diff --git a/README.markdown b/README.markdown
@@ -20,39 +20,39 @@
 7. [Development - Guide for contributing to the module](#development)
     * [Tests - Testing your configuration](#tests)
 
-##Overview
+## Overview
 
 The firewall module lets you manage firewall rules with Puppet.
 
-##Module Description
+## Module Description
 
 PuppetLabs' firewall module introduces the `firewall` resource, which is used to manage and configure firewall rules from within the Puppet DSL. This module offers support for iptables and ip6tables. The module also introduces the `firewallchain` resource, which allows you to manage chains or firewall lists and ebtables for bridging support. At the moment, only iptables and ip6tables chains are supported.
 
 The firewall module acts on your running firewall, making immediate changes as the catalog executes. Defining default pre and post rules allows you to provide global defaults for your hosts before and after any custom rules. Defining `pre` and `post` rules is also necessary to help you avoid locking yourself out of your own boxes when Puppet runs.
 
-##Setup
+## Setup
 
-###What firewall Affects
+### What firewall Affects
 
 * Every node running a firewall
 * Firewall settings in your system
 * Connection settings for managed nodes
 * Unmanaged resources (get purged)
 
 
-###Setup Requirements
+### Setup Requirements
 
 Firewall uses Ruby-based providers, so you must enable [pluginsync](http://docs.puppetlabs.com/guides/plugins_in_modules.html#enabling-pluginsync).
 
-###Beginning with firewall
+### Beginning with firewall
 
 In the following two sections, you create new classes and then create firewall rules related to those classes. These steps are optional but provide a framework for firewall rules, which is helpful if you’re just starting to create them.
 
 If you already have rules in place, then you don’t need to do these two sections. However, be aware of the ordering of your firewall rules. The module will dynamically apply rules in the order they appear in the catalog, meaning a deny rule could be applied before the allow rules. This might mean the module hasn’t established some of the important connections, such as the connection to the Puppet master.
 
 The following steps are designed to ensure that you keep your SSH and other connections, primarily your connection to your Puppet master. If you create the `pre` and `post` classes described in the first section, then you also need to create the rules described in the second section.
 
-####Create the `my_fw::pre` and `my_fw::post` Classes
+#### Create the `my_fw::pre` and `my_fw::post` Classes
 
 This approach employs a whitelist setup, so you can define what rules you want and everything else is ignored rather than removed.
 
@@ -124,7 +124,7 @@ Alternatively, the [firewallchain](#type-firewallchain) type can be used to set
   }
   ~~~
 
-####Create Firewall Rules
+#### Create Firewall Rules
 
 The rules you create here are helpful if you don’t have any existing rules; they help you order your firewall configurations so you don’t lock yourself out of your box.
 
@@ -169,29 +169,29 @@ Rules are persisted automatically between reboots, although there are known issu
   class { 'firewall': }
   ~~~
 
-###Upgrading
+### Upgrading
 
 Use these steps if you already have a version of the firewall module installed.
 
-####From version 0.2.0 and more recent
+#### From version 0.2.0 and more recent
 
 Upgrade the module with the puppet module tool as normal:
 
     puppet module upgrade puppetlabs/firewall
 
-##Usage
+## Usage
 
 There are two kinds of firewall rules you can use with firewall: default rules and application-specific rules. Default rules apply to general firewall settings, whereas application-specific rules manage firewall settings for a specific application, node, etc.
 
 All rules employ a numbering system in the resource's title that is used for ordering. When titling your rules, make sure you prefix the rule with a number, for example, '000 accept all icmp requests'. _000_ runs first, _999_ runs last.
 
-###Default Rules
+### Default Rules
 
 You can place default rules in either `my_fw::pre` or `my_fw::post`, depending on when you would like them to run. Rules placed in the `pre` class will run first, and rules in the `post` class, last.
 
 In iptables, the title of the rule is stored using the comment feature of the underlying firewall subsystem. Values must match '/^\d+[[:graph:][:space:]]+$/'.
 
