> I have seen some of this functionality in Checkpoint, and I think that
> it would be immensely useful in the iptables community if it is adopted.

NuFW provides these sort of things :
  http://www.nufw.org
Code can be considered has beta code. It works but things need to be
done (especially a Windows Client ;-).
With NuFW, you really filter by User (Group) and not by IP as it often
the case.

BR,
-- 
Eric Leblond
Nufw, Now User Filtering Works (http://www.nufw.org)