snipped of a chef recipe.

production.rb

include_recipe 'iptables'

iptables_rule 'ssh_in'
iptables_rule 'http_in'
iptables_rule 'https_in'
iptables_rule 'mongo_in' do
  only_if { node[:mongo][:replica_set][:enabled] }
  variables :rs_members => search(:node, "role:mongo_#{node[:mongo][:replica_set][:name]}")
end