Sometimes software like Docker (in certain network configurations) will use iptables for its own purposes, clobbering some of your own iptables rules. Having an external firewall for access control is super advantageous in cases like this.