title: Ansible iptables role execution order
body: <p>I have a playbook defined that executes two roles:</p>
  <ol>
  <li>Install SSHD</li>
  </ol>
  <pre class="lang-yaml prettyprint-override"><code>- name: install sshd
    apt:
      name: openssh-server
      state: present
      update_cache: yes
  - name: Allow new incoming SYN packets on TCP port {{ssh_port}} (SSH)
    iptables:
      chain: INPUT
      protocol: tcp
      destination_port: &quot;{{ssh_port}}&quot;
      ctstate: NEW
      syn: match
      jump: ACCEPT
      comment: Accept new SSH connections.
      state: present
  </code></pre>
  <ol start="2">
  <li>Configure IPTables</li>
  </ol>
  <pre class="lang-yaml prettyprint-override"><code>- name: Iptables flush filter
    iptables:
      chain: &quot;{{ item }}&quot;
      flush: yes
    with_items:  [ 'INPUT', 'FORWARD', 'OUTPUT' ]
  - name: Allow related and established connections
    iptables:
      chain: INPUT
      match: conntrack
      ctstate: ESTABLISHED,RELATED
      jump: ACCEPT
  - name: Set the policy for the INPUT chain to DROP
    iptables:
      chain: INPUT
      policy: DROP 
  
  </code></pre>
  <p>I thought of having the roles defined in a self-contained way. this is why the SSHD role takes care of its own firewall settings. However, this leads to a problem now:</p>
  <ul>
  <li>Executing the SSHD role first, the iptables role will delete (flush) the SSHD rule, leaving access to ssh blocked</li>
  <li>Executing the iptables role first, it will immediately block SSH (and therefore ansible) access, before the SSHD role can be executed to enable it again</li>
  </ul>
  <p>How do I structure the playbooks correctly?</p>