Provider/Delayed Approach

I had a few issues where I needed multiple cookbooks to setup firewall rules and I didn't want to have to bake in the sequencing of diptables into the run list.  What do you think of this approach?

In my code I can do this and then populating the rules/using iptables/etc. is automatically deferred:

diptables_apply 'apply' do
  action :nothing
end

diptables_rule 'ssh' do
  rule '--proto tcp --dport ssh -m state --state NEW'
  notifies :apply, 'diptables_apply[apply]', :delayed
end