we have hosts on the 2.6 kernel that support iptable comments. A conditional should probably be made on the iptables_version fact that is done elsewhere in this provider (https://github.com/puppetlabs/puppetlabs-firewall/blob/master/lib/puppet/provider/firewall/iptables.rb#L39).

```bash
host:~# facter kernelmajversion
2.6
host:~# facter -p iptables_version
1.4.2
host:~# lsmod | grep comment
xt_comment              6272  84
```