It appears the maintainer of the package, or the person who built the post-installation script, made the assumption that any error experienced while the script is running should indicate a complete failure.

On our platform, we compile a large number of common modules in to our kernel and you are unable to use modprobe if you wish to enable a specific module. As a result, any attempts to load a kernel module using modprobe will fail, and error status 1 will be returned.

Having extracted the .deb package, and looked at the "postinst" script, I found that it tries to run these two commands:

modprobe -q iptable_filter
modprobe -q ip6table_filter

In your case, it never makes it to the second command. When the first command is executed, it returns a status 1 error code. This wouldn't be an issue if the script was doing the error checking. However, because "set -e" is done at the top of the script, it immediately exits with status 1. Dpkg then intercepts this status, and assumes it has failed.

This is indeed a bug with the package itself. The postinst script should be refactored so that it doesn't blindly assume an error return from modprobe is an actual issue.

At this point, it appears that "iptables-persistent" should work as it has been installed. However, apt-get is most likely going to try to reconfigure "iptables-persistent" when doing any package installations in the future. This shouldn't cause the process to fail, but it will return a failure status code.