A couple of things:
For a hardware firewall, get a NAT router, which will work with any breed of computer.
A firewall does not stop malware: it only stops unsolicited data packets (things not requested by an Internet Browser, or application already behind the firewall). Unrequested packets are 'dropped' or blocked, outside the firewall.
It has no analytic capacity: it merely verifies the legitimacy of inbound & outbound traffic headers.
So if the requested webpage has an 'asset' that is malware, it is dutifully returned as requested (because the 'header' is verified as legit).
So, somewhere in your journeys if you requested a page, with a malware 'asset': bingo: the returning header is verified and malware is delivered.
Your anti-virus, anti-malware, browser configurations, and other layered defenses should be deployed for those defensive tasks.
One major reason (among several) so many machines are corrupted is the use of Internet Explorer with 'active scripting' enabled. [This is that setting: IE> Tools> Internet Options> Advanced> Security: Allow active content to run files on my computer]
This setting allows a remote server to install software to your system, which may or may not be malicious; you have no way of knowing. In effect, it's an "Open Door" policy, and subjects you to 'Drive By installs', 'Opacity based attacks', and so on.
Compromised websites (from whatever source) have 'assets' (different elements that make up the requested page); some 1st party; some 3rd party.
Whenever a page is displayed, the user's web browser will interpret the page, discover the URL address of the asset server, and request that asset. This could be an image, flash animation, video, text, or other resource from the third-party server.
Since browsers run 'on the fly', making no distinction between text and active scripting, malware can be deployed into the receiving machine as the requested asset, and the malware is installed.
So by enabling 'active scripting' and having unblocked 3rd party cookies (another 'asset') the result may be malware dutifully delivered and installed.
One of the best ways to avoid malware being installed from the Internet is to use Firefox with 'NoScript' add-on as your primary browser.
This "NS" in effect stops 'active scripting' on your doorstep...permitting you to decide whether or not to allow the site to deliver scripted assets to the browser.
Fall back on IE as a last resort, to view or interact with a sub-standard webpage. Switch back to FF when finished.
Firefox: https://www.mozilla.com/en-US/firefox/
"NoScript" add-on: https://addons.mozilla.org/en-US/firefox/collections/dunbar-pappy/dunbarpappy/
Intentional downloads from peer-2-peer sites; clicking links from known malware sources; allowing 'Active X' controls; and so on, will ultimately defeat any security barrier.