[puppet] Move default iptables & port-knocking as well.