In my system I created a couple of scripts to set the firewall forwarding policy and accounting policy. By default the IP Forwarding system in the Linux kernel forwards everything. Because of this, your firewall script should start by denying access to everything and flushing any ipfw rules in place from the last time it was run. This script will do the trick. Now we have the ultimate firewall.
Nothing can get through.
No doubt you have some services you need to forward so here are a few examples you should find useful. You might also be interested in accounting for traffic going through your firewall. This script will count ever packet. You could add a line or to to account for packets going to just a single system. If all you wanted was a filtering firewall you can stop here.