IBM's 32-bit OS/2 TCP/IP stack (part of MPTS v5.3 and up) includes a powerful firewall.
This feature is a partial port of AIX SecureWay Firewall. It supports packet filters and basic IPSec tunnels. In conjunction with TCP/IP v4.1 and up, it can also turn OS/2 into a dynamic client for AIX-based Virtual Private Networks.
Unfortunately, the feature is largely undocumented and comes with no graphical configuration interface (besides the aforementioned AIX VPN client).
To address this shortcoming, I have written some documentation on how to use the firewall feature.