Sorry for being unclear, that’s what I meant. Set rules using the Ansible module, make them persistent by notifying a handler that makes a cmd call.

Yeah, ansible.builtin.iptables makes the changes and the task then notifies a handler to invoke iptables-save.