I prefer iptables-services instead of firewalld. This role ensure that firewalld is disabled and iptables-services is enabled. This role is in development state and tested on CentOS7 vagrant box.
CentOS 7
#TODO Paste here defaults/main.yml
- hosts: servers
roles:
- role: hxpro.iptables-services
WTFPL
Matěj Koudelka matej@hxpro.cz