I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?
A simple packet filter firewall can only filter out packets based criteria such as source IP address and destination port number (e.g.80 and 443). But a packet from a trusted source IP address (e.g., an intranet host) and destined for port 80 (http) on the web server, may be allowed by a simple packet filter firewall. Yet that packet (well, that series of packets) can still contain malicious data, such as form input characters that make up an SQL injection attack against the web application.
A simple packet filter firewall might not necessarily be stateful, meaning it cannot look at the conversation not just the individual packets. In addition, these devices are not usually complex enough to deal with application (TCP/IP Layer 5) data and specifics. You might use a network level firewall to filter and block network attacks, but a web application firewall is designed to better deal with the specifics of HTTP requests at the application layer. Using a stateful Layer 3 firewall with a web application firewall would be a good combination.