firewall.pp

  # Default firewall rules
  firewall { '000 accept all icmp':
    proto   => 'icmp',
    action  => 'accept',
  }
  firewall { '001 accept all to lo interface':
    proto   => 'all',
    iniface => 'lo',
    action  => 'accept',
  }
  firewall { '002 accept related established rules':
    proto   => 'all',
    ctstate => ['RELATED', 'ESTABLISHED'],
    action  => 'accept',
  }

no_patch.sh

$ puppet apply --noop --modulepath . firewall.pp --verbose
Info: Loading facts in /home/rpinson/bas/puppet/firewall/puppet-firewall/lib/facter/iptables_persistent_version.rb
Info: Loading facts in /home/rpinson/bas/puppet/firewall/puppet-firewall/lib/facter/iptables_version.rb
Info: Loading facts in /home/rpinson/bas/puppet/firewall/puppet-firewall/lib/facter/ip6tables_version.rb
Notice: Compiled catalog for wrk15.wrk.cby.camptocamp.com in environment production in 0.06 seconds
Info: Applying configuration version '1409062655'
Notice: /Stage[main]/Main/Firewall[000 accept all icmp]/ensure: current_value absent, should be present (noop)
Notice: /Stage[main]/Main/Firewall[002 accept related established rules]/ensure: current_value absent, should be present (noop)
Notice: /Stage[main]/Main/Firewall[001 accept all to lo interface]/ensure: current_value absent, should be present (noop)
Notice: Class[Main]: Would have triggered 'refresh' from 3 events
Notice: Stage[main]: Would have triggered 'refresh' from 1 events
Notice: Finished catalog run in 0.59 seconds

patched.sh

$ puppet apply --noop --modulepath . firewall.pp --verbose
Info: Loading facts in /home/rpinson/bas/puppet/firewall/puppet-firewall/lib/facter/iptables_persistent_version.rb
Info: Loading facts in /home/rpinson/bas/puppet/firewall/puppet-firewall/lib/facter/iptables_version.rb
Info: Loading facts in /home/rpinson/bas/puppet/firewall/puppet-firewall/lib/facter/ip6tables_version.rb
Notice: Compiled catalog for wrk15.wrk.cby.camptocamp.com in environment production in 0.06 seconds
Info: Applying configuration version '1409062668'
Notice: /Stage[main]/Main/Firewall[000 accept all icmp]/ensure: current_value absent, should be present (noop)
Notice: /Stage[main]/Main/Firewall[001 accept all to lo interface]/ensure: current_value absent, should be present (noop)
Notice: /Stage[main]/Main/Firewall[002 accept related established rules]/ensure: current_value absent, should be present (noop)
Notice: Class[Main]: Would have triggered 'refresh' from 3 events
Notice: Stage[main]: Would have triggered 'refresh' from 1 events
Notice: Finished catalog run in 0.65 seconds