provide a way to leave iptables alone

Check an attribute before doing anything with iptables.  Useful for cases where you want to leave iptables alone, not disable it.  No changes to default behavior.
Should this be a log resource, instead?