I am currently using a paid security system that includes a firewall. It is rather expensive and I know you are a believer in iThemes. I don't think they include a firewall. Is a firewall necessary with iThemes?
The functions of a firewall are handled by your webhost. But there are different ways into a WordPress website, and these can be blocked by iThemes Security. Also, iThemes Security can block attempts to hack into your site.
No, it doesn't appear that it has web application firewall features. Here is the statement from their website:
For a WordPress firewall solution, we strongly recommend using Sucuri’s Website Firewall (WAF) along with the iThemes Security plugin. While iThemes Security hardens your WordPress application, Sucuri’s Website firewall works on the server level to provide a deeper layer of security.