Puppet recipe for netfilter