Puppet Firewall Module (fork created to support negation matching)