Not to mention shorewall, which IMO provides a really nice abstraction over iptables, that fits 90% of the needs out there.