Filtergen is a packet filter generator. It compiles a fairly high-level description language into iptables, ipchains, or ipfilter scripts (and has bits of support for Cisco IOS access lists).