-####Examples of Default Rules
+#### Examples of Default Rules
 
 Basic accept ICMP request example:
 
@@ -223,7 +223,7 @@ firewall { '006 Allow inbound SSH (v6)':
 }
 ~~~
 
-###Application-Specific Rules
+### Application-Specific Rules
 
 Puppet doesn't care where you define rules, and this means that you can place
 your firewall resources as close to the applications and services that you
@@ -247,7 +247,7 @@ class profile::apache {
 }
 ~~~
 
-###Rule inversion
+### Rule inversion
 Firewall rules may be inverted by prefixing the value of a parameter by "! ". If the value is an array, then every item in the array must be prefixed as iptables does not understand inverting a single value.
 
 Parameters that understand inversion are: connmark, ctstate, destination, dport, dst\_range, dst\_type, iniface, outiface, port, proto, source, sport, src\_range, src\_type, and state.
@@ -270,7 +270,7 @@ firewall { '002 drop NEW external website packets with FIN/RST/ACK set and SYN u
 }
 ~~~
 
-###Additional Uses for the Firewall Module
+### Additional Uses for the Firewall Module
 
 You can apply firewall rules to specific nodes. Usually, you will want to put the firewall rule in another class and apply that class to a node. Apply a rule to a node as follows:
 
@@ -341,7 +341,7 @@ firewall { '100 my rule':
 }
 ~~~
 
-###Additional Information
+### Additional Information
 
 Access the inline documentation:
 
@@ -352,7 +352,7 @@ Or
     puppet doc -r type
     (and search for firewall)
 
-##Reference
+## Reference
 
 Classes:
 
@@ -369,7 +369,7 @@ Facts:
 * [iptables_version](#fact-iptablesversion)
 * [iptables_persistent_version](#fact-iptablespersistentversion)
 
-###Class: firewall
+### Class: firewall
 
 Performs the basic setup tasks required for using the firewall resources.
 
@@ -381,31 +381,31 @@ Include the `firewall` class for nodes that need to use the resources in this mo
 
     class { 'firewall': }
 
-####ensure
+#### ensure
 
 Parameter that controls the state of the iptables service on your system, allowing you to disable iptables if you want.
 
 `ensure` can either be 'running' or 'stopped'. Defaults to 'running'.
 
-####package
+#### package
 
 Specify the platform-specific package(s) to install. Defaults defined in `firewall::params`.
 
-####pkg_ensure
+#### pkg_ensure
 
 Parameter that controls the state of the iptables package on your system, allowing you to update it if you wish.
 
 `ensure` can either be 'present' or 'latest'. Defaults to 'present'.
 
-####service
+#### service
 
 Specify the platform-specific service(s) to start or stop. Defaults defined in `firewall::params`.
 
 ###Type: firewall
 
 This type enables you to manage firewall rules within Puppet.
 
-####Providers
+#### Providers
 **Note:** Not all features are available with all providers.
 
  * `ip6tables`: Ip6tables type provider
@@ -610,14 +610,14 @@ If Puppet is managing the iptables or iptables-persistent packages, and the prov
 
 * `name`: The canonical name of the rule. This name is also used for ordering, so make sure you prefix the rule with a number. For example:
 
-~~~puppet
+  ~~~puppet
 firewall { '000 this runs first':
   # this rule will run first
 }
 firewall { '999 this runs last':
   # this rule will run last
 }
- ~~~
+  ~~~
 
   Depending on the provider, the name of the rule can be stored using the comment feature of the underlying firewall subsystem. Values must match '/^\d+[[:graph:][:space:]]+$/'.
 
@@ -765,24 +765,24 @@ firewall { '101 blacklist strange traffic':
 
 * `week_days`: Only match on the given weekdays. Possible values are 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun'.
 
-###Type: firewallchain
+### Type: firewallchain
 
 Enables you to manage rule chains for firewalls.
 
 Currently this type supports only iptables, ip6tables, and ebtables on Linux. It also provides support for setting the default policy on chains and tables that allow it.
 
 **Autorequires**: If Puppet is managing the iptables or iptables-persistent packages, and the provider is iptables_chain, the firewall resource will autorequire those packages to ensure that any required binaries are installed.
 
-####Providers
+#### Providers
 
 `iptables_chain` is the only provider that supports firewallchain.
 
-####Features
+#### Features
 
 * `iptables_chain`: The provider provides iptables chain features.
 * `policy`: Default policy (inbuilt chains only).
 
-####Parameters
+#### Parameters
 
 * `ensure`: Ensures that the resource is present. Valid values are 'present', 'absent'.
 
@@ -828,27 +828,27 @@ resources { 'firewallchain':
 }
 ~~~
 
