There is no clear distinction between pcn-iptables and pcn-firewall in the documentation.
Clarification of the difference between pcn-iptables and the firewall service (in particular to emphasize the possibility to use the former as a drop-in replacement of iptables) and, more in general, of the difference between applications and services.