IPtables rules are just another config file. As such, use puppet (or equivalent) to manage them. I'm fairly indifferent to the likes of Shorewall.

actually come to think of it, the way you're doing it you're running iptables for each rule, that's your bottleneck<BR><BR>Put all the rules into one file and use iptables-restore ...