I frankly believe that Kerio 2.1.5 is the best firewall out there. It runs at under 5,000 K memory usage which is nothing. It also allows incredibly tight control over which ports programs can use and what addresses they can contact. I also can use it to limit which programs can access my proxy. Even though it hasn't been supported in almost 3 years, it still is the best, in my opinion, for a firewall. It will also encourage to learn what your firewall is actually doing and what ports are for what type of communication.
If you have heard about the fragmented packets vulnerability, check out the thread at www.dslreports.com in the Kerio forum and see the thread on using CHX-I with Kerio. IT is what I use and I feel completely safe.
T. Ward