iptables immutable

[Kelly Setzer <Kelly.Setzer@placemark.com>]

We are in the process of implementing a firewall based on iptables.
Our basic implementation is laid out, and now we are searching for
every scrap that might improve security.  One thing I'd like is the
ability to "lock" the iptables configuration so that no further
changes can be made (without rebooting).

I don't see that iptables supports that directly.  I would be willing
to put my effort into such a project, although it's at the limits of
my expertise.  I have been trying to think of a way to emulate this
behavior.

The only reasonable idea I've had is using Linux Capabilities:
http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.4/capfaq-0.2.txt

However, I'm not even sure how I'd apply that to iptables to prevent
changes to the iptables chains.

Thoughts?

Kelly