Actually, there's nothing katello-specific in that ptable, I'll move it into foreman proper (fedora ptables are currently broken there). Let's keep this in the engine for now though. I'll add removal of the ptable on rollback too.