Bad me. I should have written these the first time round.
-# Class: firewall
+# = Class: firewall
#
-# Manages the installation of packages for operating systems that are
-# currently supported by the firewall type.
+# Manages packages and services required by the firewall type/provider.
+#
+# This class includes the appropriate sub-class for your operating system,
+# where supported.
+#
+# == Parameters:
+#
+# [*ensure*]
+# Ensure parameter passed onto Service[] resources.
+# Default: running
#
class firewall (
$ensure = running
+# = Class: firewall::linux
+#
+# Installs the `iptables` package for Linux operating systems and includes
+# the appropriate sub-class for any distribution specific services and
+# additional packages.
+#
+# == Parameters:
+#
+# [*ensure*]
+# Ensure parameter passed onto Service[] resources. When `running` the
+# service will be started on boot, and when `stopped` it will not.
+# Default: running
#
-#This class includes the proper sub-class for the distro being run
class firewall::linux (
$ensure = running
) {
+# = Class: firewall::linux::archlinux
+#
+# Manages `iptables` and `ip6tables` services, and creates files used for
+# persistence, on Arch Linux systems.
+#
+# == Parameters:
+#
+# [*ensure*]
+# Ensure parameter passed onto Service[] resources.
+# Default: running
+#
+# [*enable*]
+# Enable parameter passed onto Service[] resources.
+# Default: true
#
-#This class manages iptables on archlinux
class firewall::linux::archlinux (
$ensure = 'running',
$enable = true
+# = Class: firewall::linux::debian
+#
+# Installs the `iptables-persistent` package for Debian-alike systems. This
+# allows rules to be stored to file and restored on boot.
+#
+# == Parameters:
+#
+# [*ensure*]
+# Ensure parameter passed onto Service[] resources.
+# Default: running
+#
+# [*enable*]
+# Enable parameter passed onto Service[] resources.
+# Default: true
#
-#This class manages iptables on debian
class firewall::linux::debian (
$ensure = running,
$enable = true
+# = Class: firewall::linux::redhat
+#
+# Manages the `iptables` service on RedHat-alike systems.
+#
+# == Parameters:
+#
+# [*ensure*]
+# Ensure parameter passed onto Service[] resources.
+# Default: running
+#
+# [*enable*]
+# Enable parameter passed onto Service[] resources.
+# Default: true
#
-#This class manages iptables on redhat
class firewall::linux::redhat (
$ensure = running,
$enable = true