-###Fact: ip6tables_version
+### Fact: ip6tables_version
 
 A Facter fact that can be used to determine what the default version of ip6tables is for your operating system/distribution.
 
-###Fact: iptables_version
+### Fact: iptables_version
 
 A Facter fact that can be used to determine what the default version of iptables is for your operating system/distribution.
 
-###Fact: iptables_persistent_version
+### Fact: iptables_persistent_version
 
 Retrieves the version of iptables-persistent from your OS. This is a Debian/Ubuntu specific fact.
 
-##Limitations
+## Limitations
 
-###SLES
+### SLES
 
 The `socket` parameter is not supported on SLES.  In this release it will cause
 the catalog to fail with iptables failures, rather than correctly warn you that
 the features are unusable.
 
-###Oracle Enterprise Linux
+### Oracle Enterprise Linux
 
 The `socket` and `owner` parameters are unsupported on Oracle Enterprise Linux
 when the "Unbreakable" kernel is used. These may function correctly when using
@@ -860,13 +860,29 @@ unsupported system will result in iptable rules failing to apply.
 As Puppet Enterprise itself does not yet support Debian 8, use of this module with Puppet Enterprise under a Debian 8
 system should be regarded as experimental.
 
-###Other
+### Known Issues
+
+#### MCollective causes PE to reverse firewall rule order
+
+Firewall rules appear in reverse order if you use MCollective to run Puppet in Puppet Enterprise 2016.1, 2015.3, 2015.2, or 3.8.x.
+
+If you use MCollective to kick off Puppet runs (`mco puppet runonce -I agent.example.com`) while also using the [`puppetlabs/firewall`](https://forge.puppet.com/puppetlabs/firewall) module, your firewall rules might be listed in reverse order.
+
+In many firewall configurations, the last rule drops all packets. If the rule order is reversed, this rule is listed first and network connectivity fails.
+
+To prevent this issue, do not use MCollective to kick off Puppet runs. Use any of the following instead:
+
+* Run `puppet agent -t` on the command line.
+* Use a cron job.
+* Click [Run Puppet](https://docs.puppet.com/pe/2016.1/console_classes_groups_running_puppet.html#run-puppet-on-an-individual-node) in the console.
+
+#### Reporting Issues
 
-Bugs can be reported in JIRA:
+Report found bugs in JIRA:
 
 <http://tickets.puppetlabs.com>
 
-##Development
+## Development
 
 Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
 
@@ -882,7 +898,7 @@ Currently we support:
 * ip6tables
 * ebtables (chains only)
 
-###Testing
+### Testing
 
 Make sure you have:
 

diff --git a/metadata.json b/metadata.json
@@ -1,6 +1,6 @@
 {
   "name": "puppetlabs-firewall",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "author": "Puppet Labs",
   "summary": "Manages Firewalls such as iptables",
   "license": "Apache-2.0",

diff --git a/spec/acceptance/change_source_spec.rb b/spec/acceptance/change_source_spec.rb
@@ -1,10 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-  describe 'reset' do
-    it 'deletes all rules' do
-      shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    end
+describe 'changing the source' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   describe 'when unmanaged rules exist' do

diff --git a/spec/acceptance/class_spec.rb b/spec/acceptance/class_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper_acceptance'
 
