title: Puppet Firewall - ctstate not available?
body: <p>I got the task of converting some iptables rules into puppet firewall. I am currently stuck on this:</p>
  
  <p>iptables -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP -m comment --comment "drop new not syn"</p>
  
  <p>I can't find a method to use neither --match or --ctstate in Puppet Firewall. How can I do this?</p>