IPtables rules are just another config file. As such, use puppet (or equivalent) to manage them. I'm fairly indifferent to the likes of Shorewall. They're nice for creating complex rulesets on gateway ...