There are a fairly large number of options: iptables, firewalld, shorewall, ufw, and probably a bunch of others.
As mentioned by @AndyMac, PCI compliance is a matter of the firewall is doing (and how), and of ensuring you have monitoring.
Personally, I find shorewall is a good match here, because it has a strong notion of zones and inter-zone flows, but YMMV.
You will most likely want either a syslog daemon, or some kind of log parser, to collect and send logging to a centralised location (which is a PCI requirement).
I am not sure doing this only for a central firewall is sufficient - it may be preferable to have firewall + logging on all/most nodes.
Edited to add:
It does sound like your issue is more about logging than what firewall you use. As a first step, I would setup a test system, make sure iptables is installed, and create a rule to log all new TCP connections: iptables -I INPUT 1 -p tcp -m conntrack --ctstate NEW -j LOG --log-prefix "TEST LOGGING"
.
Then grep -r 'IN=' /var/log
, after having initiated a few connections.
If you don't see any output, check your syslog config.