-describe "firewall class:", :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+describe "firewall class" do
   it 'should run successfully' do
     pp = "class { 'firewall': }"
 

diff --git a/spec/acceptance/connlimit_spec.rb b/spec/acceptance/connlimit_spec.rb
@@ -1,14 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  describe 'reset' do
-    it 'deletes all iptables rules' do
-      shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    end
-    it 'deletes all ip6tables rules' do
-      shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
-    end
+describe 'connlimit property' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   if default['platform'] !~ /sles-10/

diff --git a/spec/acceptance/connmark_spec.rb b/spec/acceptance/connmark_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+describe 'connmark property' do
 
   describe 'connmark' do
     context '50' do
@@ -9,7 +9,7 @@
           class { '::firewall': }
           firewall { '502 - test':
             proto    => 'all',
-	    connmark => '0x1',
+            connmark => '0x1',
             action   => reject,
           }
         EOS

diff --git a/spec/acceptance/firewall_bridging_spec.rb b/spec/acceptance/firewall_bridging_spec.rb
@@ -1,14 +1,9 @@
  require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  describe 'reset' do
-    it 'deletes all iptables rules' do
-      shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    end
-    it 'deletes all ip6tables rules' do
-      shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
-    end
+describe 'firewall bridging' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   describe 'iptables physdev tests' do
@@ -371,5 +366,4 @@ class { '::firewall': }
         end
       end
     end
-
 end
diff --git a/spec/acceptance/firewall_dscp_spec.rb b/spec/acceptance/firewall_dscp_spec.rb
@@ -1,10 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  before(:all) do
-    shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
+describe 'firewall DSCP' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   describe 'dscp ipv4 tests' do

diff --git a/spec/acceptance/firewall_iptmodules_spec.rb b/spec/acceptance/firewall_iptmodules_spec.rb
@@ -1,14 +1,9 @@
  require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  describe 'reset' do
-    it 'deletes all iptables rules' do
-      shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    end
-    it 'deletes all ip6tables rules' do
-      shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
-    end
+describe 'firewall iptmodules' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   describe 'iptables ipt_modules tests' do

diff --git a/spec/acceptance/firewall_mss_spec.rb b/spec/acceptance/firewall_mss_spec.rb
@@ -1,10 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  before(:all) do
-    shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
+describe 'firewall MSS' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   describe 'mss ipv4 tests' do

diff --git a/spec/acceptance/firewall_spec.rb b/spec/acceptance/firewall_spec.rb
@@ -1,11 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  describe 'reset' do
-    it 'deletes all rules' do
-      shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    end
+describe 'firewall basics', docker: true do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   describe 'name' do

diff --git a/spec/acceptance/firewall_tee_spec.rb b/spec/acceptance/firewall_tee_spec.rb
@@ -1,10 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  before(:all) do
-    shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
+describe 'firewall tee' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   if default['platform'] =~ /ubuntu-1404/ or default['platform'] =~ /ubuntu-1204/ or default['platform'] =~ /debian-7/ or default['platform'] =~ /debian-8/ or default['platform'] =~ /el-7/
@@ -13,7 +12,7 @@
         it 'applies' do
           pp = <<-EOS
             class { '::firewall': }
-            firewall { 
+            firewall {
               '810 - tee_gateway':
                 chain   => 'PREROUTING',
                 table   => 'mangle',
@@ -39,7 +38,7 @@ class { '::firewall': }
         it 'applies' do
           pp = <<-EOS
             class { '::firewall': }
-            firewall { 
+            firewall {
               '811 - tee_gateway6':
                 chain    => 'PREROUTING',
                 table    => 'mangle',

diff --git a/spec/acceptance/firewall_time_spec.rb b/spec/acceptance/firewall_time_spec.rb
@@ -1,11 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-
-  before(:all) do
-    shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
+describe 'firewall time' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   if default['platform'] =~ /ubuntu-1404/ or default['platform'] =~ /debian-7/ or default['platform'] =~ /debian-8/ or default['platform'] =~ /el-7/

diff --git a/spec/acceptance/firewall_uid_spec.rb b/spec/acceptance/firewall_uid_spec.rb
@@ -1,14 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  describe 'reset' do
-    it 'deletes all rules' do
-      shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    end
-    it 'deletes all ip6tables rules' do
-      shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
-    end
+describe 'firewall uid' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   describe "uid tests" do

diff --git a/spec/acceptance/firewallchain_spec.rb b/spec/acceptance/firewallchain_spec.rb
@@ -1,9 +1,11 @@
 require 'spec_helper_acceptance'
 
