Here's a version that's not quite so funky (but still kinda ugly). This is a situation in which a prototype is actually useful. If the  hiccup() function is defined in the source file in which it's used | invoked, either the full definition of the function or a prototype declaration must appear before first invocation of the function. If the function is moved to a module, a use statement must appear before first invocation.

File hiccup_here_3.pl:

use warnings;
use strict;

use Hic;
# sub hiccup (&@);

my $lanCidr = 'WHATEVER';
my $dmzIp   = 'SOMEWHERE';
my %ipAddress = qw(HERE we_are  THERE it_goes  EVERYWHERE at_once);
my @array     = qw(WIBBLE BOFF);

my $s = << "EOF";
iptables -t nat -N outbound-DMZ
@{[ hiccup {
    "iptables -t nat -s $lanCidr -o $_ -j SNAT --to-source $dmzIp"
    } keys %ipAddress ]}
whatever else here
@{[ hiccup {
    "flocculate -f $_ -j SNAT --to-source $dmzIp"
    } @array ]}
iptables -t nat -A outbound-DMZ -j RETURN
EOF

# sub hiccup (&@) { return join "\n", map $_[0]->(), @_[ 1 .. $#_ ]; }

print "[[$s]]";
[download]

Module Hic.pm:

package Hic;

use warnings;
use strict;

use parent 'Exporter';

our $VERSION = '0.1.0';

our @EXPORT    = qw(hiccup);  # default exported symbol(s)
our @EXPORT_OK = qw();        # optional exported symbol(s) (none)

sub hiccup (&@) { return join "\n", map $_[0]->(), @_[ 1 .. $#_ ]; }

1;
[download]

However it's invoked, the function produces the following output:

c:\@Work\Perl\monks\Anonymous Monk\1197277>perl hiccup_here_3.pl
[[iptables -t nat -N outbound-DMZ
iptables -t nat -s WHATEVER -o EVERYWHERE -j SNAT --to-source SOMEWHER
+E
iptables -t nat -s WHATEVER -o THERE -j SNAT --to-source SOMEWHERE
iptables -t nat -s WHATEVER -o HERE -j SNAT --to-source SOMEWHERE
whatever else here
flocculate -f WIBBLE -j SNAT --to-source SOMEWHERE
flocculate -f BOFF -j SNAT --to-source SOMEWHERE
iptables -t nat -A outbound-DMZ -j RETURN
]]
[download]

Update: Screwed up initial post of hiccup_here_3.pl file. Fixed.