Maybe we're talking about different things. "Firewall" traditinally means "a network filtering device that makes decisions purely based upon network traffic". That's the kind of thing I pointed you to in my previous message. You might be thinking of the expanded definition used by Microsoft: "a network filtering device that makes decisions based upon what executable is trying to do the networking". Is that what you're after? The latter type of filtering is probably possible on Linux by using selinux or apparmor, and would be much more secure than trying to do it at the wine layer. Please give that a try.
