When I add a new rule and do a puppet run, Exec["save iptable rules"] is not called.
Rules have been loaded fine though, they're just not saved.

I'm on Fedora 11, with the following config:
Iptables {

before => Exec["save iptables rules"],
notify => Exec["save iptables rules"],

}

exec { "save iptables rules":

command => "/etc/init.d/iptables save",
refreshonly => true,
logoutput => true,

} iptables { "http":

    proto => "tcp",
    dport => "80",
    state => "NEW",
    jump  => "ACCEPT",
}

The last message in my logs related to the iptables module is:
notice: /Iptables[http]: rules have changed... in 0.03 seconds