netfilter is a framework for arbitrary packet mangling. So far, a new NAT system and packet-filtering system have been built on top of it, as well as compatibility modules for ipfwadm and ipchains. Netfilter is a work-in-progress, but should be fairly robust for nic work.
c895e370bf63cd2f5b9879ff8e1d2fae969dc96c48b7065db8f687056c66ef07