I seem to recall a thread about this a month or two back, where the
position was put forth that the KISS principle would argue for directly
using iptables instead of one of the wrappers, since the poster claimed to
be able to put up a working firewall in 5 or 6 lines vs 10's or 100's that
may result from shorewall. From my standpoint, I only need to mess with
5 or 6 lines (if that) in shorewall to get a working system, but would
need to master a bunch of "fine" manuals to fully understand iptables,
so kiSS still has me using shorewall.