Well, whatever kind of *software* firewall you run can be disabled (or configured) by any program running with euid = 0. I assume a decent manufacturer would let their rootkit run as root , so no firewall will protect you from that.

Look at Windows. It has a good firewall, but basically any program can open whatever ports it needs, without asking you. In Linux this is not common, but perfectly doable.

I guess you could block all outgoing ports using iptables and then check from time to time if anything has messed with your rules.

Plus if the rootkit runs in the kernel it can easily bypass the firewall. Same as decent rootkits running on Windows.