Puppet class tripleo::firewall makes an effort to not
persist ephemeral firewall rules created by neutron and
ironic-inspector. In instack-undercloud the rules are
persisted anyway because we run iptables-save when
configuring masquerading.
This changes the masquerading to also filter the rules,
similar to what we do in tripleo::firewall.
Additionally filtering of the Ironic Inspector iptables
pxe_filter rules are implemented.
Closes-Bug: #1765700
Change-Id: I0cebfe4177981958c6e1a3b4b772f0a365f79e39
(cherry picked from commit e49688be98)
77f557416a