Having any of the firewall in the kernel is one Linuxism I've never understood. I tried to set up an old computer as a VPN server, and I had to recompile the kernel or switch distributions, because the kernel wasn't compiled with a packet processing feature I wanted to use.