You can recompile a kernel with policy Deny by default and configure firewall not through ISPmanager (the panel so does not know how) manually so it is need for you.
Options of a kernel which are used for work ISPmanager are written in the documentation on a site
http://en.ispdoc.com/index.php/Confi...ith_ISPmanager