Previously when hostnames were used in the source and destination properties
they were being converted to IP address by iptables. This meant that later
comparisons were failing because the property in code (a hostname) and the
'real' property returned by introspection (an ip address) were not matching.
This code using the munge facility will automatically detect and convert
hostnames to IP addresses in the type so the comparison works as expected.
The side-effect is that puppet does the hostname to IP conversion, not
iptables.