[...]

class iptables {
  file { "/etc/sysconfig/iptables":
    mode => 0644,
    owner => root,
    content => "*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
-A INPUT -d 127.0.0.0/255.0.0.0 -i lo -j ACCEPT 
-A INPUT -m state --state ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8006 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 13782 -j ACCEPT 
COMMIT"
  }

  service { iptables:
    ensure => running, # make sure the service is running
    subscribe => file[""/etc/sysconfig/iptables"] # and restart it if the config changes
  }
}