Use a new "ctstate" feature to support nf_conntrack
That's for https://projects.puppetlabs.com/issues/15505
Support for --dport AND --dports (and sport/sports equivalents)

Note: no test support, examples not fixed!

:dport is now matching --dport (used to match -m multiport --dports)
:dports is now matching -m multiport --dports
iptables-saves output the -m tcp/udp so changing support for:
:sport, :dport original meaning with multiport
:{s,d}port_{udp,tcp} for -m tcp/udp
no support for :{s,d}port_sctp, but eventually, this should be added to
be consistant
support for addrtype
NOTES