Fix mangling of chain names that contain -f

Author: Max Vozeler

lib/puppet/provider/firewall/iptables.rb

@@ -356,7 +356,7 @@ def self.rule_to_hash(line, table, counter)
         # -f requires special matching:
         # only replace those -f that are not followed by an l to
         # distinguish between -f and the '-f' inside of --tcp-flags.
-        values = values.sub(/-f(?!l)(?=.*--comment)/, '-f true')
+        values = values.sub(/\s-f(?!l)(?=.*--comment)/, ' -f true')
       else
         values = values.sub(/#{resource_map[bool]}/, "#{resource_map[bool]} true")
       end