Comparing Firewall Featureshttp://www.windowsecurity.com/articles/Com...l_Features.html
A hardware firewall is really a software firewall running on a dedicated piece of hardware or specialized device. It can provide a strong degree of protection from most forms of attacks coming from the outside. Hardware firewalls are easy to configure and they can protect every machine on a local network. A hardware firewall typically uses packet filtering to examine the header of a packet to determine its source and destination addresses. This information is compared to a set of predefined or user-created rules that determine whether the packet is allowed (forwarded) or denied (dropped) on particular ports. They tend to treat any kind of traffic traveling from the local network out to the Internet as safe which can be a security risk.
With a software firewall you can specify which applications are allowed to communicate over the Internet from your computer. Programs that are not explicitly allowed to do so are either blocked or else the user is prompted for confirmation before the traffic is allowed to pass. Software firewalls generally offer the best measure of protection against Trojans and worms but they are harder to configure. Another drawback is that they must share resources with other running processes on your computer and this can decrease performance.
Proxy Firewalls stand between a trusted and un-trusted network, inspects the entire packet and makes the connection on behalf of the source. The request does not automatically go to the destination computer. Instead, the proxy firewall impersonates the internal destination computer and accepts the request on behave of the computer it is protecting. If the proxy decides the packet is safe, it sends it onto the destination computer. When the destination computer replies, the reply goes back to the proxy server, which repackages the packet to contain the source address of the proxy server, not the host system on the internal network. The proxy hides the true network address and there is no direct connection to internal computers.