The kernel already has one, however to safer (if thats the word), try smoothwall.org. It is a very good firewall and is dead easy to setup (Also works on Windows)