You could run it on the firewall if you wanted. This was designed to work in either case. If you have access to the firewall and want to deploy it there you can. If you don't have access to the firewall, but you do have access to the system running the service you'd like to protect, you can deploy it there, and the key is: you don't need to update or change the firewall for it to "just work" for both TCP and UDP ports.