Modifying iptables rules is such a common operation that all configuration management languages would support them natively. Using an iptables module for Ansib

Modifying iptables rules is such a common operation that all configuration management languages would support them natively. Using an iptables module for Ansible it is straightforward to write the rules as yaml. The documentation has a clear example. However, having used several of these languages for over a decade and realizing this is a contentious issue within the community, I would actually avoid using these tools for individual rules. What I would do is dump the rules to a file, distribute the file, and let Ansible make sure the file matches what is running (by way of a regular rule load when necessary). The idea here is that I am already familiar with iptables rules and how to write them, and would expect any other ops-ish person to be the same. The source file matches the output, and any historical diffs will be much more straightforward to read, as there are no intermediary source formats that can change. Also, there is one less Ansible dependency involved, and less syntax to learn (given that one can already read iptables rules).