For what it's worth, PF is a lot easier to work with than iptables. The configuration files involved (namely: pf.conf) are easy to read/write and well-documented.