##### SUMMARY
Module triggers an unsupported syntax with iptables executable.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
iptables

##### ANSIBLE VERSION

```
ansible 2.9.6
  config file = -SNIP-/ansible.cfg
  configured module search path = ['-SNIP-/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/Cellar/ansible/2.9.6_1/libexec/lib/python3.8/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.8.2 (default, Mar 11 2020, 15:23:03) [Clang 11.0.0 (clang-1100.0.33.17)]
```

##### CONFIGURATION

```
DEFAULT_BECOME = True
HOST_KEY_CHECKING = False
INTERPRETER_PYTHON = auto_silent
```

##### OS / ENVIRONMENT

OS Ansible is executed in: MacOSX
Destination OS: SUSE Linux Enterprise Server 12 SP5


##### STEPS TO REPRODUCE

Play:
```yaml
- name: create ajp port whitelist
  iptables:
    action: insert
    chain: INPUT
    comment: See Ticket123
    destination_port: '8009'
    policy: ACCEPT
    protocol: tcp
    source: '172.18.0.2'
```

##### EXPECTED RESULTS
Not to receive an error.


##### ACTUAL RESULTS
When executed, this doesn't work:

```
failed: [-SNIP-] (item=172.18.0.2) => {"ansible_loop_var": "item", "changed": false, "cmd": "/usr/sbin/iptables -t filter -L INPUT -p tcp -s 172.18.0.2 --destination-port 8009 -m comment --comment 'See Ticket123'", "item": "172.18.0.2", "msg": "iptables v1.4.21: Illegal option `-s' with this command\n\nTry `iptables -h' or 'iptables --help' for more information.", "rc": 2, "stderr": "iptables v1.4.21: Illegal option `-s' with this command\n\nTry `iptables -h' or 'iptables --help' for more information.\n", "stderr_lines": ["iptables v1.4.21: Illegal option `-s' with this command", "", "Try `iptables -h' or 'iptables --help' for more information."], "stdout": "", "stdout_lines": []}
```

- Source specification.
      - Address can be either a network name, a hostname, a network IP address
        (with /mask), or a plain IP address.
      - Hostnames will be resolved once only, before the rule is submitted to
        the kernel. Please note that specifying any name to be resolved with
        a remote query such as DNS is a really bad idea.
      - The mask can be either a network mask or a plain number, specifying
        the number of 1's at the left side of the network mask. Thus, a mask
        of 24 is equivalent to 255.255.255.0. A C(!) argument before the
        address specification inverts the sense of the address.
    type: str
  destination:
    description:
      - Destination specification.
      - Address can be either a network name, a hostname, a network IP address
        (with /mask), or a plain IP address.
      - Hostnames will be resolved once only, before the rule is submitted to
        the kernel. Please note that specifying any name to be resolved with
        a remote query such as DNS is a really bad idea.
      - The mask can be either a network mask or a plain number, specifying
        the number of 1's at the left side of the network mask. Thus, a mask
        of 24 is equivalent to 255.255.255.0. A C(!) argument before the
        address specification inverts the sense of the address.
    type: str
  tcp_flags:
    description:
      - TCP flags specification.
      - C(tcp_flags) expects a dict with the two keys C(flags) and C(flags_set).
    type: dict
    default: {}