-describe 'puppet resource firewallchain command:', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+describe 'puppet resource firewallchain command' do
   before :all do
     iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
+
   describe 'ensure' do
     context 'present' do
       it 'applies cleanly' do

diff --git a/spec/acceptance/invert_spec.rb b/spec/acceptance/invert_spec.rb
@@ -1,8 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-  before(:all) do
+describe 'firewall inverting' do
+  before :all do
     iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   context "inverting rules" do

diff --git a/spec/acceptance/ip6_fragment_spec.rb b/spec/acceptance/ip6_fragment_spec.rb
@@ -1,8 +1,9 @@
 require 'spec_helper_acceptance'
 
 if default['platform'] =~ /el-5/ or default['platform'] =~ /sles-10/
-  describe "firewall ip6tables doesn't work on 1.3.5 because --comment is missing", :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+  describe "firewall ip6tables doesn't work on 1.3.5 because --comment is missing" do
     before :all do
+      iptables_flush_all_tables
       ip6tables_flush_all_tables
     end
 
@@ -19,8 +20,9 @@ class { '::firewall': }
     end
   end
 else
-  describe 'firewall ishasmorefrags/islastfrag/isfirstfrag properties', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+  describe 'firewall ishasmorefrags/islastfrag/isfirstfrag properties' do
     before :all do
+      iptables_flush_all_tables
       ip6tables_flush_all_tables
     end
 

diff --git a/spec/acceptance/isfragment_spec.rb b/spec/acceptance/isfragment_spec.rb
@@ -1,8 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall isfragment property', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+describe 'firewall isfragment property' do
   before :all do
     iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   shared_examples "is idempotent" do |value, line_match|

diff --git a/spec/acceptance/match_mark_spec.rb b/spec/acceptance/match_mark_spec.rb
@@ -1,10 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'firewall type', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  before(:all) do
-    shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
+describe 'firewall match marks' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   if default['platform'] !~ /el-5/ and default['platform'] !~ /sles-10/

