Where does a firewall application fit into the software stack?

Question

I'm trying to figure out where a firewall application on a server fits into the software stack, and at what point in the networking process the firewall "kicks in," from the perspective of an application on a server trying to communicate out, through the software firewall on the same server.

Without a firewall:

program asks OS for port; then poof:
program --> port --> internet

Where does firewall fit?

program asks OS for port; then poof:
program --> firewall(block/pass) --> port --> internet

or

program asks OS for port; then poof:
program --> port --> firewall(block/pass) --> internet

Answer 1

Put simply, the local firewall on your machine acts as a gatekeeper for actual traffic that will be passing through your operating system's network stack.

So, it'd go as such:

Software -> Network Stack (In/Out) -> Firewall -> Network

It does not prevent port bindings as the kernel handles this. It will however prevent traffic on the port(s) if configured to do so.

Answer 2

There are (for all practical purposes) two different layers in play with what you're asking.

An app asking for a port binding is at a different level than where the firewall operates. An app will talk directly to the TCP/IP stack to get a binding. That happens completely independently of any firewall, regardless of if the firewall is local to the app host or a remote system.

Firewalls will intercept packets on ports they are configured to pay attention to once the bindings have already been granted. Then, once packets start flowing through those ports, the firewall can do its work and inspect the traffic. That's when the firewall will do it's allowing or blocking.