Shorewall is probably nice tool but I have to agree. iptables (and netfilter thereof) are good to work with. In larger setups we used fwbuilder for generating the policy but it always boils down to understand iptables & netfilter.