Where do the packages go?

Question

Network administration

Hello.
Help clean up the mess :)
I (superficially) know that networks have an upper level: sockets/ports/etc.
I know that there is software that works with them (accepts some tcp / ip packets, or blocks them (browsers / firewalls)).
And I know that there is a network cable through which bits run in the form of an ethernet frame.
But here's what I don't understand. A packet arrives on the network card. It apparently decodes to the next level of the network hierarchy (Ethernet frame to IP packet). Then it is decoded again ... And at what point, ahem, does the firewall cut it off? How far can he get up the network stack? :)