netfilter is a framework for arbitrary packet mangling. So far, a new NAT system and packet-filtering system have been built on top of it, as well as compatibility modules for ipfwadm and ipchains. Netfilter is a work-in-progress, but should be fairly robust for non-exotic work.
c1f807685c78559650187c4892ccd9cff5cf001c61a6e788267d4d8e1babcfce