this makes iptables (hopefully) idempotent

It also does less based on 'atomic' and more based on the existence of firewalld or iptables-services