Q:

Safe way to deploy iptables using ansible

I would like to deploy iptables rules in a "safe" way using ansible where for safe I think at something like the shorewall command safe-restart.
So I'm looking for a workflow like this:

install the new rules;
wait for 30 seconds for a confirmation from the user (or, in our case, from the machine executing the playbook);
if the user confirms then make them permanent, otherwise restore the old rules.

My goal is to avoid losing control of my machines because of a wrong firewall configuration (that may, for example, block SSH).

A:

Since ansible is agentless it means it would need to open new connection (or re-use existent if configured properly) to host in order to restore the state.
If on the current step changes to firewall would not allow the next connection to succeed there's no way to recover obviously.
Thus it means you have to put testing-recovery task on the host itself which would try to apply new rules and then wait to see if next step of playbook has been succeeded (typically you need at least SSH accessible, so testing step of playbook could be just killing that script before it restores previous ruleset). It also can do some self-originating testing of course.
Summary: plant a script that would not only apply the rules but also would withdraw them back in case those rules would cause connectivity regression.
Straight-forward approach using iptables-apply:

Run it detached (with screen or tmux or whatever) with new ruleset
Kill it in the following play step before it rolled back firewall to the previous ruleset

