status quo:

A service that happens to use the libnet-dns-perl Debian package can't be switched from ferm / iptables to nftables as the firewall::provider.

example services affected: VRTS, mailman3 where the package is pulled in by spamassassin.

root cause:

If firewall::provider is set to nftables there is code that removes ferm/iptables and related packages.

This also removes libnet-dns-perl though.

effect:

If there is other puppet code that installs spamassassin or pulls in libnet-dns-perl in other ways, packages get installed and removed again on every single puppet run.

Services can't switch to nftables as firewall provider.

desired fix:

Some way to configure that this package is still needed while also being able to switch the firewall provider.