Yes, the best way to do it, using the user_data section of the server definition. Here is basic example how to do it:

resources:
  server:
    type: OS::Nova::Server
    properties:
      key_name: { get_param: key_name }
      image: { get_param: image }
      flavor: { get_param: flavor }
      admin_pass: { get_param: admin_pass }
      user_data:
        str_replace:
          template: |
            #!/bin/bash
            iptables --flush  # flush all the previous rules
            service iptables save  # save new configuration
            service iptables restart # restart the iptables service