Ask HN: How do you build a 'firewall'?

I'm curious to know how you would build your own firewall that

1) is easily integrated by the end user. Just copy paste inside your domain registrar's DNS records

2) is responsive, and does not compromise end user's website traffic. Should be able to handle millions of traffic per hour.

Can anyone shed some light on how you would go about building your own 'firewall' that is able to intercept all http requests?

I want to then look at a time series analysis of the log and determine if a given IP address is malicious traffic or not. What sort of machine learning here is useful?