Support for chains. More finegrained ICMP control. Fail on wrong input (typos)
Adding $log_prefix_prefix

If you ever need to analyze your logfiles with something like logstash it helps
if you have a common denominator that allows you to determine what application
triggered the log line.

In case of iptables, the application syslog shows is 'kernel'. Although
technically correct, this may not always be so helpful as there are many
different messages (non-firewall related) that can be triggered by the kernel.

Therefore it's now possible to specify $iptables::Log_prefix_prefix. This
string will be prepended before all log lines generated by the (default)
firewall rules. Before the logline-dependent prefixes.
Treating IPv4 and IPv6 as equals