for socket.
10-05 15:50:02.650 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.650 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_clear_detect -m connmark --mark 0x2000000/0x2000000 -j REJECT
10-05 15:50:02.715 6742 7004 I ip6tables: ip6tables: Protocol wrong type for socket.
10-05 15:50:02.717 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.717 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_clear_detect -m connmark --mark 0x1000000/0x1000000 -j RETURN
10-05 15:50:02.792 6742 7004 I ip6tables: ip6tables: Protocol wrong type for socket.
10-05 15:50:02.794 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.794 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_clear_detect -p tcp -m u32 --u32 52>>26&0x3C@ 40&0xFFFF0000=0x16030000 &&52>>26&0x3C@ 44&0x00FF0000=0x00010000 -j CONNMARK --or-mark 0x1000000
10-05 15:50:02.830 6742 7004 I ip6tables: ip6tables: Protocol wrong type for socket.
10-05 15:50:02.831 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.831 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_clear_detect -p udp -m u32 --u32 48&0xFFFF0000=0x16FE0000 &&60&0x00FF0000=0x00010000 -j CONNMARK --or-mark 0x1000000
10-05 15:50:02.866 6742 7004 I ip6tables: ip6tables: Protocol wrong type for socket.
10-05 15:50:02.866 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.866 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_clear_detect -m connmark --mark 0x1000000/0x1000000 -j RETURN
10-05 15:50:02.896 6742 7004 I ip6tables: ip6tables: Protocol wrong type for socket.
10-05 15:50:02.896 6742 7004 I ip6tables: ip6tables terminated by exit(1)
10-05 15:50:02.896 6742 7004 E Netd : exec() res=0, status=256 for /system/bin/ip6tables -w -A st_clear_detect -p tcp -m state --state ESTABLISHED -m u32 --u32 52>>26&0x3C@ 40&0x0=0x0 -j st_clear_caught
10-05 15:50:02.927 3222 3238 E NetdConnector: NDC Command {111 strict enable} took too long (1118ms)
10-05 15:50:02.929 3222 3238 E NetworkManagement: Failed strict enable
10-05 15:50:02.929 3222 3238 E NetworkManagement: com.android.server.NativeDaemonConnector$NativeDaemonFailureException: command '111 strict enable' failed with '400 111 Strict command failed'
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at com.android.server.NativeDaemonConnector.executeForList(NativeDaemonConnector.java:444)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at com.android.server.NativeDaemonConnector.execute(NativeDaemonConnector.java:345)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at com.android.server.NativeDaemonConnector.execute(NativeDaemonConnector.java:340)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at com.android.server.NetworkManagementService.prepareNativeDaemon(NetworkManagementService.java:579)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at com.android.server.NetworkManagementService.-wrap11(NetworkManagementService.java)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at com.android.server.NetworkManagementService$NetdCallbackReceiver$1.run(NetworkManagementService.java:763)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at android.os.Handler.handleCallback(Handler.java:739)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at android.os.Handler.dispatchMessage(Handler.java:95)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at android.os.Looper.loop(Looper.java:148)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at android.os.HandlerThread.run(HandlerThread.java:61)
10-05 15:50:02.929 3222 3238 E NetworkManagement:	at com.android.server.ServiceThread.run(ServiceThread.java:46)
v10-05 15:59:13.642 3222 3238 E BluetoothAdapter: Bluetooth binder is null
10-05 15:59:13.644 3222 3238 E KernelUidCpuTimeReader: Failed to read uid_cputime: /proc/uid_cputime/show_uid_stat: open failed: ENOENT (No such file or directory)

Edit: may be caused by a missing kernel build option. Someone knows more about that? ... It may also fix the hotspot problem.

Edit2: The kernel has IPv6 iptables support enabled but compared to ipv4 a lot of options are not set. Not sure if they differ appart from their prefix or dependencies. Do they? I can't use menuconfig they made the config manually.... I duplicated the ones from ipv4 and placed the missing ones with the ipv6 prefix. Hope the build is successful and it does finally work then.

Edit3: ok did not work. Have to do research