diff --git a/lib/puppet/provider/firewall/ip6tables.rb b/lib/puppet/provider/firewall/ip6tables.rb
index 585f855eb..51d0399d3 100644
--- a/lib/puppet/provider/firewall/ip6tables.rb
+++ b/lib/puppet/provider/firewall/ip6tables.rb
@@ -37,7 +37,7 @@
 
   confine :kernel => :linux
 
-  ip6tables_version = Facter.fact('ip6tables_version').value
+  ip6tables_version = Facter.value('ip6tables_version')
   if (ip6tables_version and Puppet::Util::Package.versioncmp(ip6tables_version, '1.4.1') < 0)
     mark_flag = '--set-mark'
   else
diff --git a/lib/puppet/provider/firewall/iptables.rb b/lib/puppet/provider/firewall/iptables.rb
index 52a7a2da6..27c0b362e 100644
--- a/lib/puppet/provider/firewall/iptables.rb
+++ b/lib/puppet/provider/firewall/iptables.rb
@@ -42,7 +42,7 @@
   defaultfor :kernel => :linux
   confine :kernel => :linux
 
-  iptables_version = Facter.fact('iptables_version').value
+  iptables_version = Facter.value('iptables_version')
   if (iptables_version and Puppet::Util::Package.versioncmp(iptables_version, '1.4.1') < 0)
     mark_flag = '--set-mark'
   else
diff --git a/lib/puppet/type/firewall.rb b/lib/puppet/type/firewall.rb
index 171c2e6f1..1ae9d39c3 100644
--- a/lib/puppet/type/firewall.rb
+++ b/lib/puppet/type/firewall.rb
@@ -841,7 +841,7 @@ def insync?(is)
       end
 
       # Old iptables does not support a mask. New iptables will expect one.
-      iptables_version = Facter.fact('iptables_version').value
+      iptables_version = Facter.value('iptables_version')
       mask_required = (iptables_version and Puppet::Util::Package.versioncmp(iptables_version, '1.4.1') >= 0)
 
       if mask_required