SlackFire is an firewall script implemented with iptables. It is completely configurable via a CLI, as all configuration is performed via configuration files. It supports all kinds of packet forwarding, including NAT, NAT with port redirection, and forwarding to machines with routable IP addresses. The configuration files are heavily commented, and messages in the log file are as informative as possible.
