Any security difference between root based firewall (AFWall+) and non-root based ones (NetGuard)? What are the technical differences between root based firewalls (like AFWall+) and non-root based firewalls (like NetGuard)?

Is there any impact on the security effectively provided by such software?

I've already checked a bit in NetGuard's source code to make myself an idea, but I think this may still be a good question and I'm interested to get other people's analysis on the subject.

I would like to restrict such question to the core technical feature provided by such software (like the kind of firewalling: stateless or stateful, are there any hardcoded exceptions, the robustness of the code handling untrusted packets, etc.) and not on secondary features or anti-features they may have (ads, tracking, cosmetic, ...) unless they concretely affect the core objective of the software.

In other words: no rants please ;) !

In case there are limitations, it might be worth mentioning if they are implementation specific (the consequence of some choice made by the development team) or a consequence of the technology used (relying on very different systems, it is possible that one has to cope with limitations that the other does not have).
As the author of NetGuard I have first hand experience in this field.

A disadvantage of a firewall based on a local VPN is that not all traffic types can be handled, because the (Android) Linux kernel does not allow forwarding all traffic types over a socket based connection. An example is IPsec, which is being used for IP calling by some manufacturers. A partial (not for IPsec) solution to this would be to use a remote VPN server to forward traffic, but this is privacy wise not acceptable for a lot of people and would come with additional complexity and probably also with extra battery usage. In practice handling TCP and UDP traffic appears to be sufficient for 99,9% of the NetGuard users. Since Android 5 it is possible to exclude applications from being routed into the VPN (the VPN implementing application decides if this is mandatory or optional), which can be used to address problems arising from not being able to forward all traffic. Another option is to exclude address (ranges), which NetGuard uses to 'fix' IP calling for some manufacturers.

Another disadvantage is that forwarding traffic will increase battery usage on mobile devices, because it involves some processing, because packets needs to be inspected and to be forwarded. Using iptables, which is integrated in the Linux kernel, is more efficient as thus more battery friendly.

In general it has appeared that Android routes all traffic into the VPN, even traffic of system applications and components, but a manufacturer could decide to exclude certain traffic types, reducing the security that can be achieved by a VPN based firewall.

NetGuard does not analyze the data itself, except for DNS requests to provide ad blocking, but if it would it could raise a privacy concern. Nevertheless, technically seen this is an advantage of a VPN based firewall (if you still want to call it that way), because it would allow state-full inspection of data streams beyond what is possible with iptables. This would likely be at the costs of battery usage, because of the processing involved. Note that it would require a local MiT attack to inspect SSL streams.

Yet another disadvantage is that Android doesn't allow chaining of VPN's, so using a local VPN to implement a firewall will prevent using of a real VPN service, unless the firewall provides such a service itself or alternatively a forwarding or proxy mechanism to another VPN application.

Lastly, a VPN based firewall depends on the application providing the firewall VPN service to be running. This seems to be trivial, but it is not, because some manufacturer Android versions/variants are too aggressively killing processes in low memory conditions (IMHO it is a bug if Android kills applications providing a VPN service).

Finally, rooting of Android devices is becoming increasingly difficult, leaving a VPN based firewall as the only choice for many people. I don't expect Google to add a system based firewall anytime soon, because it could affect their ad revenue significantly. iOS does have a system based firewall.

Let me know if there are any questions and I will try to answer them.