If you're getting the firewall to block against hackers, don't bother - the hardware one will be more than enough. If you're getting something to control application access, then I've no idea - Comodo is apparently quite decent, and many still swear by Sygate Pro, even though it's not been updated since Symantec bought it in 2005 or something.
Personally, I don't bother - just use the hardware one on my Draytek router.
I did read that the OneCare virus detector came last in a recent test, but I don't trust them at all - they put Norton top a couple of years ago.... I struggle to think anything can surpass NOD32 for protection from viruses at the moment, especially for the low memory foot-print (if that matters to you).