The issue I have with Matousec's ratings is that he rates firewalls based on their protection against leaks, not their ability to act as just firewalls. (Another way of saying it is, how well the firewall acts as for host intrusion prevention.) I question how well these tests actually translate to the real world. Nevertheless, with that in mind, the tests still have some validity...

(Note that I'm no firewall or leaktest guru. Just a skeptical reader. )