Remove the double colons from the firewall class invocation. This resolve the 'error Invalid tag "::firewall"' on puppet 2.7.20 with the puppetlabs-firewall module installed, and still successfully ensures the firewall rule in iptables.