It occurred to me that a real firewall isn't implemented in the O/S at all in the way you are talking about and that until now, unless I am wrong again, what we have been talking about is personal firewalls. It doesn't seem to me to be a good idea to run that type of firewall on anything larger scale to the extent that it would attract DOS attacks, but rather that the firewall should be implemented as separate hardware specialised enough to perform well at the right networking level.
I imagine that it could still read IP tables from a machine that does run application servers however.