Who has the best firewall in XP?

A client has recently decided to let its LAN to have internet access via DSL, it has been recommended to have a firewall , so the client activated the ICS feature. However, the ICS has been known to not letting outsiders in to mess things but insiders messing out. So, the cuestion is , which solutions in your experience (hardware or software , windows minded, money an issue) has proved to be the best bang for the buck and what strategy of deployment and training of users where used?