I had a similar issue on another test and just emitted TCONF if ENOENT is returned. We don't use ip_tables by default on newer products. Possibly in OpenQA we should use modprobe to load the module.