I found that 'firehol' was quite a surprise to me -- not only didn't it suck, it actually improved my hand-written firewall somewhat.
Unlike everything else, it doesn't tell you to fill in three values in a configuration file and expect to have a full firewall. All it does is help take the tedious bits out of writing an iptables firewall.
I'd like to know what you think of shorewall? Is it good firewall or should I switch to that firehol you write about? I have heared some opinions like "shorewall is bad" so I'm really thinking of switching to something else. But I dont't know why... noone was able to give me a good reason.
-- Jakub Sporek