Yes, I have an idea..
I suspect the problem is that the machine is becoming hung when the firewall script attempts to remove the networking & ipfiltering modules before stopping its services.
My firewall script does the same thing (I use LutelWall) and I found that any time I issued a shutdown (STOP) command to the firewall, it would hang my machine 90% of the time when it tried to modprobe -r or rmmod the kernel modules.
My solution was to edit my firewall script itself, and comment out the module removal section. Now, when I shut it down, it does everything else it does (clear out filter rules, etc..) but leaves the kernel modules inserted. There should be no harm in doing this as far as I know (and besides, if you're shutting down or shutting off the firewall, it makes no difference.), and if you have the KMOD cronjob in your hourly cron folder, the modules will be removed within the hour anyways.
If you're unsure how to go about editing the firewall script, should you like to try this, just let us know. I'll post the section of my firewall I commented out for you.