diff --git a/spec/acceptance/nodesets/centos-59-x64-pe.yml b/spec/acceptance/nodesets/centos-59-x64-pe.yml
diff --git a/spec/acceptance/nodesets/centos-59-x64.yml b/spec/acceptance/nodesets/centos-59-x64.yml
diff --git a/spec/acceptance/nodesets/centos-64-x64-fusion.yml b/spec/acceptance/nodesets/centos-64-x64-fusion.yml
diff --git a/spec/acceptance/nodesets/centos-64-x64-pe.yml b/spec/acceptance/nodesets/centos-64-x64-pe.yml
diff --git a/spec/acceptance/nodesets/centos-64-x64.yml b/spec/acceptance/nodesets/centos-64-x64.yml
diff --git a/spec/acceptance/nodesets/centos-65-x64.yml b/spec/acceptance/nodesets/centos-65-x64.yml
diff --git a/spec/acceptance/nodesets/centos-7-x64.yml b/spec/acceptance/nodesets/centos-7-x64.yml
@@ -1,11 +1,10 @@
 HOSTS:
   centos-7-x64:
     roles:
-      - master
-    platform: el-7-x86_64
-    box : puppetlabs/centos-7.0-64-nocm
-    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-7.0-64-virtualbox-nocm.box
-    hypervisor : vagrant
+      - agent
+      - default
+    platform: redhat-7-x86_64
+    hypervisor: vagrant
+    box: puppetlabs/centos-7.2-64-nocm
 CONFIG:
   type: foss
-  log_level: verbose
diff --git a/spec/acceptance/nodesets/debian-607-x64.yml b/spec/acceptance/nodesets/debian-607-x64.yml
diff --git a/spec/acceptance/nodesets/debian-70rc1-x64.yml b/spec/acceptance/nodesets/debian-70rc1-x64.yml
diff --git a/spec/acceptance/nodesets/debian-8-x64.yml b/spec/acceptance/nodesets/debian-8-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  debian-8-x64:
+    roles:
+      - agent
+      - default
+    platform: debian-8-amd64
+    hypervisor: vagrant
+    box: puppetlabs/debian-8.2-64-nocm
+CONFIG:
+  type: foss
diff --git a/spec/acceptance/nodesets/default.yml b/spec/acceptance/nodesets/default.yml
@@ -1,10 +1,10 @@
 HOSTS:
-  centos-64-x64:
+  ubuntu-1404-x64:
     roles:
-      - master
-    platform: el-6-x86_64
-    box : centos-64-x64-vbox4210-nocm
-    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
-    hypervisor : vagrant
+      - agent
+      - default
+    platform: ubuntu-14.04-amd64
+    hypervisor: vagrant
+    box: puppetlabs/ubuntu-14.04-64-nocm
 CONFIG:
   type: foss
diff --git a/spec/acceptance/nodesets/docker/centos-7.yml b/spec/acceptance/nodesets/docker/centos-7.yml
@@ -0,0 +1,12 @@
+HOSTS:
+  centos-7-x64:
+    platform: el-7-x86_64
+    hypervisor: docker
+    image: centos:7
+    docker_preserve_image: true
+    docker_cmd: '["/usr/sbin/init"]'
+    # install various tools required to get the image up to usable levels
+    docker_image_commands:
+      - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts'
+CONFIG:
+  trace_limit: 200
diff --git a/spec/acceptance/nodesets/docker/debian-8.yml b/spec/acceptance/nodesets/docker/debian-8.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  debian-8-x64:
+    platform: debian-8-amd64
+    hypervisor: docker
+    image: debian:8
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen'
+CONFIG:
+  trace_limit: 200
diff --git a/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/spec/acceptance/nodesets/docker/ubuntu-14.04.yml
@@ -0,0 +1,12 @@
+HOSTS:
+  ubuntu-1404-x64:
+    platform: ubuntu-14.04-amd64
+    hypervisor: docker
+    image: ubuntu:14.04
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      # ensure that upstart is booting correctly in the container
+      - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8'
+CONFIG:
+  trace_limit: 200
diff --git a/spec/acceptance/nodesets/fedora-18-x64.yml b/spec/acceptance/nodesets/fedora-18-x64.yml
diff --git a/spec/acceptance/nodesets/sles-11sp1-x64.yml b/spec/acceptance/nodesets/sles-11sp1-x64.yml
diff --git a/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml b/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml
diff --git a/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml b/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml
diff --git a/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml b/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
diff --git a/spec/acceptance/params_spec.rb b/spec/acceptance/params_spec.rb
@@ -1,17 +1,16 @@
 require 'spec_helper_acceptance'
 
-describe "param based tests:", :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
-
-  before(:all) do
-    shell('iptables --flush; iptables -t nat --flush; iptables -t mangle --flush')
-    shell('ip6tables --flush; ip6tables -t nat --flush; ip6tables -t mangle --flush')
+describe 'param based tests' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   it 'test various params', :unless => (default['platform'].match(/el-5/) || fact('operatingsystem') == 'SLES') do
     iptables_flush_all_tables
 
     ppm = <<-EOS
-    firewall { '100 test': 
+    firewall { '100 test':
       table     => 'raw',
       socket    => 'true',
       chain     => 'PREROUTING',

diff --git a/spec/acceptance/purge_spec.rb b/spec/acceptance/purge_spec.rb
@@ -1,6 +1,11 @@
 require 'spec_helper_acceptance'
 
