Even if is neater to have a separated firewall::rule::iptables define I'd suggest for "performance" reason to place the case for the firewall_tool (or rule_class, here) dand the relevant iptables::rule declaration directly in the firewall (or firewall::rule) define.
For each rule you save 1 resource,

The abstraction for firewalling is already quite resource intensive.