Remote attackers have no direct connection with the BIOS. The only point of entry for a remote attacker is to send network packets. Network packets are interpreted by the operating system, and remote attacks work by exploiting a bug in an application or a component of the operating system itself.
Firewalls protect against remote attacks only if they block access to vulnerable applications. If you're running an Apache server and there's a vulnerability in your version of Apache, a firewall will not protect you since it has to allow HTTP requests to go through.
It is possible to have a bug in the network card's firmware. This is rare, but it has been known to happen. If the bug affects the way the network card handles packets before it transmits them to the operating system, the operating system's firewall will not help. One potential source of vulnerability is Wake-on-LAN and similar protocols if implemented incorrectly. In this particular instance, a machine is vulnerable only when it is plugged into the network but turned off! The way to protect against such attacks is to block wake-on-LAN packets from untrusted sources with a network appliance located between the machine and the hostile world.