FireHOL looks like a neat tool, but seeing their last (official) release was in 2008 turned me off. I'm using Shorewall now, and as a plus, it supports ipset (mentioned by rw-).