IPtables rules are just another config file. As such, use puppet (or equivalent) to manage them. I'm fairly indifferent to the likes of Shorewall. They're nice for creating complex rulesets on gateway ...

Iptables, more properly referred to as “iptables/netfilter” because of the two modules that are involved — the userspace module “iptables” and the kernel ...