diff --git a/.puppet-lint.rc b/.puppet-lint.rc
index c7a214e..24728eb 100644
--- a/.puppet-lint.rc
+++ b/.puppet-lint.rc
@@ -1 +1,2 @@
---no-variable_scope-check
\ No newline at end of file
+--no-variable_scope-check
+--no-top_scope_facts
\ No newline at end of file
diff --git a/README.md b/README.md
index 5b6cec1..d57d967 100644
--- a/README.md
+++ b/README.md
@@ -32,17 +32,17 @@ NRPE allows monitoring tools like NAGIOS or ICINGA to connect to clients for mon
 
 ## Features
 
-* install nrpe binaries
-* manage NRPE service user properties
-* manage directory structure (file system permissions, selinux context) through parameters
-* manage configuration files through parameters:
-  * nrpe.conf
-  * nrpe.cfg
-* manage sudo role for nagios user on NRPE clients
-* manage dynamic NRPE check command  definitions
-* manage iptables (optional). set `ne_incl_fw`to `true`. 
-* manage selinux rule exceptions (optional)
-* manage NRPE service
+- install nrpe binaries
+- manage NRPE service user properties
+- manage directory structure (file system permissions, selinux context) through parameters
+- manage configuration files through parameters:
+  - nrpe.conf
+  - nrpe.cfg
+- manage sudo role for nagios user on NRPE clients
+- manage dynamic NRPE check command  definitions
+- manage iptables (optional). set `ne_incl_fw`to `true`. 
+- manage selinux rule exceptions (optional)
+- manage NRPE service
 
 > Note: The value for the `nagios_server` variable is derived from a global paraneter set in Foreman (`nagios_server`), because the paremeter is used across multiple modules. You need to set that manually in Foreman under "Global Parameters". Same for `nagios_source`, the value for the firewall source.
 
@@ -54,14 +54,14 @@ See the full Puppet documentation including parameters in `docs/index.html`
 
 All dependencies must be included in the catalogue.
 
-* [confdroid_resources](https://gitlab.confdroid.com/puppet/cd_resources) to manage YUM repositories.
-* [puppetlabs firewall](https://github.com/puppetlabs/puppetlabs-firewall)  to manage iptables
+- [confdroid_resources](https://gitlab.confdroid.com/puppet/cd_resources) to manage YUM repositories.
+- [puppetlabs firewall](https://github.com/puppetlabs/puppetlabs-firewall)  to manage iptables
 
 ## Deployment
 
 `confdroid_nrpe` does typically not need to be specifically declared. It will be auto-required by `cd_nagios` with default settings. Only if you want to override settings declare it specifically.
 
-* native Puppet deployment
+- native Puppet deployment
 
 via site.pp or nodes.pp
 
@@ -71,9 +71,9 @@ node 'example.example.net' {
 }
 ```
 
-* through Foreman:
+- through Foreman:
 
-In order to apply parameters through Foreman, **__confdroid_nrpe::params__** must be added to the host or host group in question, unless the defaults are fully acceptable across the estate.
+In order to apply parameters through Foreman, **__confdroid_nrpe::params__*- must be added to the host or host group in question, unless the defaults are fully acceptable across the estate.
 
 See [more details about class deployment on Confdroid.com](https://confdroid.com/2017/05/deploying-our-puppet-modules/).
 
@@ -100,31 +100,32 @@ All files and directories are configured with correct selinux context. If selinu
 
 ## Known Problems
 
-* SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the `ssl_cert_file` line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the `$ne_enable_ssl` boolean parameter, which is set to `false` by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found.  Setting this option  to `true` will include all SSL / TLS settings.
+- SSL/TLS support: Version 3 of NRPE supposedly has support for SSL/ TLs. However, at the time of writing this module, this seems to be buggy, as I was unable to start the NRPE service as soon as the `ssl_cert_file` line was uncommented in the configuration file, despite having valid certs in the right position on the node. This happened when installing manually, not through this Puppet module. For that reason I included the `$ne_enable_ssl` boolean parameter, which is set to `false` by default, hence disabling SSL/TLS options until this has been fixed upstream, or a valid workaround has been found.  Setting this option  to `true` will include all SSL / TLS settings.
 
 ## Troubleshooting
 
-* `CHECK_NRPE: Unable to read output`: Nagios sudo access also needs Selinux to allow this. Default settings in this module take care for both through `$ne_allow_sudo` and `$ne_include_selinux`.
-* `CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected)`: This is down to the new illegal meta characters feature via `nasty_metachars`, i.e. if you included an additional character which actually be part of a check, or if a custom check contains a default illegal character.
+- `CHECK_NRPE: Unable to read output`: Nagios sudo access also needs Selinux to allow this. Default settings in this module take care for both through `$ne_allow_sudo` and `$ne_include_selinux`.
+- `CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected)`: This is down to the new illegal meta characters feature via `nasty_metachars`, i.e. if you included an additional character which actually be part of a check, or if a custom check contains a default illegal character.
 
 ## Support
 
-* OS: Rocky 9
-* Puppet 8
+- OS: Rocky 9
+- Puppet 8
 
 ## Tests
 
-* Puppet Lint
-  * excluded tests:
-    * `--no-variable_scope-check`: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters.
-* Puppet Parser
-* ERB Template Parser
-* Sonar Quality Gate
+- Puppet Lint
+  - excluded tests:
+    - `--no-variable_scope-check`: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters.
+    - `--no-top_scope_facts`: iptables does not recognise otherwise
+- Puppet Parser
+- ERB Template Parser
+- Sonar Quality Gate
 
 ## Contact Us
 
-* [contact Us](https://confdroid.com/contact/)
-* [Feedback Portal](https://feedback.confdroid.com)
+- [contact Us](https://confdroid.com/contact/)
+- [Feedback Portal](https://feedback.confdroid.com)
 
 ## Disclaimer
 
diff --git a/manifests/firewall/iptables.pp b/manifests/firewall/iptables.pp
index 1c8caa1..cf4a19d 100644
--- a/manifests/firewall/iptables.pp
+++ b/manifests/firewall/iptables.pp
@@ -7,10 +7,9 @@
 class confdroid_nrpe::firewall::iptables (
 
 ) inherits confdroid_nrpe::params {
-
   if $ne_incl_fw == true {
     firewall { "${ne_fw_order_no}${ne_nrpe_port} port ${ne_nrpe_port}":
-      source => $nagios_server,
+      source => $nagios_source,
       proto  => 'tcp',
       dport  => $ne_nrpe_port,
       jump   => 'accept',