diff --git a/jobs/garden/spec b/jobs/garden/spec
index cea3b893..f6f85782 100644
--- a/jobs/garden/spec
+++ b/jobs/garden/spec
@@ -40,6 +40,12 @@ packages:
   - dontpanic
   - tini
 
+provides:
+- name: iptables
+  type: iptables
+  properties:
+  - garden.iptables_bin_dir
+
 properties:
   garden.listen_network:
     description: "Garden server connection mode (tcp or unix)."
@@ -228,6 +234,10 @@ properties:
     description: "(Under development) Number of seconds between each CPU throttling check"
     default: 15
 
+  garden.iptables_bin_dir:
+    description: "Path to directory that contains iptables binary"
+    default: /var/vcap/packages/iptables/sbin
+
   grootfs.log_level:
     description: "Log level for grootfs - can be debug, info, error or fatal."
     default: info
diff --git a/jobs/garden/templates/config/config.ini.erb b/jobs/garden/templates/config/config.ini.erb
index 8085ed6a..653e79e2 100644
--- a/jobs/garden/templates/config/config.ini.erb
+++ b/jobs/garden/templates/config/config.ini.erb
@@ -63,8 +63,8 @@ parse_ip(p('garden.network_pool'), 'garden.network_pool')
 <% end -%>
 
 ; binaries
-  iptables-bin = /var/vcap/packages/iptables/sbin/iptables
-  iptables-restore-bin = /var/vcap/packages/iptables/sbin/iptables-restore
+  iptables-bin = <%= p("garden.iptables_bin_dir") %>/iptables
+  iptables-restore-bin = <%= p("garden.iptables_bin_dir") %>/iptables-restore
   init-bin = <%= "#{runtime_bin_dir}/init" %>
   dadoo-bin = /var/vcap/packages/guardian/bin/dadoo
   nstar-bin = /var/vcap/packages/guardian/bin/nstar