-describe "purge tests:", :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+describe 'purge tests' do
+  before :all do
+    iptables_flush_all_tables
+    ip6tables_flush_all_tables
+  end
+
   context('resources purge') do
     before(:all) do
       iptables_flush_all_tables

diff --git a/spec/acceptance/resource_cmd_spec.rb b/spec/acceptance/resource_cmd_spec.rb
@@ -3,7 +3,7 @@
 # Here we want to test the the resource commands ability to work with different
 # existing ruleset scenarios. This will give the parsing capabilities of the
 # code a good work out.
-describe 'puppet resource firewall command:', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+describe 'puppet resource firewall command' do
   before(:all) do
     # In order to properly check stderr for anomalies we need to fix the deprecation warnings from puppet.conf.
     config = shell('puppet config print config').stdout

diff --git a/spec/acceptance/rules_spec.rb b/spec/acceptance/rules_spec.rb
@@ -1,8 +1,9 @@
 require 'spec_helper_acceptance'
 
-describe 'complex ruleset 1', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+describe 'complex ruleset 1' do
   before :all do
     iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   after :all do
@@ -127,7 +128,7 @@
   it 'applies cleanly' do
     pp = <<-EOS
       class { '::firewall': }
-      
+
       Firewall {
         proto => 'all',
         stage => 'pre',

diff --git a/spec/acceptance/socket_spec.rb b/spec/acceptance/socket_spec.rb
@@ -1,9 +1,10 @@
 require 'spec_helper_acceptance'
 
 # RHEL5 does not support -m socket
-describe 'firewall socket property', :unless => (UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) || default['platform'] =~ /el-5/ || fact('operatingsystem') == 'SLES') do
+describe 'firewall socket property', :unless => default['platform'] =~ /el-5/ || fact('operatingsystem') == 'SLES' do
   before :all do
     iptables_flush_all_tables
+    ip6tables_flush_all_tables
   end
 
   shared_examples "is idempotent" do |value, line_match|

diff --git a/spec/acceptance/standard_usage_spec.rb b/spec/acceptance/standard_usage_spec.rb
@@ -1,7 +1,7 @@
 require 'spec_helper_acceptance'
 
 # Some tests for the standard recommended usage
-describe 'standard usage tests:', :unless => UNSUPPORTED_PLATFORMS.include?(fact('osfamily')) do
+describe 'standard usage tests' do
   it 'applies twice' do
     pp = <<-EOS
       class my_fw::pre {

diff --git a/spec/acceptance/unsupported_spec.rb b/spec/acceptance/unsupported_spec.rb
diff --git a/spec/spec_helper_acceptance.rb b/spec/spec_helper_acceptance.rb
@@ -8,7 +8,7 @@ def iptables_flush_all_tables
 end
 
 def ip6tables_flush_all_tables
-  ['filter'].each do |t|
+  ['filter', 'mangle'].each do |t|
     expect(shell("ip6tables -t #{t} -F").stderr).to eq("")
   end
 end
@@ -23,21 +23,19 @@ def do_catch_changes
 
 run_puppet_install_helper
 
-UNSUPPORTED_PLATFORMS = ['windows','Solaris','Darwin']
-
 RSpec.configure do |c|
   # Project root
   proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
 
-  # Readable test descriptions
-  c.formatter = :documentation
-
   # Configure all nodes in nodeset
   c.before :suite do
     # Install module and dependencies
     hosts.each do |host|
       copy_module_to(host, :source => proj_root, :module_name => 'firewall')
-      on host, puppet('module install puppetlabs-stdlib --version 3.2.0'), { :acceptable_exit_codes => [0,1] }
+      on host, puppet('module install puppetlabs-stdlib --version 3.2.0')
+
+      # the ubuntu-14.04 docker image doesn't carry the iptables command
+      apply_manifest_on host, 'package { "iptables": ensure => installed }' if fact('osfamily') == 'Debian'
     end
   end
 end
diff --git a/spec/spec_helper_local.rb b/spec/spec_helper_local.rb
@@ -1,3 +1,14 @@
 RSpec.configure do |config|
   config.mock_with :rspec
 end
+
+def with_debian_facts
+  let :facts do
+    {
+      :kernel          => 'Linux',
+      :operatingsystem => 'Debian',
+      :operatingsystemrelease => '8.0',
+      :osfamily        => 'Debian',
+    }
+  end
+end
diff --git a/spec/unit/classes/firewall_linux_redhat_spec.rb b/spec/unit/classes/firewall_linux_redhat_spec.rb
@@ -7,13 +7,14 @@
       :enable => 'true'
     )}
   end
-      
+
   context 'ensure => stopped' do
     let(:params) {{ :ensure => 'stopped' }}
     it { should contain_service('iptables').with(
       :ensure => 'stopped'
     )}
   end
+
   context 'enable => false' do
     let(:params) {{ :enable => 'false' }}
     it { should contain_service('iptables').with(
@@ -30,24 +31,26 @@
     oldreleases.each do |osrel|
       context "os #{os} and osrel #{osrel}" do
         let(:facts) {{
-          :osfamily               => 'RedHat',
           :operatingsystem        => os,
-          :operatingsystemrelease => osrel
+          :operatingsystemrelease => osrel,
+          :osfamily               => 'RedHat',
+          :selinux                => false,
         }}
 
