Every Linode comes with a public IP. There is no explicit private network, but it's possible to set one up yourself. Traffic between Linodes is not billed if you use a private IP (which you need to add to your linode manually))for IPv4, or for any traffic between linodes on IPv6 (which is enabled by default, I believe). You can then either use firewall rules to block traffic except between your linodes (trusting in Linode's internal network to prevent spoofing), or use secure tunnels to create a virtual VLAN.
I'm not sure that there's much value in a firewall-only linode, since you're not really offloading much load by doing that.
You can definitely set up custom distros, I believe these are the correct instructions for doing that:
https://library.linode.com/custom-insta ... stro-howtoKeep in mind, however, that pfsense is not a Linux distribution (it's FreeBSD), and as such won't run reliably on linodes (people have gotten it running, but it's unstable).