/etc/init.d is deprecated for this because there is then a race condition - for a few moments on restart, you have network up but do not have your firewall up. don't do it.
typically what you want to do is get your firewall set up to your liking, then do
iptables-save > /etc/network/iptables. Now create
/etc/network/if-pre-up.d/iptables.sh as follows:
/sbin/iptables-restore < /etc/network/iptables
Be sure to remember to make both files owned by root, and
chmod 400 /etc/network/iptables ; chmod 755 /etc/network/if-pre-up.d/iptables.sh to set permissions appropriately - unprivileged users should not be able to read your actual firewall ruleset, much less change it, but your script in
if-pre-up.d must be executable. (You might optionally chmod it 700 if you're feeling frisky; but I don't see that it'll really keep anything any more secure.)
You do not need a down script for this, just a pre-up. You specifically want pre-up because that keeps you from ever having your network interface online without your firewall up.