Nice write-up. I have a very similar setup, only I didn't delve into the netflow montioring/traffic shaping because it seemed a bit overkill for my needs.
Have you given any thought about what you might do with respect to Shorewall, given the this news?
Have you given any thought about what you might do with respect to Shorewall, given the this news?