diff --git a/config/cluster/host.go b/config/cluster/host.go
index e1a79902..01299643 100644
--- a/config/cluster/host.go
+++ b/config/cluster/host.go
@@ -350,6 +350,21 @@ func (h *Host) NeedCurl() bool {
 	return false
 }
 
+// NeedIPTables returns true when the iptables package is needed on the host
+func (h *Host) NeedIPTables() bool {
+	// Windows does not need any packages iptables
+	if h.Configurer.Kind() == "windows" {
+		return false
+	}
+
+	// Controllers do not need iptables
+	if h.IsController() {
+		return false
+	}
+
+	return !h.Configurer.CommandExist(h, "iptables")
+}
+
 // WaitKubeAPIReady blocks until the local kube api responds to /version
 func (h *Host) WaitKubeAPIReady() error {
 	return h.WaitHTTPStatus("https://localhost:6443/version", 200)
diff --git a/phase/prepare_hosts.go b/phase/prepare_hosts.go
index 3117eaad..b7471c61 100644
--- a/phase/prepare_hosts.go
+++ b/phase/prepare_hosts.go
@@ -35,6 +35,12 @@ func (p *PrepareHosts) prepareHost(h *cluster.Host) error {
 		}
 	}
 
+	if h.NeedIPTables() {
+		if err := h.Configurer.InstallPackage(h, "iptables"); err != nil {
+			return err
+		}
+	}
+
 	if h.IsController() && !h.Configurer.CommandExist(h, "kubectl") {
 		log.Infof("%s: installing kubectl", h)
 		if err := h.Configurer.InstallKubectl(h); err != nil {