How is the QubesOS firewall implemented?

A post was split to a new topic: Sys-whonix ← sys-firewall2 leads to identity correlation

(Moved this into a new topic. Feel free to propose a title change)