Hum, ok, for the blocking rules, it seems that iptable -I works better thant iptable -A, i guess this is the same for opening ports.
But is seems that 53 and 443 are already opened on WRT router, so, if i am right, i should only open 587 for mail because push notifications can goes through 443...