iptables flush is handled by puppet firewall provider. Adding manual flush just add errors iat the 1st run