So far I used 2 methods:
- put all the IP Tables rules in /etc/rc.local and every time reload the rc.local file.
- lately I use CSF firewall so I can block failed login attempts etc. too.
In the end I created small KVM machine that runs a minimal linux and acts as a gateway router + nginx proxy...