If you mean an iptables firewall on a distinct physical machine placed in front of the machines you're trying to protect, then it will be enough to prevent remote attacks.

If you mean an iptables firewall on the same physical machine as the one you're trying to protect, it will be useless; like Matt mentioned in the second paragraph, the OS never even gets to see these packets, the ME steals them off the Ethernet adapter.