It's depends on your purpose of the firewall, honestly, some web application firewalls mostly offer a different solution each other.
From my own experience, I created a so called web application firewall by utilizing nginx reverse proxy to receive request first on a server, then filter them to my backend server where the real stuff located.
Nginx has a great documentation about it, you can start from it.
Then you can add your own features from your reverse proxy server. You can add a bunch of iptables rules if you prefer it, especially to provide a basic DDoS protection.
You can add mod_security also for a more advanced protection features. This guide can help you to explore it, and also some OWASP rules because (maybe) it's a common standard for people who build their firewall using mod_security.
Again, your web application firewall's feature is your own choice. It's a large field to explore, start from "hardened reverse proxy server" (cool name, eh?), you can continue to another type such as DNS based firewall, or something similar.