In the drawing below you have three networks which are connected though a firewall. The role of the firewall is to limit the traffic between these networks.
Limiting the traffic means that you can decide that only traffic going to a certain port (say,
22) is allowed, how often you can connect to a given host from another one etc.
There is nothing special neither in the networks nor in the ports.
Some networks have special names, like
Internet for instance. For a firewall this is a network like others. Some other networks may be called
Historically, networks having special usages were names with their own names.
DMZ is an example of such a network. The idea is that this is a network which is exposed to a "public" one (usually called
Internet) and to a "private" one. Going further, it was designed as a sink: you can only get in there, and once you are in you do not leave to other networks. This way, if something in this network is compromised, the compromission is limited to it only.
There are other networks which got their own names:
LAN (traditionally your private network, not exposed),
WAN (traditionally a network to join your other networks, not exposed to the public one(s)), etc.
The main reason for a firewall is to ensure compartimentalization, on a device which is not part of the compartimentalized network. Only then comes the naming which is just a rough agreement to simplify the communication between network/system engineers.
To your questions now.
Conceptually a firewall is software. You can get it as a network appliance which comes with some management software, or use software firewalls (
iptableson Linux for instance) -- you will obviously needs some hardware too.
The firewall understands network packets - whether they come from Active Directory, a web server or a music stream does not matter.
You can also have a firewall built into the OS of the machine you are using - this is for instance the case for Linux and Windows. In such cases you usually firewall traffic for your machine only (you do not want anyone to connect to you for instance, even if you have exposed some service)
Please note that a lot of this traditional naming is now obsolete and is really used as a high-level simplification.
Note: This is a simplified view, mostly true (= it is not complete)