What do sysadmins generally use BPF or other more advanced firewall systems for? I've administered only a few production systems, and the firewalls I configure

What do sysadmins generally use BPF or other more advanced firewall systems for? I've administered only a few production systems, and the firewalls I configured were always very simple. Reject all traffic incoming except for port 22/23, 80/443 and outgoing except for to certain package management systems, that sort of thing. I admit I've done some slightly more complex things to rewrite things to implement some virtual network thing, but I don't think I did that in production.