         it { should_not contain_service('firewalld') }
         it { should_not contain_package('iptables-services') }
-        
+
         it_behaves_like "ensures iptables service"
       end
     end
 
     newreleases.each do |osrel|
       context "os #{os} and osrel #{osrel}" do
         let(:facts) {{
-          :osfamily               => 'RedHat',
           :operatingsystem        => os,
-          :operatingsystemrelease => osrel
+          :operatingsystemrelease => osrel,
+          :osfamily               => 'RedHat',
+          :selinux                => false,
         }}
 
         it { should contain_service('firewalld').with(

diff --git a/spec/unit/classes/firewall_linux_spec.rb b/spec/unit/classes/firewall_linux_spec.rb
@@ -1,18 +1,21 @@
 require 'spec_helper'
 
 describe 'firewall::linux', :type => :class do
-  let(:facts_default) {{ :kernel => 'Linux' }}
-  it { should contain_package('iptables').with_ensure('present') }
-
   context 'RedHat like' do
     %w{RedHat CentOS Fedora}.each do |os|
       context "operatingsystem => #{os}" do
         releases = (os == 'Fedora' ? ['14','15','Rawhide'] : ['6','7'])
         releases.each do |osrel|
           context "operatingsystemrelease => #{osrel}" do
-            let(:facts) { facts_default.merge({ :operatingsystem => os,
-                                                :operatingsystemrelease => osrel}) }
+            let(:facts) {{
+              :kernel                 => 'Linux',
+              :operatingsystem        => os,
+              :operatingsystemrelease => osrel,
+              :osfamily               => 'RedHat',
+              :selinux                => false,
+            }}
             it { should contain_class('firewall::linux::redhat').with_require('Package[iptables]') }
+            it { should contain_package('iptables').with_ensure('present') }
           end
         end
       end
@@ -24,8 +27,16 @@
       context "operatingsystem => #{os}" do
         releases = (os == 'Debian' ? ['6','7','8'] : ['10.04','12.04','14.04'])
         releases.each do |osrel|
-          let(:facts) { facts_default.merge({ :operatingsystem => os, :operatingsystemrelease => osrel}) }
+          let(:facts) {{
+            :kernel                 => 'Linux',
+            :operatingsystem        => os,
+            :operatingsystemrelease => osrel,
+            :osfamily               => 'Debian',
+            :selinux                => false,
+          }}
+
           it { should contain_class('firewall::linux::debian').with_require('Package[iptables]') }
+          it { should contain_package('iptables').with_ensure('present') }
         end
       end
     end

diff --git a/spec/unit/classes/firewall_spec.rb b/spec/unit/classes/firewall_spec.rb
@@ -2,7 +2,7 @@
 
 describe 'firewall', :type => :class do
   context 'kernel => Linux' do
-    let(:facts) {{ :kernel => 'Linux' }}
+    with_debian_facts
     it { should contain_class('firewall::linux').with_ensure('running') }
   end
 
@@ -22,7 +22,7 @@
   end
 
   context 'ensure => stopped' do
-    let(:facts) {{ :kernel => 'Linux' }}
+    with_debian_facts
     let(:params) {{ :ensure => 'stopped' }}
     it { should contain_class('firewall::linux').with_ensure('stopped') }
   end