oh... I think

ipt=/sbin/iptables

should be

function ipt()
{
/sbin/iptables "$@"
}

or $ipt

but thanks for the impetus - I now have a knock-locked cert-only sshd for next time we go skiing and feel the need to vpn back to the webcam aimed at the cats...