Whenever I touch a Linux system I’m amazed that nobody’s written anything better than iptables yet.

@jogbert It's horrible. Yet I rarely have to touch it. ufw does fine for laptops and simple servers, and I use firehol for complex routers.

@dsilverstone Just little things, like “log AND accept/drop” shouldn’t need to be two rules. :-(

@jogbert Mmm, OTOH it's pretty extensible/sane overall.

@dsilverstone I’d rather something like OpenBSD’s pf. Readable yet powerful (and just one config file).