Search:

I think that many of the reasons above should suffice, don't you? It lends little control to properly secure your environment. It has no ability to track connection state, it has no concept of inside...

Correct, for one, it has no idea about connection state, second, it is very limited in that it only allows for port and protocol filtering from the "outside" and not much else.