AFWall+ allow DHCP+DNS services without allow all root?
On my stock Android 4.2.1, I don't need to allow (Tethering) - DNS+DHCP service, let alone (root) - Applications running as root for DHCP/DNS over Wifi hostpot in AFwall+. My system can get the IP easily but would not connect to internet unless I change my system's DNS setting to some public DNS like 8.8.8.8. It is a fix that I once saw on a forum.

That said, my system would not receive the IP from my other two devices running Android 4.4.4 if I don't allow (Tethering) - DNS+DHCP service. Even then, I still have to tweak that DNS setting to browse the Internet on my system. 

I don't know the reason for such behavior, but never ever I needed to allow (root) - Applications running as root or those IP-tables rules you mentioned.