I don't know anything about MLBAtBat or orbot, but I can tell you that CM9 does have iptables. And keyodi's kernel added NAT support a couple updates ago.
Things like droidwall now work, when before they didn't. Now something is definitely still not 100% enabled, for instance you can track app's wifi data usage through settings, but droidwall can't log packet blocks. I understand that proxydroid works now, though. Is that what orbot does?
Would a VPN work for you? You're just trying to get around a local blackout, right? Try DroidVPN, it is a fast network that is free in market. You'll have to email them for a password, though.
Anyway, I am not doubting there's a problem, but it isn't because there aren't IPtables. They've been there for a long while.