Some comments.

roles/base/templates/iptables/iptables

@@ -33,7 +33,10 @@
 # ban staging from non-staging hosts
 {% if env != 'staging' %}
 {% for host in groups['staging'] %}
+{% if 'eth0_ip' in hostvars[host] %}# {{ host }}
 -A INPUT -s {{ hostvars[host]['ansible_eth0']['ipv4']['address'] }} -j REJECT --reject-with icmp-host-prohibited
+{% else %}# {{ host }} has no 'eth0_ip' listed
+{% endif %}
 {% endfor %}
 {% endif %}