The problem is that the IPTables::IPv4 perl module is out of date in terms of its support for newer versions of iptables. Therefore on some systems this module will not install cleanly because the system itself will have a copy of iptables which is newer than this module supports. Because of this, some of the tests will fail if they are not forced. However, the Manager only uses this module to create correctly formatted commands to send to the firewall, and the Manager itself never actually executes the portions of the code which use XS to interface with iptables. Therefore we consider it safe for now to force the install on the Manager, until such time as we can update the firewall module to use IPTables::libiptc. (We have a version of Firewall.pm which uses IPTables::libiptc, but we weren't able to get a new working firewall VM which was working well enough for public release.)