Having a quick look at the code (I'm not the cloudstack expert here :)) it seems that it will list the rules and only try to delete the ones that really exist. The same procedure is applied in the other cleanup methods, so if this is true and I haven't misunderstood how it works, it should be safe to call the destroyNode as it should not fail during rollback. Worth a try?