Digital Ocean has never, since their release, provided anything impressively technical with regard to their infrastructure. It's not surprising that this is half-assed as well.

>If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked.

Did you confirm that the tooling is indeed missing?

Yes, iptables is installed as a dependency of Docker, but is not configured to do anything:

		$ iptables -L -v
		Chain INPUT (policy ACCEPT 2172 packets, 459K bytes)
		pkts bytes target     prot opt in     out     source               destination

		Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
		pkts bytes target     prot opt in     out     source               destination
		0     0 ACCEPT     all  --  any    docker0  anywhere             anywhere             ctstate RELATED,ESTABLISHED
		0     0 ACCEPT     all  --  docker0 !docker0  anywhere             anywhere
		0     0 ACCEPT     all  --  docker0 docker0  anywhere             anywhere

		Chain OUTPUT (policy ACCEPT 2350 packets, 461K bytes)
		pkts bytes target     prot opt in     out     source               destination