For Netfilter and a rationale behind ipfw, ipchains and iptables, check out Rusty's unreliable guides at netfilter.gnumonks.org.
Netfilter, from a security perspective, is discussed in the September 2001 issue of LJ in David A. Bandel's “Taming the Wild Netfilter”.