I've found that `gfcc' offers a great way to set up IPchains. It's got a few user interface issues, but overall works fairly well. It will export a shell script... I save that next to the corresponding .rule file it makes, then create a symlink to it from /etc/init.d/gfcc.sh, and then symlink to that from inside /etc/rcS.d. Now I can `super gfcc' anytime I need to, and set things as I see fit.