The dependency to iptable made it difficult to test. Why not put the validation stuff (the lines arround "# FIXME:") down to iptables?

And beyond that, what do you think about a symetric approach?
With an additional static class (maybe called "firewall_config"), where firewalling can be enabled statically and
the "firewall" defined type represents the rules?

In terms of ipv6 it would be possible then, to check in ipv6 enabled rules, wether the static config has also enabled ipv6 - what's a precondition for proper working.