##### SUMMARY
Module triggers an unsupported syntax with iptables executable.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
iptables

##### ANSIBLE VERSION

```
ansible 2.9.6
  config file = -SNIP-/ansible.cfg
  configured module search path = ['-SNIP-/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/Cellar/ansible/2.9.6_1/libexec/lib/python3.8/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.8.2 (default, Mar 11 2020, 15:23:03) [Clang 11.0.0 (clang-1100.0.33.17)]
```

##### CONFIGURATION

```
DEFAULT_BECOME = True
HOST_KEY_CHECKING = False
INTERPRETER_PYTHON = auto_silent
```

##### OS / ENVIRONMENT

OS Ansible is executed in: MacOSX
Destination OS: SUSE Linux Enterprise Server 12 SP5


##### STEPS TO REPRODUCE

Play:
```yaml
- name: create ajp port whitelist
  iptables:
    action: insert
    chain: INPUT
    comment: See Ticket123
    destination_port: '8009'
    policy: ACCEPT
    protocol: tcp
    source: '172.18.0.2'
```

##### EXPECTED RESULTS
Not to receive an error.


##### ACTUAL RESULTS
When executed, this doesn't work:

```
failed: [-SNIP-] (item=172.18.0.2) => {"ansible_loop_var": "item", "changed": false, "cmd": "/usr/sbin/iptables -t filter -L INPUT -p tcp -s 172.18.0.2 --destination-port 8009 -m comment --comment 'See Ticket123'", "item": "172.18.0.2", "msg": "iptables v1.4.21: Illegal option `-s' with this command\n\nTry `iptables -h' or 'iptables --help' for more information.", "rc": 2, "stderr": "iptables v1.4.21: Illegal option `-s' with this command\n\nTry `iptables -h' or 'iptables --help' for more information.\n", "stderr_lines": ["iptables v1.4.21: Illegal option `-s' with this command", "", "Try `iptables -h' or 'iptables --help' for more information."], "stdout": "", "stdout_lines": []}
```

description:
      - Insert the rule as the given rule number.
      - This works only with C(action=insert).
    type: str
    version_added: "2.5"
  ip_version:
    description:
      - Which version of the IP protocol this rule should apply to.
    type: str
    choices: [ ipv4, ipv6 ]
    default: ipv4
  chain:
    description:
      - Specify the iptables chain to modify.
      - This could be a user-defined chain or one of the standard iptables chains, like
        C(INPUT), C(FORWARD), C(OUTPUT), C(PREROUTING), C(POSTROUTING), C(SECMARK) or C(CONNSECMARK).
    type: str
  protocol:
    description:
      - The protocol of the rule or of the packet to check.
      - The specified protocol can be one of C(tcp), C(udp), C(udplite), C(icmp), C(ipv6-icmp) or C(icmpv6),
        C(esp), C(ah), C(sctp) or the special keyword C(all), or it can be a numeric value,
        representing one of these protocols or a different one.
      - A protocol name from I(/etc/protocols) is also allowed.
      - A C(!) argument before the protocol inverts the test.
      - The number zero is equivalent to all.
      - C(all) will match with all protocols and is taken as default when this option is omitted.
    type: str
  source:
    description: